Comment by bullen | Hacker News Reader

Comment by bullen | Hacker News Reader

I don't agree that it's decentralized, it tries to be but it's really distributed with a few root servers with a few people that have keys to them.

Eventually there will be a decentralized name system for probably a decentralized P2P radio system, and I'm trying to build that: http://radiomesh.org

But it's proving more tricky than I could have ever dreamed, right now I have scrapped 433MHz LoRa on Rasperry Zero and I'm moving to 169MHz plain radio on Raspberry Pico.

As for running your own it's very easy with these simplified lines of Java and dns4j (excluding port 53 UDP stuff):

  Message query = new Message(data);
  Header header = query.getHeader();
  Record question = query.getQuestion();
  Message response = new Message(query.getHeader().getID());
  response.getHeader().setFlag(Flags.QR);
  response.addRecord(question, Section.QUESTION);
  Name name = question.getName();
  int type = question.getType();
  int dclass = question.getDClass();
  String host = name.toString(true).toLowerCase();
  ...
  response.addRecord(new ARecord(name, dclass, 300, "someIP"), Section.ANSWER);
  ...
  response.getHeader().setFlag(Flags.AA);
  return response.toWire(512);

Everyone should run their own DNS on the same process as their HTTP and SMTP servers... because without DNS nothing exists.

There are few things more frustrating than having your DNS provider be down for hours without recourse!

Hi.

The root servers use anycast, so you can figure there are "several" nameservers with the same address scattered around the 'tubes, and distinguished by the routes announced in different places.

There are and have been alternate roots since the beginnings of internet time, notiwthstanding Mockapetris' opinion that people who advertise false root should be shot.

Writing a decent recursive nameserver is nontrivial, I've written several for specific purposes but generally I use BIND.

I concur that running a recursive server for your SMTP server is best practice because network intelligence is oftentimes utilized for spam / malware mitigation. I'm unclear why you need it for e.g. HTTP.

> few root servers with a few people that have keys to them

Well, kind of. As said, there are quite a few root servers although the control is in the hands of relatively few. Maybe you realize this, maybe you don't but yes there are keys for DNSSEC. I'm not sure exactly how it works, but several people have to cooperate to sign the root zone. They have key signing ceremonies which are televised online. During COVID I watched them drill a lockbox, because one of the keyholders couldn't make it to the ceremony; fun times.

I don't like anycast because I think it requires BGP and backbone access or similar expensive stuff. DNS should have had regions in the main protocol so that people in EU don't use a DNS server in Asia f.ex. But it's too late for that now.

I might use geolocation on my DNS replies, and unfortunately here is the 2nd flaw of DNS, the replies should follow the sent order, because as the protocol works now you either get round-robin redundancy or direct your users to the hopefully correct continent, you can't have both!

As for my brute force workaround: I use IPs for connecting as often as I can, and the hostname is just for virtual hosting to work.

So all my applications have euro., asia. and iowa. prefixes and when outside of a browser I can "hardcode" the IPs so that extra second of lookup never hits my users.

Ofcourse that requires fixed IPs and open port 53 which is something every home fiber owner should ask for to distribute the internet again!

Most recursive resolvers try to figure out which authoritative server for a domain responds fastest and use that one. If you've got enough DNS requests and enough DNS servers, it kind of works out ok without anycast. Although, I've been told that 4 authoritatives is the optimal number, which is limiting (you can do more of course, but a random internet use recalls but can't find a writeup suggesting more wasn't great in some semi-failure cases, and you can cargocult top X domains which seem to do 4 for the most part)

Advanced protocols may be able to use SRV records to distribute further traffic, but web browsers can't, so kind of stuck for them.

> Advanced protocols may be able to use SRV records to distribute further traffic, but web browsers can't

Not for lack of trying from the DNS community, more like web browsers won't. However if you haven't already you should take note of the HTTPS and SVCB DNS record types: https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-https...

Personally I don't see a use case other than advertising or surveillance for a web page doing 20 DNS lookups (and that includes CNAME chains). Having said that...

> extra second of lookup

Hrm. Sounds like you want it to work like today's internet, with today's internet services.

You're using radios, what's your traffic shaping look like UDP vs TCP? I know from experience that media devices spam the crap out of wifi (weird stuff too, like multicast MAC addresses). A common scenario is a TCP channel for control, and an accompanying UDP spew for the actual content.

DNS resolution according to the standards which were promulgated in the 1980s uses UDP, unless a (UDP) reply indicates that the request should be retried with TCP: there is no use of TCP, as in there is no "and if all else fails, retry with TCP".

For media, this provides a first mover advantage: whomever resolves their service and starts streaming first attenuates DNS resolution for the latecomers. I actually wrote about this on HN and wrote a demo TCP-only forwarder (which also conveniently does DoT) https://github.com/m3047/tcp_only_forwarder but nobody was very interested.

Point being, if DNS resolution is failing or slow and you can't / won't do traffic shaping you might want to force DNS over TCP / TLS.

There is MDNS for example. Also in terms of alternatives to BGP, you're still going to need to figure out routes. And / or, you going to have to detect loops. Different "anycast" nodes could use something like this to detect each other's presence. You could use the (IP) TTL to limit how many hops a packet will traverse looking for a particular server (no similar concept at the MAC level AFAIK). I hope you have fun!

> but yes there are keys for DNSSEC

why would you want DNSSEC?

DNSSEC works fine for me, why not? When people break it, I get early warning. When people implement it and don't utilize it, I find out. But in all seriousness my sights are on DANE and ultimately eliminating Certificate Authorities.

It's not happening, for multiple reasons.

https://educatedguesswork.org/posts/dns-security-dane/

Reasons not to DNSSEC? The biggest one is that it exposes you to misconfigurations that happen routinely even at large sites (because DNSSEC is hard to manage), for no actual security benefit. The "no actual benefit" part is my big reason, though. DNSSEC is pure path-dependence; people do it because they think they should be doing it, because a bunch of people put a standard together back in the 1990s and have been lobbying for it ever since.

If you proposed DNSSEC today, rather than in 1994, it would go nowhere. But since it's been an IETF effort for 2 decades, it now has a life of its own.

I upvoted you because you're clearly a fanatic in this space. (Hello!) However, I disagree. Viktor punches above his weight (we've gone a couple rounds).

I'm against CAs because they are fabrications who do a beauty show primarily for the browser makers, and everybody else has to deal with the fallout (eschewing political comparisons... deep breaths...); they also provide cover for "infrastructure vendors" who mint their own CAs.

They say that DNS encapsulates the two most difficult problems in data science: naming and cache expiry (I'd add delegation). So if we already have one global tribe attempting to solve this problem, how much of our attention budget do we really want to spend on people who have discovered this "new problem": CA chains: really?

There are (Derrida-not) misconfigurations which routinely happen (PeeWee Herman "I meant to do that") which clearly benefit from DNSSEC. Surely noone would configure their network to trust the name of, say a file server, which serves the executables for your short order diner. Dang. It's such a brilliant idea. Why doesn't it pan out? JasBug hasn't been solved, other than M$ saying "don't do that". What if the DNS solved it?

We're writing here for the public so yes, "CA chains" is technically inaccurate. I don't care.

https://www.youtube.com/watch?v=CVukpkWAp4Y

here is a link to the key signing ceremony if, like I was, you are interested.

Maybe it's the englisher in me, but I was hoping for more grandeur, perhaps some kind of ceremonial mace or at least a benediction.

God save the internet, and its fascist regime!

I co-develop a userspace FOSS DNS client for Android. If you only bother with UDP, you'll leak DNS over TCP. I've found adware to increasingly use TCP to bypass such naive DNS-based content blocking implementations: https://nitter.net/rethinkdns/status/1434137438901846020

The fight for privacy and security in a centralized system is a battle that is lost before it has even begun for all participants.

You need to redesign everything from scratch and be aware how the old system was flawed. The tradeoffs are usually complex high energy vs. simple low energy and it's always a good idea to start with the simple low energy.

SMTP(1971), ETHERNET(1973), IP(1974), UDP(1980), C64(1982), TCP&DNS(1983), HTTP&BGP(1989), DHCP(1993) and RASPBERRY4(2019) are never going away because they are simple. If you want to use something new make sure you are not wasting everyones time!

Edit: I added two hardware devices because they mark the first and last open personal device humans made at scale big enough to matter so that you can see the timeline properly; it took us 50 years to complete the creation loop of a global computer network.

It's going to be REALLY interesting to see what the Raspberry 5 looks like. My guess it's going to flop like the PS5 unless they REALLY increase the energy consumption of the GPU by a factor of atleast 2x, but they need to make that dynamic or the 4 will retain it's low energy value and hurt adoption (think C64 vs. 128)!

> But it's proving more tricky than I could have ever dreamed

Do you have more detailed explanations about this project? radiomesh.org homepage doesn't contain a lot of info.

You may be interested to check out projects like GNU Name System, or routing mechanisms such as CJDNS. Tor's onion services are also very interesting as a global secure naming scheme.

No, I have been iterating on different hardware for 5 years, while developing the idea in my head.

The real challenge is the physical limits and the scalability problem (radio range, bandwidth, electricity use, longevity and disc space) .

I have a working prototype for most parts so I know the project is doable, but to what extent it can successfully replace legacy systems without them faceplanting on their own is another question.

I'll check out your mentions, but I doubt they can be applied to radio.

In a decentralized system how are you handling the bad actor problem? Such as 2 entities claiming they own a namespace?

Well it will probably be some sort of hashing on the old fiber internet but at a fixed very low energy rate per message, and a bit higher energy rate for names (in a first come, first served manner with some sort of public/private key signed distributed database, just trying to not use the b-word here and with spam protection I haven't choosen yet) so far I'm concentrating on the hardware and radio hopping protocol to make sure it could scale at all, that combined with reputation: because the system is relaying your messages, you can be increasingly punished as you missbehave; which makes it hard to abuse productively. But as with all radio you will be able to disturb locally, if you have a better suggestion I'm all ears.

Ah ok. I was trying to figure out how you would fix say abc.xyz is announced by someone name squatting. Then the real abc.xyz comes along and says 'hey wait'. First come first serve fixes someone else coming along and stealing but not squatting. In all of the systems I come up with I always end up with some sort of central trusted authority/machine saying 'this is ok, that is not'.

Yes, but good point about the squatting, I know it's going to be a problem, eventually solved by the "market" but I would like something a bit leaner... thanks for stirring my noodles.

Maybe a penalty for unused names with time, but that will just drive paid spam and energy "waste"... time solves everything, I'm sure a better solution will crop up eventually, it's not like I will be done next week!

Unfortunately for us, everything is a pyramid scheme, you just have to make an as stable/fair pyramid as you can!

Oh very true. It is what I keep running into when trying to create something like this. I end up with something where 'the buck stops here' kind of deal. There is a secondary problem too of transfer of ownership. Companies split up and buy each other out all the time. So you have to have a way transfer ownership too. Which in purely technical terms looks like someone else is squatting. But they are not you want them to have it. The existing DNS business system kind of grew into all of this. As in DNS today right now does not preclude anyone not making their own set of domains. You probably could make it very decentralized just using the config options. The problem is someone 'reputable' has to verify. That becomes a weak point and place where someone can gatekeep. Adding any sort of monetary advantage will also unfortunately motivate people to gatekeep. However, money keeps the lights on...

I don't think you can do better than : you have to pay to rent in the namespace. This allows first-come first-served, and squatters, but they have to pay. Since the namespace is new, in theory there's no benefit to squatting because no particular name has any value yet.

Of course often there's a desire to mirror some existing namespace (e.g. DNS, trademarks) where there is value in the name already. In that case the best you can do is to build some oracle mechanism that consumes proofs of namespace ownership. Similar to how LE/Acme works, but used to drive an oracle.

Reply on news.ycombinator.com