Hacker News Reader

Comment by tptacek | Hacker News Reader

I just install djbdns everywhere. I have more confidence in djbdns not coughing up a shell on my machines than any other server.

DNSSEC, by the way, is a bug and not a feature.

View on HN

But what about IPv6 records or DKIM/SPF TXT entries? It is hell to maintain more than a couple of these records for djbdns. I had to use an online tool every time to help me convert my entries to tinydns format.

I switched to PowerDNS mainly for this reason.

I remember that djbdns had some other quirks too. Like I had to setup a supervisor to run it (no integration with the init system), I had to run one instance for IPv4, one for IPv6 and one for IPv4 zone transfers. Also it didn't support zone transfers over IPv6.

Maybe all these have been fixed, it is a couple years since I last used it.

I've written a library in Scheme to generate my tinydns configuration from a functional program. It includes error-checking, IPv6 and SPF support (haven't used DKIM yet). I might clean it up and publish it if there's interest.

there is at least one person who is interested :-)

Ok, I'll publish it as soon as I can at

https://github.com/pflanze/tinydns-scm

I'll send you notification when done if you give me your email (you can contact me at the URL in my profile). (Or supposedly you could "watch" the Github repo above for similar effect.)

Edit: the functionality on Github to get notifications is "watch", not "star".

djbdns is a great read and exemplary code, but I wouldn't use it in production without significant modification; it's far too easy to DOS.

TinyDNS and dnscache can each be sped up by about a factor of two by replacing a few of a hand-rolled primitives with their SIMD equivalents, but even after that neither is terribly fast and it's very easy to exhaust their limits. axfrdns is deal-breaker slow; it forks a new process for each TCP connection.

What situation are you in where you need high-volume AXFR?!

axfrdns is a confusing mis-nomer; the daemon handles all TCP DNS queries too. TinyDNS will truncate any UDP response that doesn't fit in 500 bytes (it also doesn't implement EDNS0), leaving it to be handled by axfrdns. That's about 4% of all DNS responses going on my data.

And with apologies for the domain name; http://dnsneedsfuckingtcp.info/ .

To generalize my point; DOS is a very significant risk to DNS server availability these days, and the first and best defense is to have a fast server (Knot's target of 500k qps is in the right ballpark). djbdns is single threaded, single process and doesn't even use epoll/kqueue, it's just not up to it and tops out within a few 10k qps, axfrdns won't get close to that.

https://github.com/abh/djbdns/blob/master/byte_copy.c is a good example of my earlier point too; last time I profiled tinydns it spent a lot of time in vanity routines like that; the libc implementations are factored to CPU instructions and are much better.

No disagreement with your points about Bind though.

How maintained is that? qmail is in an awful state, and djbdns hasn't been updated in relative millennia.

Being secure is a notable achievement, but that shouldn't completely hold up iterative improvements.

I'm just happy to be keeping software written during the age of the Plantagenets alive. Who knew Daniel Bernstein had such longevity?

But djbdns has had security issues in the past?

http://maradns.samiam.org/DNS.security.comparison.txt

Nope.

Am I missing something?

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1191

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0858

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4392

It just has the fewest. But they still popup from time to time.

dnscache is not the authoritative server. The link in your previous comment even mentioned this explicitly.

None of these are meaningful. BIND has a long and illustrious history of coughing up shells to attackers. Any nameserver written in C and not written by Bernstein has a high hurdle to clear.

Reply on news.ycombinator.com