Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is DNS still hard to learn?

jvns.ca

Post reply on HN
Print view View original

241–250 of 261 posts

Re: Why is DNS still hard to learn?

#241

Post by AlotOfReading »

pmontra wrote: post #237
AlotOfReading wrote: post #214

Earlier quoted context omitted.

Not OP, but I've encountered a few situations where the solution was modifying .git/ manually. The one that comes to mind was having two branches with names separated only by case on a case sensitive system, and then checking out both on a case insensitive system.

Wouldn't be easier to rename the branches on the case sensitive system (a throw away Linux VM would do), push, pull? Of course if the solution is editing .git/config, that's even easier, but it probably takes more than that.

It's been awhile so my memory is fuzzy, but this was at a windows-only shop back before WSL was a thing and getting a VM involved an annoying months-long requisition process. I think the repo state was actually corrupted too, so pull may not have been working.

Re: Why is DNS still hard to learn?

#242

Post by lazyant »

tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

DNS _protocol_ and _servers_ are conceptually easy. In practice, the implementations and what actually happens is not. When you type google.com in your browser, do you know exactly the workflow in your computer and the different caches it uses (browser, OS etc) and how they work?

Do you know which Linux tools use gethostbyname vs getaddrinfo and why they could give different results?

Re: Why is DNS still hard to learn?

#243

Post by teddyh »

labcomputer wrote: post #59
teddyh wrote: post #10

Earlier quoted context omitted.

> the list of DNS record types Actually authoritative list: https://www.iana.org/assignments/dns-parameters/dns-paramete... > That list also has linked references for each entry, whereas the list you gave only has references for 9 of the 51 types it lists. If we exclude entries explictly marked as experimental, obsolete, deprecated, or reserved, the list you gave is still missing these: • AMTRELAY • ATMA • AVC • DOA…

These all seem to be super-niche or obsolete though? * ATMA, ISDN, NIMLOC, EID, X25, are all for relatively niche or obsolete physical layer protocols (I guess ATM isn't that niche, but most people never run into it). * WKS, PX, NID, LP, L64, L32 seem to be defined but unused in practice (I had never even heard of ILNP, which what NID, LP, L64 and L32 are for, until I googled it just now). * RKEY, NINFO, MINFO and se…

> These all seem to be super-niche or obsolete though?

Yes, I wrote that in an edit soon after commenting; your comment was made hours after I made mine, so you should have seen it.

And, as I said, the SPF record, though obsolete, is still very commonly found, in my experience.

Re: Why is DNS still hard to learn?

#244

Post by nvahalik »

jvns wrote: post #159
tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

Hello! I wrote this post and I have a couple of things to say about this "DNS is not actually hard" take. It took me many years to feel totally comfortable debugging DNS problems, and I wrote this post to explain why I think it was hard for me. I also used to think that "no, actually, it's easy!" was an encouraging response to "this is hard to learn". And I kind of get it! I love DNS! I think it is surprisingly simpl…

Seems like maybe you are both saying: DNS the protocol is easy to understand well. DNS in he wild is much harder to understand well.

Re: Why is DNS still hard to learn?

#245

Post by yencabulator »

nvahalik wrote: post #244
jvns wrote: post #159

Earlier quoted context omitted.

Hello! I wrote this post and I have a couple of things to say about this "DNS is not actually hard" take. It took me many years to feel totally comfortable debugging DNS problems, and I wrote this post to explain why I think it was hard for me. I also used to think that "no, actually, it's easy!" was an encouraging response to "this is hard to learn". And I kind of get it! I love DNS! I think it is surprisingly simpl…

Seems like maybe you are both saying: DNS the protocol is easy to understand well. DNS in he wild is much harder to understand well.

Actually, DNS the protocol is a horribly complex beast with various compression mechanism, tricky encoding rules, workarounds for MTU limits, etc. Most people "learning DNS" never even attempt to learn the protocol.

What is reasonably easy is a high-level understanding of e.g. "given this question, this is what one expects an authoritative DNS server to respond" in the human-friendly form, covering the basic kinds of questions (A/AAAA/MX/TXT/CNAME).

Re: Why is DNS still hard to learn?

#246

Post by saghm »

vasco wrote: post #227
saghm wrote: post #175

Earlier quoted context omitted.

> Maybe everyone sees this differently? Or maybe is more than one viewpoint to it. > For example, if someone tells me that something is "actually really simple", and I did not get it yet, I tend to think that I likely (not certainly, but likely) have not found the right approach to that something yet, and once I found that way to look at it, things will resolve itself. At least in my experience, people asserting that…

> anyone could do it by just putting in the work, it's not surprising that people might interpret that as implying that people who don't have the same knowledge are either too lazy to put in the effort or not capable of it Not spending time on something doesn't mean you're lazy or stupid, that seems like your own leap. If you choose to interpret in a charitable way it just says: "if you haven't looked here don't worr…

My point is that if your goal is to teach people, you should care about framing things in a way that's conducive to the people who you want to teach. Dismissing fairly common insecurities because you don't happen to have them will significantly reduce your effectiveness at teaching, and if you don't find it worth the time to take into account feedback about how to craft your messaging more effectively, I'd argue that your priority never really was teaching in the first place.

Re: Why is DNS still hard to learn?

#247

Post by nullfield »

briHass wrote: post #187
gerdesj wrote: post #160

Earlier quoted context omitted.

"that weird dot after the top-level domain" That weird dot is called root. Without it, a name is unqualified, with it the name is completely defined. That means that context is everything. Without the dot, a resolver might add the resolver's domain or parts of it, repeatedly. Now, you and I know exactly what: host.example.co.uk is supposed to mean but without the trailing dot a resolver could try to look up host.exam…

You might actually be surprised, or at least I was, that browsers -- and typically worse, IoT junk, still generally respect the DNS server(s) served to them via DHCP or they use plain ol' 53 to the hardcoded Google/Cloudflare standards. Some (like the Facebook Portal) are tricky enough to try DNS over TLS, but insofar as my big-list-of-common-DNS-IPs in the block rule is accurate, nothing reaches out over DoH unless…

Yes, but in the end unless they change the underlying transport (i.e. TCP/IP) to something that is not the Internet, you can still see that the traffic is happening and block the endpoint.

If the device doesn’t work after that, well, maybe I didn’t need it.

Re: Why is DNS still hard to learn?

#248

Post by firexcy »

jeroenhd wrote: post #43
tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

I think it is hard to learn... using the tools people used to learn DNS with. BIND is great at what it does, but its configuration files suck and its manual is long, terse, and unnecessarily complex sometimes. Dig is powerful, but abbreviates everything like we're on an 80 column terminal. At times Wireshark was a better tool debugging DNS issues than Dig was. Give someone PowerDNS or another modern DNS server and I…

I think old CLI tools are hard to use because they were designed to be machine- and human-readable at the same time. They are effectively APIs in some scenarios (e.g., scripting and as linked libraries) and in others handholds. As a result they are restricted to be barely viable as either.

Re: Why is DNS still hard to learn?

#249

Post by pravus »

chefandy wrote: post #240
pravus wrote: post #236

Earlier quoted context omitted.

> Old-school FOSS nerds have a hard time admitting that they tend to be absolutely useless at considering user experience, because then that’s something On Computers that they’re not good at. New-school FOSS nerds don't seem to understand that all poor user experience concerns are because we are trying to be productive. The new style of of reduced information density and easy-to-remember names isn't useful when you a…

I've been using Linux for 25 years, spent 6 or so years doing administration type work on large Unix systems, and spent 10 years in a back-end developer role. I've somewhere in the high five figure range of hours spent contributing to FOSS software. More recently, I've gotten formal interface design education and worked in design roles. I am not a 'new school' FOSS nerd by any measure. > New-school FOSS nerds don't s…

> I've been using Linux for 25 years, spent 6 or so years doing administration type work on large Unix systems, and spent 10 years in a back-end developer role. I've somewhere in the high five figure range of hours spent contributing to FOSS software. More recently, I've gotten formal interface design education and worked in design roles. I am not a 'new school' FOSS nerd by any measure.

If you have trouble with tools like dig, you have wasted a lot of fucking time.

Re: Why is DNS still hard to learn?

#250

Post by gerdesj »

briHass wrote: post #187
gerdesj wrote: post #160

Earlier quoted context omitted.

"that weird dot after the top-level domain" That weird dot is called root. Without it, a name is unqualified, with it the name is completely defined. That means that context is everything. Without the dot, a resolver might add the resolver's domain or parts of it, repeatedly. Now, you and I know exactly what: host.example.co.uk is supposed to mean but without the trailing dot a resolver could try to look up host.exam…

You might actually be surprised, or at least I was, that browsers -- and typically worse, IoT junk, still generally respect the DNS server(s) served to them via DHCP or they use plain ol' 53 to the hardcoded Google/Cloudflare standards. Some (like the Facebook Portal) are tricky enough to try DNS over TLS, but insofar as my big-list-of-common-DNS-IPs in the block rule is accurate, nothing reaches out over DoH unless…

I've spent over 20 years running DNS servers, web proxies etc. I also happily run quite a lot of IoT crap. I have two VLANs at home - THINGS and SEWER. SEWER is for stuff that really scares me! SEWER has layer 2 (MAC) isolation.

For a laugh, on my laptop (Arch BTW) I block one of my browsers from all external access except via a local Squid proxy with bump n splice - man in the middle, but at least I am the man.

In general I am an optimist. I think we are going through growing pains, akin to dealing with a teenager ("I hate you"). Mr Google and the other school bullies will be gradually brought into line and we will all be gradually dragged into the future. It may well not be as envisioned by anyone. However the climate is a bit of a snag and that might be more important.

We live in a time when my grand daughters are able to cavort on a Chinese media platform and multiple American ones to the entire world as an audience. They look pretty cool whilst doing it - they have media and make up skills and more. I used be able to flick beer mats or something.

The world is twisting and turning in front of our eyes and I for one am out of breath (ex smoker!)

Post reply on HN