Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is DNS still hard to learn?

jvns.ca

Post reply on HN
Print view View original

21–30 of 261 posts

Re: Why is DNS still hard to learn?

#21

Post by laserbeam »

Here's what's cool about the article:

- Presents some nice theories which make things hard to learn (infrequent use, poor tools...)

- Describes how DNS tools could be improved.

- Gives you a few gotchas for how one may shoot themselves in a foot with DNS.

Here's what's a bit (not much) less cool:

- I really have no clue if those things ACTUALLY make things hard to learn (because it's not a research paper on learning).

- It's a plug for other content on the side which actually describes the DNS protocol. I'll admit the sold content looks cool. I haven't purchased and can't vouch for the actual quality.

Re: Why is DNS still hard to learn?

#22

Post by hiAndrewQuinn »

shon wrote: post #2

It’s not. It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. dig is a little confusing. It’s more capable but less straightforward than good old nslookup (which still works fine BTW). I think partly DNS and the core protocols may seem confusing to younger people in the industry because so much stuff “just works” now. For example, today wifi routers “just work” right out…

Re/ knowing older protocols, I recently took a few weeks to read _Networking for System Administrators_ and take+review copious Anki card notes. It's incredible just how much more confident I feel around understanding networking at a high level, including both DNS and all the stuff underneath it, like `ethtool` and Ethernet frames and stuff.

I suppose this isn't surprising, since knowing things "from the ground up" is why I went for electrical engineering instead of CS in college.

Re: Why is DNS still hard to learn?

#23

Post by Dylan16807 »

andrewaylett wrote: post #19
Dylan16807 wrote: post #13

Earlier quoted context omitted.

It comes with a validity counter in seconds, and you can be very very loose about counting those seconds. It's not the hard kind of cache invalidation. You don't really have to do "invalidation" at all. And on the server side, it's perfectly acceptable to send a mix of old and new versions for a while.

That definitely helps things to work , but it makes it very much more difficult to work out why things might not be working. Not least because an unexpected cache can lead to things looking like they're working when they're actually broken at source, as well as things looking like they're still broken when you've actually fixed them at source already.

"I didn't know that cache existed" isn't because of the difficulty of invalidating the right items, though.

And the occasional cache that keeps things forever is so extra broken that it's not doing that because cache invalidation is hard, it's either a supreme misunderstanding or it's incompetence.

Re: Why is DNS still hard to learn?

#24

Post by andrewfromx »

sometimes it's hard to even know WHERE to change the settings. Last week a friend was trying to setup heroku with api.foo.com and he needed to add a CNAME to the domain so heroku would make the cert and turn it on.

I used dig, i used host, I used whois, I got invited to their aws route 53 and saw all sorts of stuff in there but each change had no affect. Finally I noticed from whois that the name servers weren't even aws they were google.

So they gave me access to the google account but no domains in there.

Finally I asked, have the CEO log in to his personal google account and sure enough, that's where the change could be made.

Re: Why is DNS still hard to learn?

#25

Post by Spooky23 »

DNS is easy in the same way that chess is. The game mechanics are straightforward, and it gets more complex from there.

DNS bears the burden of delivering you to complex IT systems. It’s abused in various ways to enforce geographic restrictions, service levels, etc. It generally works, so long as everyone upstream knows how to configure things so that downstream things they don’t know exist work well.

When things don’t work… that’s not easy.

Re: Why is DNS still hard to learn?

#26

Post by gunapologist99 »

It's probably a good idea for all IT people to have a working knowledge of how to debug DNS issues.

DNS has historically been a vector for significant security holes and it's likely that this will continue to be true for the indefinite future. These holes also lead to other vectors in nearly every other protocol like SMTP. Even the CA system used for HTTPS is highly dependent on a basically insecure protocol. (Would you notice if your bank bought a DV certificate instead of OV? likely not)

So, perhaps it's not such a bad thing that it seems hard to learn to those who don't have enough interest, since even now we see people building DNS things without taking the time to really understand the history of things like port randomization, cache poisoning, AXFR, etc.

Re: Why is DNS still hard to learn?

#27

Post by monksy »

shon wrote: post #2

It’s not. It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. dig is a little confusing. It’s more capable but less straightforward than good old nslookup (which still works fine BTW). I think partly DNS and the core protocols may seem confusing to younger people in the industry because so much stuff “just works” now. For example, today wifi routers “just work” right out…

I just wanted to add on to what you're saying:

> I think partly DNS and the core protocols may seem confusing to younger people in the industry because so much stuff “just works” now.

I've noticed it's become much worse since universities have been teaching Python to start with and with the whole aggressive comodization of developers. To some extent the social justice polices inacted in our communities to exclude people*. ("unsavory" people)

We no longer have the culture where we had kids in early ages get a desktop, learn the ins and outs, play video games, trying to pretend to be a hacker, etc. We're getting developers who barely can script in javascript, barely do html, ignore the edge cases, and generally don't have a lot of interest in the craft. It's pretty frustrating to see this.

Re: Why is DNS still hard to learn?

#28

Post by alexjplant »

shon wrote: post #2

It’s not. It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. dig is a little confusing. It’s more capable but less straightforward than good old nslookup (which still works fine BTW). I think partly DNS and the core protocols may seem confusing to younger people in the industry because so much stuff “just works” now. For example, today wifi routers “just work” right out…

When I was 14 I (poorly) administered an Active Directory environment with mail, web, and CIFS for a restaurant without understanding DNS or DHCP. Instead of setting the WRT54G's DHCP server to hand out the domain controller's static IP as the DNS server for proper name resolution I just used IP addresses and host file entries to make everything work. I also had the MX record for the domain set to the router's WAN IP and didn't have any PTR records set - the fact that e-mail delivery went as smoothly as it did is an absolute miracle in retrospect. A few years later I figured out how DNS actually worked and in my early 20s I inherited a corporate intranet where BIND was used as the nameserver for all external corporate domain zones. Moving this setup to VPSes for increased reliability taught me a _lot_ (mostly zone transfers, SOA, etc). I'm grateful for the experience but these days everything is pretty much done for you so this is a low-value activity... "IT" isn't valued the same way that "software engineering" is for better or worse.

Re: Why is DNS still hard to learn?

#29

Post by donretag »

shon wrote: post #2

It’s not. It’s one of the few things that hasn’t changed much and it’s operation is fairly straightforward. dig is a little confusing. It’s more capable but less straightforward than good old nslookup (which still works fine BTW). I think partly DNS and the core protocols may seem confusing to younger people in the industry because so much stuff “just works” now. For example, today wifi routers “just work” right out…

That is what I assumed as well, until one day I got hit by a bug involving Extension Mechanisms for DNS (EDNS). Never knew it existed. All of a sudden DNS was failing and could not understand why. Took me a long time to fix the issue.

Re: Why is DNS still hard to learn?

#30

Post by tristor »

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like dig).

It's always been a big surprise to me that my DNS expertise is what seems to be most memorable for a lot of folks I've worked with through my career, when I don't believe I know anything mystical or special. DNS is extremely well standardized, the most common server and client implementations rigorously follow the standard, and it's very easy to inspect with free tooling. It just takes some effort and time to learn, but it's not really hard.

Post reply on HN