Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is DNS still hard to learn?

jvns.ca

Post reply on HN
Print view View original

211–220 of 261 posts

Re: Why is DNS still hard to learn?

#211

Post by kmoser »

tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

> I think DNS is something few people take the time to learn, but it's not actually hard to learn.

Hard disagree. For me, DNS is like doing taxes: I touch it once a year or so, find it Byzantine, know enough to be dangerous, but am always frustrated that I don't use it often enough to remember exactly how to configure things without having to consult poorly written and/or overly technical tutorials.

I'd like to see a better version of web-based tools like mxtoolbox.com that will analyze DNS records, let you know what's wrong, and give you actual examples of what settings you need for things like DMARC/DKIM/SPF records. In my experience, online tutorials for setting them up come tantalizingly close to giving me what I need, but I often end up getting stuck with the last few details (usually the weird punctuation required) because, again, I touch this stuff so infrequently I just don't remember from one time to the next. Ideally I'd want a form-based tool that gives you drop-downs to select from and, when submitted, just gives you the actual record you need.

Re: Why is DNS still hard to learn?

#214

Post by AlotOfReading »

zx8080 wrote: post #201
syntheweave wrote: post #188

Earlier quoted context omitted.

This is the comment I wanted to make. DNS is one of those technologies that has a simple explanation - "it's indirection" - with consequential ramifications that turn it into someone's job. Most people will not interact with it often enough to know how to perform the job, so they remain hesitant and try not to do anything at all with it, because it burned them once before. Git is analogous - most uses of Git are form…

> Git is analogous - most uses of Git are formulaic, and the underlying concepts are simple enough - but actually accessing the right lever to pull when disaster strikes is unclear and hard to experiment with. Would you mind sharing some examples of hard-to-recover git related disaster? I ask because I previously worked with applying hundreds of patches on top of chromium (yes, Opera). This resulted in __multiple__ m…

Not OP, but I've encountered a few situations where the solution was modifying .git/ manually. The one that comes to mind was having two branches with names separated only by case on a case sensitive system, and then checking out both on a case insensitive system.

Re: Why is DNS still hard to learn?

#215

Post by mike31fr »

DNS-noob here: For what use case is it useful to debug DNS like described in this article? I'm a programmer since 2001 and I never ever had to investigate what is going on behind name resolution, I never encountered any kind of DNS-related issue.

Re: Why is DNS still hard to learn?

#216

Post by codeisawesome »

jvns wrote: post #159
tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

Hello! I wrote this post and I have a couple of things to say about this "DNS is not actually hard" take. It took me many years to feel totally comfortable debugging DNS problems, and I wrote this post to explain why I think it was hard for me. I also used to think that "no, actually, it's easy!" was an encouraging response to "this is hard to learn". And I kind of get it! I love DNS! I think it is surprisingly simpl…

Julia, I agree with your take here, thank you for bringing this thought process into the mainstream. There are many other concepts this happens with and in other ways: people sing praises of the pedagogic excellence in Skiena’s & Sedgewick’s algorithm textbooks (and the awful EPI book by Aziz et al) but I hate reading them, they’re actually written horribly to explain things, IMO. I think this form of difficult writing on top of already difficult concepts is a weird type of gate keeping (perhaps sometimes unintentional?) and it should be tackled all over Computer Science by better writers who have an explanation style like yours.

Re: Why is DNS still hard to learn?

#217

Post by einichi »

jvns wrote: post #159
tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

Hello! I wrote this post and I have a couple of things to say about this "DNS is not actually hard" take. It took me many years to feel totally comfortable debugging DNS problems, and I wrote this post to explain why I think it was hard for me. I also used to think that "no, actually, it's easy!" was an encouraging response to "this is hard to learn". And I kind of get it! I love DNS! I think it is surprisingly simpl…

Simple is not always easy. Too simple can be difficult to grasp and sometimes adding a little complexity can actually make something more intuitive and easier.

DNS is simple, but it is not necessarily easy to understand.

Re: Why is DNS still hard to learn?

#218

Post by mrweasel »

neilk wrote: post #52
tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

How did you learn DNS? And when?

For me: Volunteer systems administration for a student organization. We had a subdomain under the domain of the university and wanted to add another one. We already had Bind configured with an A and MX record. No one really wanted to deal with it, so I asked some people I knew, who recommended that given we already ran qmail, then maybe tinydns would be the best option.

So I installed tinydns, read the documentation, experimented with the subdomain we didn't use yet. Took a few tries, but not really difficult.

Later one we added more stuff, like zone transfers, all of it is pretty easy once everything is running.

One of the things that scare people away from running DNS servers is Bind and it's configuration language, it's not great. You just don't have to use Bind, or you can switch to it once you understand the concepts of DNS better.

Re: Why is DNS still hard to learn?

#219

Post by mst »

bombcar wrote: post #132
jeroenhd wrote: post #74

Earlier quoted context omitted.

I have read the RFC. I just don't mess with DNS often enough that I know all the RFC definitions from the top of my head, and I don't want to need to find the appropriate RFC(s) every time I want to debug an issue. It's not as if tools like wget bother you with http/3 spec fields every time you download something from the internet unless you explicitly ask for them, and even if they do, they're more descriptive than…

>I just don't mess with DNS often enough That's the root of all this, we only deal with DNS when something breaks, and it rarely breaks. If we did DNS all day every day it'd all be super clear and concise.

I learned DNS a bit over 20 years ago running a BIND deployment that was authoritative for somewhere over 30k customer domains.

I still tend to use nslookup over dig (yes, I know, bad mst) because I got sufficiently used to the former that I barely notice it's even there when using it - my fingers and brain are so used to it that the interface part of nslookup is mentally invisible (though I always teach other people 'dig' and 'host' instead).

I'm not sure learning it that way was exactly easier, but being (somewhat, that was far from the only service I was responsible for) immersed in it meant I at least got through the initial mental scrabbling in a relatively compressed time frame, and once you've got a coherent model built in your head life is easier.

I think this is really a very long way to say "based on doing DNS most days for a few years, I strongly suspect you're right."

Re: Why is DNS still hard to learn?

#220

Post by mst »

manuel_w wrote: post #138
jeroenhd wrote: post #43

Earlier quoted context omitted.

I think it is hard to learn... using the tools people used to learn DNS with. BIND is great at what it does, but its configuration files suck and its manual is long, terse, and unnecessarily complex sometimes. Dig is powerful, but abbreviates everything like we're on an 80 column terminal. At times Wireshark was a better tool debugging DNS issues than Dig was. Give someone PowerDNS or another modern DNS server and I…

$ ip address --color Command "--color" is unknown, try "ip address help".

Some CLI apps with subcommands accept top level options anywhere in the arguments, some - like 'ip' - expect
The advantage of that approach is that you don't have to worry about naming collisions between the command and subcommand option sets, which can be really handy - especially in applications with pluggable and/or user supplied subcommands, so you can add top level options without worrying about breaking somebody else's extensions.

The disadvantage is, well, what just happened to you.

(note that I personally really like the pedantic approach because it fits my brain, but I'm -not- trying to endorse it as better in general since it's very definitely a trade-off and one that often isn't a good one overall)

Post reply on HN