Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mess with DNS

jvns.ca

Post reply on HN
Print view View original

71–80 of 94 posts

Re: Mess with DNS

#71

Post by matthewaveryusa »

anderspitman wrote: post #53

This is awesome. But I wish a service existed that made domain names easy enough to use that the average person could manage them. IMO you shouldn't have to learn DNS and TLS in order to securely use a domain name. If I want to sign up to have Fastmail host my email, why do I have to manually copy and paste a bunch of DNS records? Fastmail already knows exactly what records need to be set. I should be able to OAuth r…

The oauth flow you just mentioned exists, I just did it to confirm my domain in cloudflare with google workspace: google did an oauth flow and I got a cloudflare popup asking me to add a dns record for an hour. It was very cool.

Re: Mess with DNS

#73

Post by jeroenhd »

Neat project! Setting up your own DNS server for a throwaway domain is definitely a pain, especially if you've never done so and use anything other than PowerDNS really, so this is useful for messing around with.

I do hope the author has set some limits on the DNS configuration you can freely enter. One annoying trick DDoS spammers will use is that they will set up DNS records that are as large as possible to use for their botnet's amplification attack, so allowing them arbitrarily large requests on your domain may be problematic and may cause nasty complaints against your domain. I'd recommend anyone running a free subdomain service (or something super cool like this!) to consider this in their configuration. We can't have nice things because of these bad people :(

Re: Mess with DNS

#75

Post by anderspitman »

matthewaveryusa wrote: post #71
anderspitman wrote: post #53

This is awesome. But I wish a service existed that made domain names easy enough to use that the average person could manage them. IMO you shouldn't have to learn DNS and TLS in order to securely use a domain name. If I want to sign up to have Fastmail host my email, why do I have to manually copy and paste a bunch of DNS records? Fastmail already knows exactly what records need to be set. I should be able to OAuth r…

The oauth flow you just mentioned exists, I just did it to confirm my domain in cloudflare with google workspace: google did an oauth flow and I got a cloudflare popup asking me to add a dns record for an hour. It was very cool.

This is news to me. Can you provide more details or point to some documentation of this feature?

Re: Mess with DNS

#76

Post by anderspitman »

wpietri wrote: post #65
anderspitman wrote: post #53

This is awesome. But I wish a service existed that made domain names easy enough to use that the average person could manage them. IMO you shouldn't have to learn DNS and TLS in order to securely use a domain name. If I want to sign up to have Fastmail host my email, why do I have to manually copy and paste a bunch of DNS records? Fastmail already knows exactly what records need to be set. I should be able to OAuth r…

That's a good idea, but it would require all the registrars agreeing on a few different protocols and people doing the hard work of implementing them reliably at many, many, many different participants. Since lots of those participants are competitors (e.g., many registrars provide hosting, email service, etc), I think it would be very hard to get enough momentum that places like, say, GoDaddy would feel obligated to…

It seems like a pretty useful feature one of the big boys could offer to differentiate themselves. Or I could see a new entrant in the domain seller space marketing this as a main feature.

Re: Mess with DNS

#77

Post by silisili »

NelsonMinar wrote: post #46

This tool is so neat! One thing I've learned from it is my ISP (sonic.net) seems to be doing queries to _.example.com. For instance: $ dig @50.0.1.1 nelson.lily6.messwithdns.com a Results in two queries being answered by the messwithdns server. One for nelson.lily6.messwithdns.com as expected, but also one for _.lily6.messwithdns.com. Any guesses what that naked underscore query is for? Not every nameserver does it (…

As others answered, something called qname minimization. Others gave detailed explanations, so I'll try to be shorter.

In DNS, the recursive resolver sends the entire FQDN each time to every step.

Now realize, like every company, DNS operators want to collect and sell your data.

So imagine a 'bigsite.com' that does a lot of things. And you like, say porn.bigsite.com. Without this minimization, everyone from the root to verisign to bigsite knows what you queried for.

Re: Mess with DNS

#78

Post by silisili »

I just want to applaud this for the effort.

I've seen jvns take a similar path to me in engineering over the years, almost uncannily. The difference mostly is that I stored it all in my head, and they take the time to write it up for everyone.

Same with DNS. DNS is such a freakin black box, mostly because outside of RFCs, it's some good ol boys club of 'consultants' that don't want to share information. You should see the mailing lists, it's a giant pissing contest.

Back on point, I always wanted to distill this information down to make it for everyone, but always hit some small hurdle like... making a website about it.

That Julia takes the time to do this and share this is invaluable. It's like a better version of me exists out there, and I'm happy for it.

Re: Mess with DNS

#79

Post by thammyvienula »

Ula House Spa: Giữa thật giả của ngành làm đẹp, luôn đề cao giá trị cốt lõi là khách hàng Không thể phủ nhận rằng thời đại của nền công nghiệp làm đẹp đã tới. Trước đây, khi nhắc tới “Spa”, người ta sẽ nghĩ ngay đến hoạt động xa xỉ dành cho những người ở tầng lớp thu nhập cao nhưng cho đến nay, những trung tâm thẩm mỹ hay Spa đã trở nên quá phổ biến và quen thuộc với nhiều người. Nguồn:https://eva.vn/lam-dep-moi-ngay/ula-house-spa-giua-that-gia-...

Re: Mess with DNS

#80

Post by cookiengineer »

zrm wrote: post #70
cookiengineer wrote: post #68

Earlier quoted context omitted.

After reading through the draft I think I don't understand the argument about user privacy. Does QNAME minimization try to prevent the scenario where a malicious party has setup a DNS tracker that responds with the same A/AAAA entries for a specific subdomain in the sense that e.g. "session-id.actualserver.company.tld" results in the same entries as "actualserver.company.tld"? How would a client detect this before ac…

QNAME minimization is for recursive resolvers. The scenario is that you want to resolve alice.example.com but you don't want the root servers or the .com servers to know any more information than they need to. Historically you would send the whole query to all servers. Even the root servers would see the entire fully-qualified domain name (alice.example.com) even though all they're going to do is refer you to the .co…

Ahhh! Now it makes sense.

I didn't have in mind that an ISP could have their own map of all zones where they simply map observed specific DNS traffic to the zones themselves because they know which server is responsible as well.

Thanks for the explanation! :)

Post reply on HN