Hacker News Reader

Comment by traceroute66 | Hacker News Reader

Honestly I think I'll be sticking to the big-boys: Knot DNS, Knot Resolver, Unbound and NSD. Those projects are well established, open-source, well maintained, battle-tested and as secure as a DNS server can be. I'm not sure what MaraDNS brings to the table that makes it exponentially better.

A single-maintainer project DNS server is not something I would be comfortable leaving exposed on the internet. Perhaps especially as there appear to be a few odd coding decisions, such as rolling your own crypto (RNG).

View on HN

I'm fairly confident that MaraDNS, first written in 2001 and still around today, counts as well established. It's a decade older than Knot DNS.

It's old than Knot, NSD, Unbound and the current iteration of Bind (not sure how much they rewrote for Bind 10, but it's a lot I believe.)

Your information may simply be out of date, but: There is no ”BIND 10”. There was an aborted attempt some years ago with that name, but the current BIND is BIND 9, and there is, AFAIK, no current plans for a BIND 10.

Eh, no? BIND 10 was under active development for years before ISC ran out of money. The continued work on BIND 9 is only happening thanks to numerous sponsors and large organizations with maintenance contracts.

You can download BIND 10 release 1.2 here: https://downloads.isc.org/isc/bind10/latest/

That latest release of that “BIND 10” is nine years old. The way I heard it, “BIND 10” was created at a time when BIND 9 development had stagnated, and BIND 10 was one of those “let’s rewrite it all” projects that you should never do¹. Consequently, it was a boondoggle, and was relatively quickly abandoned in favor of restarting BIND 9 development, which has continued very nicely ever since.

There was indeed something called “BIND 10”. There is no BIND 10.

1. <https://www.joelonsoftware.com/2000/04/06/things-you-should-...>

Semantics I guess. By your logic the Dodge Viper never existed because it was discontinued.

ISC was heavily invested in BIND 10, to the point I even got a sticker. That combined with a 1.x release are what make a software project production ready.

I'm sure everyone remembers history differently, but had ISC not gone into cost cutting mode Shane wouldn't have been laid off and we'd all be arguing over what BIND 10 alternative is best. :)

> By your logic the Dodge Viper never existed because it was discontinued.

It existed, and even still exists, since people still buy and drive it. But nobody would use that “BIND 10” release today.

This is because software is different from cars, in that you need to use an up-to-date version. You therefore depend on there being a current development branch.

In this way, software is not like cars; it’s more like something like a TV channel or a magazine subscription. If a magazine stops publishing issues, or a TV channel stops transmitting, you wouldn’t say “Omni Magazine is…” or “The Festival TV channel is…”, even though video recordings and magazine issues still exist.

Heh. I'd actually be super curious how much of a base linux system is still "actively maintained" by that metric. I gave up tilting at windmills trying to get the default whois clients in any of the major distros updated after a few months of trying.

I know that Debian, as a rule, removes packages which are not maintained “upstream”.

Regarding Whois clients specifically, it seems that Debian maintains its own Whois client: <https://github.com/rfc1036/whois> This is something which Debian usually does not do, and when it happens, it usually means that there is no updated maintained version available, but the software is too important to remove.

I've been a fan of the powerdns project for many years. I have used it for authoritative, recursive and load balancing projects with great success. These days I use their dnsdist project to have fine grained control of DNS at my house to account for my various homelab shenanigans and provide that 99.99999% uptime the family demands.

> their dnsdist project

Wow. Never heard of dnsdist, that looks cool. I will shortly be embarking on an infra-refresh that is due to include DNS, so will be sure to evaluate it !

Thanks for highlighting it.

My particular "killer app" for dnsdist right now is at my house I have 2 machines running dnsdist, set to forward to my pihole by default with health checks. If the health checks fail, the dnsdist daemons failover to google/cloudflare/etc.

This lets me run a single instance of pihole (avoiding all the issues with trying to replicate configs across multiple pihole instances) and still having a solid backup if my pihole server goes down as it is by far the most likely piece of infra to just stop working.

I also use it to route requests to my internal authoritative servers and failover to my external secondary authoritative mirrors as needed. This lets me keep all my local traffic local and still have my external failover as a catch all if my homelab infra is down to my own screw ups or some hardware failures.

Right but you forgot PowerDNS which is rare to be able to support RDBMS as its native backend with third party web UI and there's also CoreDNS which is pluggable and graduated as a CNCF project.

> you forgot PowerDNS

I didn't forget it, I know the name, however from the comments received thus-far I've not had the (genuine) pleasure of using it.

I will make an effort to ensure that changes. :)

Please also consider coredns.

Reply on news.ycombinator.com