4 ms·

Are you saying that Route 53 and Cloudflare don't have distributed DNS? How could they not be, when my OLD PAL 4.2.2.2 has been distributed since the 90s?

by NDizzle 11y ago

nly 11y ago
I'm sure they have geographically distributed and anycasted servers. I'm talking more the moral or sociological impact, post-Snowden, of relinquishing control of our services to a handful of third parties en masse. It seems that building systems that are designed to be distributed, federated and cooperative isn't actually enough to overcome our natural tendency to want to pool resources and build communal lines of defence against the perceived 'Big Bad'. Broken middleboxes meant HTTP/2 needed to become TLS-only, which now means middleboxes can't be used at all, which means no caching, which means we all go to Cloudflare or another CDN as a professional MITM service. It's all fairly ludicrous. In principle the idea of ISP web caches was a good one, just like how ISP provided DNS caches are essential in keeping the Internet as we know it reliable.
- manigandham 11y ago
  HTTP/2 is not TLS only and does not require encryption. However if you are using encryption, how do you expect ISP caches to work? Like you said "middleboxes can't be used at all".
xorcist 11y ago
It depends on what you mean by "distributed". There are many servers behind Cloudflare's DNS servers, but they are all controlled by one organization. Best practice is to have your DNS servers in different AS. This is not only to have many servers all over the world, which Cloudflare solves for you, but to have them accessible over different routes, not controlled by the same people. That way a configuration error somewhere (or a bad BGP route, which happens) can not put your DNS out of service. DNS service is cheap and plentiful, and you might even have it included in your ISP deal. You might as well use it. Also note that if you secure your records with DNSSEC, none of your DNS secondaries can tamper with your data. This is by design. You do not need to place trust in the organizations running them, so that part can be left out of your SLA. It is also best practice to have all your public DNS servers mirror your primary master, which is not public. This is to make sure all your public servers are kept running even when you have operations issues with your primary.

Are you saying that Route 53 and Cloudflare don't have distributed DNS? How could they not be, when my OLD PAL 4.2.2.2 has been distributed since the 90s?

by NDizzle 11y ago

Are you saying that Route 53 and Cloudflare don't have distributed DNS? How could they not be, when my OLD PAL 4.2.2.2 has been distributed since the 90s?

nly 11y ago

I'm sure they have geographically distributed and anycasted servers. I'm talking more the moral or sociological impact, post-Snowden, of relinquishing control of our services to a handful of third parties en masse. It seems that building systems that are designed to be distributed, federated and cooperative isn't actually enough to overcome our natural tendency to want to pool resources and build communal lines of defence against the perceived 'Big Bad'. Broken middleboxes meant HTTP/2 needed to become TLS-only, which now means middleboxes can't be used at all, which means no caching, which means we all go to Cloudflare or another CDN as a professional MITM service. It's all fairly ludicrous. In principle the idea of ISP web caches was a good one, just like how ISP provided DNS caches are essential in keeping the Internet as we know it reliable.

manigandham 11y ago
HTTP/2 is not TLS only and does not require encryption. However if you are using encryption, how do you expect ISP caches to work? Like you said "middleboxes can't be used at all".

xorcist 11y ago

It depends on what you mean by "distributed". There are many servers behind Cloudflare's DNS servers, but they are all controlled by one organization. Best practice is to have your DNS servers in different AS. This is not only to have many servers all over the world, which Cloudflare solves for you, but to have them accessible over different routes, not controlled by the same people. That way a configuration error somewhere (or a bad BGP route, which happens) can not put your DNS out of service. DNS service is cheap and plentiful, and you might even have it included in your ISP deal. You might as well use it. Also note that if you secure your records with DNSSEC, none of your DNS secondaries can tamper with your data. This is by design. You do not need to place trust in the organizations running them, so that part can be left out of your SLA. It is also best practice to have all your public DNS servers mirror your primary master, which is not public. This is to make sure all your public servers are kept running even when you have operations issues with your primary.