Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is DNS still hard to learn?

jvns.ca

Post reply on HN
Print view View original

171–180 of 261 posts

Re: Why is DNS still hard to learn?

#171

Post by Aeolun »

tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

DNS itself is easy to learn. Trying to figure out why domain x doesn’t resolve to ip y is a hard problem.

Like the article points out, there’s so many layers of potential caches in between you starting a lookup and that lookup being resolved.

Re: Why is DNS still hard to learn?

#173

Post by oneplane »

I think the article hits the nail on the head. DNS itself isn't hard, but learning real-world DNS is, due to the (as described) hidden nature of many parts between intending to do a lookup and getting the expected result.

Some of this also stems from the divergence of what used to be a 'default' way to be connected to the internet (one interface, one gateway, one DNS server provider) and what is now far more common like having to figure out how to actually do the lookup in the first place (connected to multiple WANs, sometimes concurrently like LTE and WiFi) and as a user, not actually being able to tell which resolving path was used (was it the browser? the standard interface in the system C lib? was it some local resolver or recursor that sits in between the lookup? do any of them have a local cache? do any of them add special options by default?).

Even if everything works, you'd still not be able to blindly trust if the query and response used the same path in one application as it did in another. Three browsers might all use something different, and the OS itself might use something different yet again, only to have mDNS add a fifth option.

Re: Why is DNS still hard to learn?

#174

Post by alphager »

jeroenhd wrote: post #80
j16sdiz wrote: post #64

Earlier quoted context omitted.

rcvd, qr, rd, ra are defined in the RFC. It need the abbreviation to fit in the ASCII art in RFC text. back in those days, dig users are those who read rfc

I can see that they were truncated in the block diagram, but they were also explained with one or two words just lines below that. RFC1035 calls them "query"/"response", "authoritative answer", "Truncation", "Recursion Desired", "Recursion Available", and CD/AD become "Checking Disabled" and "Authentic Data". dig already translates things like record types from integers to strings, why not use the full, descriptive n…

You've gut the nail on the head: dig was designed with the needs of the 90s in mind, where terseness was a virtue (if your ram can be usefully conveyed in kilobytes, you need terse tools).

Due to backwards compatibility, the output won't be changed. Due to backwards compatibility, stuff is the tool that's installed by default.

Both can't be changed (it would break too many assumptions many scripts and programs have).

However, there are multiple dig alternatives. You just have to install them.

Re: Why is DNS still hard to learn?

#175

Post by saghm »

anyfoo wrote: post #166
jvns wrote: post #159

Earlier quoted context omitted.

Hello! I wrote this post and I have a couple of things to say about this "DNS is not actually hard" take. It took me many years to feel totally comfortable debugging DNS problems, and I wrote this post to explain why I think it was hard for me. I also used to think that "no, actually, it's easy!" was an encouraging response to "this is hard to learn". And I kind of get it! I love DNS! I think it is surprisingly simpl…

Maybe everyone sees this differently? Or maybe is more than one viewpoint to it. For example, if someone tells me that something is "actually really simple", and I did not get it yet, I tend to think that I likely (not certainly, but likely) have not found the right approach to that something yet, and once I found that way to look at it, things will resolve itself. But if people assure me that something is "hard to l…

> Maybe everyone sees this differently? Or maybe is more than one viewpoint to it.

> For example, if someone tells me that something is "actually really simple", and I did not get it yet, I tend to think that I likely (not certainly, but likely) have not found the right approach to that something yet, and once I found that way to look at it, things will resolve itself.

At least in my experience, people asserting that something lots of people have trouble understanding is "not hard" are doing so as a flex at least as often as they are trying to be helpful, so I'm surprised that a lot of people don't make the same hypothesis you do. When someone does so while also touting their status among their peers due to their knowledge and talking about how anyone could do it by just putting in the work, it's not surprising that people might interpret that as implying that people who don't have the same knowledge are either too lazy to put in the effort or not capable of it, regardless of whether that was the intended message. If the goal is to try to help people, it's more effective to communicate in a way that conveys understanding and not judgment; if someone doesn't care to improve their methodology of helping people, that's fine, but it does raise more doubts about whether they're being honest about their intentions.

Re: Why is DNS still hard to learn?

#176

Post by haroldp »

throw0101b wrote: post #101
haroldp wrote: post #97

Earlier quoted context omitted.

Can you help me find the mistake in my zone file? $ORIGIN example.net. $TTL 900 @ IN SOA ns1.example.com. hostmaster@example.com. ( 20230728001 1800 300 3600 172800 ) @ IN NS 8.8.8.8. @ IN NS 8.8.4.4. @ IN CNAME example.com. @ IN MX 10 172.253.124.27 www IN CNAME example.com

Off the top of my head (haven't had to do zone files for ~2 years): * hostmaster@example.com -> hostmaster.example.com * NS records are usually hostnames (not sure if IPs are even valid) * Ditto for MX records ; also add a period to the end, otherwise example.net will get appended * Also appending with the www record See also: * https://linux.die.net/man/8/named-checkzone

Pretty good! :)

Besides what was mentioned by others, there are two more mistakes in the SOA and one in each NS.

Re: Why is DNS still hard to learn?

#177

Post by wbl »

pests wrote: post #137
redundantly wrote: post #104

Earlier quoted context omitted.

I believe both you and the parent meant to escape the dot, as to only return lines with a dot in them: dig example.com | awk '/\./ && !/^;/ {print $5}' If it isn't escaped it'll just match on everything. If matching everything was intended then you don't need it at all: dig example.com | awk '!/^;/ {print $5}' Will strip out the lines beginning with a semi-colon. However, parsing the output of `dig` this way is not n…

Remind me again where this weird syntax came from for passing arguments?

- is allowed in domains

Re: Why is DNS still hard to learn?

#178

Post by rsync »

The question I have is:

Why isn't there a combined MTA/DKIM/DNS server ?

Why am I installing and configuring and running and monitoring all of these different server software packages ?

I'd like to have a single config file that handles everything required to run a mailserver.

If I have more complex needs I can split things up make them modular ... but I don't.

Re: Why is DNS still hard to learn?

#179

Post by riffic »

jvns wrote: post #159
tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

Hello! I wrote this post and I have a couple of things to say about this "DNS is not actually hard" take. It took me many years to feel totally comfortable debugging DNS problems, and I wrote this post to explain why I think it was hard for me. I also used to think that "no, actually, it's easy!" was an encouraging response to "this is hard to learn". And I kind of get it! I love DNS! I think it is surprisingly simpl…

an aside your content is top notch in quality and I always point to your site(s) when I want to share how this stuff works with an easy explainer. You make it seem easy :)

Re: Why is DNS still hard to learn?

#180

Post by phist_mcgee »

sdf4j wrote: post #151
dahfizz wrote: post #133

Earlier quoted context omitted.

I disagree. The CLI is inherently a super-user oriented interface. The CLI needs to let an experienced user be as productive as possible. If you need a pretty UI with everything spelled out, you should go on GitHub and find a GUI that someone built on top of the core tool. But dumbing down the core tool is not the way to go. The --help message should be good, and the man page needs to be good, but the tool itself sho…

I disagree. I'm a super-user and as such I have to use hundreds of tools to GTD. What you call “pretty UI” I call ergonomics. So I appreciate when the tooling is respectful of my time and don’t require me to visit the man page just because the developer was so situational myopic that thought sparing a few characters was a good idea. It all smells like unconscious gatekeeping.

And don't get me started on undocumented parts of CLIs, which are unknown unknowns, especially when they hold core parts of the API.

RTFM is usually (not always) a way to gatekeep bad UX.

Post reply on HN