Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Where is the DNS headed?

potaroo.net

Post reply on HN
Print view View original

41–50 of 57 posts

Re: Where is the DNS headed?

#41

Post by bityard »

troquerre wrote: post #17
bawolff wrote: post #12

Earlier quoted context omitted.

Handshake sounds exactly like namecoin which has been here for a while. I guess its trying to be better by not requiring all nodes to be full nodes or something. I feel like that is not the reason why namecoin failed. As an aside, anyone else notice how it seems like all blockchain projects are annoyingly full of marketing speak, and talk in circles for the tech part. How hard is it to clearly and concisely list the…

Handshake took inspiration from predecessors like Namecoin but it’s very different. First is scope: Namecoin puts domain names on its blockchain under the .bit TLD whereas Handshake targets TLDs. It does so because Handshake aims to improve the security of TLS by shifting trust from CAs to its blockchain. The CA model is weak bc only a single CA among the thousands of CAs that your computer trusts needs to get compro…

If I buy a domain via auction on handshake for $20,000, who does that money go to?

Re: Where is the DNS headed?

#42

Post by gsich »

Ericson2314 wrote: post #37
dpenguin wrote: post #4

There are a lot of arguments about how DoH with TLS 1.3 will give us privacy etc by the proponents of DoH(not this article).. but it’s basically moving the trust from ISPs to CDNs. There are fewer major browsers and fewer major CDNs than ISPs, I suppose.. so not sure if it’s a good move.

Why can't the ISPs run DoH too? I agree that due to social issues the problems are fairly real (ISPs ain't gonna do shit). But on a purely technical level DoH should be fine.

They can. But the problem lies with Browsers (looking especially at Firefox) just ignoring that. The technical aspects of DoH (or DoT) are fine.

Re: Where is the DNS headed?

#43

Post by gsich »

kitteh wrote: post #9
stiray wrote: post #7

Earlier quoted context omitted.

This is also my concern. ISPs are typically located in same country making them follow the laws of that country. I belive authors of the DoH idea were doing it with good intentions but road to hell is paved with good intentions. What we are doing with DoH is actually breaking decentralised internet infrastructure to centralized (or lets say, less centralized...for now) and this was never a good thing (historywise). F…

What about your ISPs employees? Do you trust a sysadmin pulling 40-50k a year (or less) to not sell your DNS resolver data? Do you think your ISP has better controls and a security team than some of the big CDNs and cloud providers to detect and prevent this? The reason I bring it up is because I know a number of ISPs whose sysadmins were on the take and selling bulk regular dumps of DNS resolver data under the table…

>What about your ISPs employees? Do you trust a sysadmin pulling 40-50k a year (or less) to not sell your DNS resolver data?

Yes. What use do you have for that data? Especially if it's only one user. There is not much that you can do.

Re: Where is the DNS headed?

#44

Post by tasuki »

bityard wrote: post #41
troquerre wrote: post #17

Earlier quoted context omitted.

Handshake took inspiration from predecessors like Namecoin but it’s very different. First is scope: Namecoin puts domain names on its blockchain under the .bit TLD whereas Handshake targets TLDs. It does so because Handshake aims to improve the security of TLS by shifting trust from CAs to its blockchain. The CA model is weak bc only a single CA among the thousands of CAs that your computer trusts needs to get compro…

If I buy a domain via auction on handshake for $20,000, who does that money go to?

It gets burned. The original Handshake developers seem very fond of both burning money and giving it away [1].

[1] https://handshake.org/grant-sponsors/

Re: Where is the DNS headed?

#45

Post by tasuki »

ca98am79 wrote: post #25
tasuki wrote: post #14

Earlier quoted context omitted.

> How hard is it to clearly and concisely list the technical goals and properties your solution has? Very? If you find https://handshake.org/ too marketing-y (I don't) perhaps you'll find the design notes more substantial: https://handshake.org/files/handshake.txt

you can also view it at http://handshake.txt if you are using a handshake resolver

Spoiler: it's a redirect!

Re: Where is the DNS headed?

#46

Post by iso947 »

edoceo wrote: post #30
iso947 wrote: post #15

Earlier quoted context omitted.

I think it’s forcing case sensitive. I’ve never seen it though.

Case Ignore is /i

Yes. I think forcing Case sensitive in Tcl is /c (the default mode). I haven’t used tcp for 20 years but seems reasonable it could apply.

Funny how two people felt it worth modding down an attempt to answer the question.

Re: Where is the DNS headed?

#47

Post by tialaramex »

gsich wrote: post #42
Ericson2314 wrote: post #37

Earlier quoted context omitted.

Why can't the ISPs run DoH too? I agree that due to social issues the problems are fairly real (ISPs ain't gonna do shit). But on a purely technical level DoH should be fine.

They can. But the problem lies with Browsers (looking especially at Firefox) just ignoring that. The technical aspects of DoH (or DoT) are fine.

Mozilla provides a clear policy for how you get your resolver onto their list. US ISPs (the DoH resolver is only enabled by default in the US) could obey that policy and apply to be added to the list.

But it seems like none of them have done that. Maybe the policy terms are objectionable? Let's see:

"Only aggregate data that does not identify individual users or requests may be retained beyond 24 hours."

But how will the poor ISP make extra money selling DNS query information?

"When a domain requested by the user is not present, the party operating the resolver should provide an accurate NXDOMAIN response and must not modify the response or provide inaccurate responses that direct the user to alternative content."

An ISP that obeys this can't put up advertising banners or sell search engine redirects when you typo a name - they'll have to actually earn money providing Internet service instead.

Re: Where is the DNS headed?

#48

Post by kreetx »

zamadatix wrote: post #33
vetinari wrote: post #21

Earlier quoted context omitted.

> How is DoH a net loss to decentralization (by moving to a few major cloud providers) when DoH is merely encrypting the information to prevent MitM spying? It is not merely encrypting the information. Hand-in-hand comes running the resolvers (which, as you noted everyone can) and having all the DNS-using software use them. Which is much bigger problem, that causes the centralization. Applications are coming today ha…

Applications can choose to ignore the system resolver regardless if it's over UDP or HTTPS. DoH/DoT is showing up in operating system resolvers just not as fast as apps like browsers were willing/able to add it. Standard DHCP options for defining DoH details are still missing though (I think, haven't checked in a while)

I think what the parent is saying is that unencrypted DNS queries you can intercept, with DoH you couldn't do that anymore.

Re: Where is the DNS headed?

#49

Post by dredmorbius »

Ericson2314 wrote: post #36
dredmorbius wrote: post #22

Earlier quoted context omitted.

"Confirm". It prompts for verification before substituting, in vim: https://www.linux.com/training-tutorials/vim-tips-basics-sea...

oh gawd I just type the `c` out of habit now. that wasn't intentional at all.

Confirmed ;-)

Re: Where is the DNS headed?

#50

Post by bawolff »

troquerre wrote: post #17
bawolff wrote: post #12

Earlier quoted context omitted.

Handshake sounds exactly like namecoin which has been here for a while. I guess its trying to be better by not requiring all nodes to be full nodes or something. I feel like that is not the reason why namecoin failed. As an aside, anyone else notice how it seems like all blockchain projects are annoyingly full of marketing speak, and talk in circles for the tech part. How hard is it to clearly and concisely list the…

Handshake took inspiration from predecessors like Namecoin but it’s very different. First is scope: Namecoin puts domain names on its blockchain under the .bit TLD whereas Handshake targets TLDs. It does so because Handshake aims to improve the security of TLS by shifting trust from CAs to its blockchain. The CA model is weak bc only a single CA among the thousands of CAs that your computer trusts needs to get compro…

So let me get this straight:

The main innovation of handshake is they reinvented DANE on the blockchain? Don't get me wrong, DANE in DNS has some issues, but how is that an improvement from namecoin? Are you saying namecoin is incapable of storing the hash of a certificate in its name records? I'd also bet the cost of a 51% attack on handshake is significantly less than the cost of hacking a CA. [Edit: after posting this i realize im not sure the 51% attack is a relavent attack here, since "double spending" isn't going to help someone pull off a MITM]

The other inovation, is instead of scoping it so it doesnt conflict with existing system, instead handshake directly conflicts with existing DNS names. I fail to see why that is a good thing.

I will admit the auction system is an interesting solution to the cybersquatting problem. I dont think its what most people want out of a naming system (if own microsoft, i want my domain to be microsoft.com, not to wait 10 years for it to be released), but it is an interesting solution.

Post reply on HN