5 ms·

P2P DNS

69 points by mikemoka 10y ago

brudgers 10y ago
Some historical context from 2010: http://arstechnica.com/tech-policy/2010/11/fed-up-with-icann-pirate-bay-cofounder-floats-p2p-dns-system/ http://arstechnica.com/tech-policy/2010/11/fed-up-with-icann... Codebase has not seen significant recent activity.
- nly 10y ago
  So it predates Namecoin.
simoncion 10y ago
Not that I'm criticising the work, but DNS is already P2P; it is -by design- a federated system. However, -as Mononofu's project's README notes- it is not highly tamper resistant. [0] I know that one could see this as a petty quibble, but just because something isn't tamper resistant doesn't mean it's not a P2P system. :) [0] I make liberal use of this lack of tamper resistance to provide various levels of ad and tracking blocking for all systems on my LAN. BIND's RPZs (and mechanisms similar to them) are pretty great.
- teddyh 10y ago
  What about DNSSEC? Does this not add tamper proofing?
  - simoncion 10y ago
    I'm not going to talk about DNSSEC [0], but I will make the argument that DNSSEC isn't DNS, but rather a DNS extension. [0] Mostly because being able to intelligently talk about it is currently way above my pay grade.
    - teddyh 10y ago
      That’s slightly like arguing that TCP is not IP but an extension of IP.
  - KaiserPro 10y ago
    It does, to a lesser or greater extent. The problem is that the root node/TLD provides trust for everything below it. This means that like HTTPS trust is also centralised (but also federated, which is even worse.) However I'm not an expert in DNSSEC so there could be nuances that I'm missing
  - agumonkey 10y ago
    Just yesterday I was reading and trying to setup dnscrypt. I don't understand how it differs with DNSSEC yet (if it does).
    - pilif 10y ago
      dnscrypt protects the traffic between you and your resolver. DNSSEC makes sure that the records presented by your domain have not been tampered with (though in fact it only makes sure that the records have not been tampered with by anyone but the registry or the government the registry is controlled by)
- sargun 10y ago
  I don't think DNS is P2P in the sense that all actors in the system are homogenous and equipotent. Although modern P2P systems have supernodes, they usually serve the purpose of rendezvous, and not typical operationl DNS is a more of a hierarchical system, where the roots are at the center, and they delegate trust and responsibility as necessary.
  - yyin 10y ago
    This is a more accurate description IMO. However DNS does not have to be that way. Before DNS there used to be file sharing of all the data via a single file in the simple "HOSTS file" format. Then there was a feature in DNS for sharing all the data of each nameserver, in a "zone file" format. With network bandwidth as it is today, sharing of data in bulk could be quite useful to make DNS more peer-to-peer like. People still share data, e.g., block lists. But, practically speaking, everyone running a nameserver connected to the public internet disables axfr. Also, in my view peer-to-peer supernodes do not monitor or forward all data, they only maintain address information of the peers (rendezvous as you say). DNS, as it is implemented on the public internet, is ripe with passive monitoring as all data flows through centralised points in the tree. Leaves, at the network's edge, are expected to be "dumb", needing to make hundreds single requests for the same information, 365 days per year, even when the majority of it is relatively static. Every query and response packet containing a seemingly useless "Query" field that never varies from "1". There's no pipelining (when using TCP) or packets containing more than one query. From what I understand there was interest in so-called "P2P DNS" in reaction to various incidents of censorship via the centralised points in the tree. If the leaves were truly connected as "peers", and sharing the database data directly "peer to peer", then we might have better protections against censorship. Incidentally, "DNSSEC", as advertised, appears to anticipate centralisation and usage as a CA-like system where peers at the network edge are not only dumb but incapable or verifying messages themselves without involvement of third parties. In contrast, encrypting DNS packets requires no third party assistance. It can be done by peers all by themselves. A client can encrypt queries and a nameserver can encrypt replies. Well suited to peer-to-peer style usage of DNS. Bulk DNS data can be rysnc'd between peers over SSH, or perhaps mrysnc'd among groups of peers. There is "DNS" as implemented so far and then there is "what's possible" using DNS. Peer to peer sharing of the data is hardly far-fetched. But it does not yet seem to have caught on outside of small groups doing passive monitoring, blocking and other manipulation.
- chris_wot 10y ago
  A federated system does not necessarily imply that it is a P2P system. A P2P system, however, is definitely federated.
chris_wot 10y ago
The link to the .mu site is, slightly ironically, not resolving. Anyone got a different URL/
deleted 10y ago
[deleted]
Canada 10y ago
Decentralized naming is an interesting problem. There are several problems with this design though: 1) Cheap, permanent domain squatting is possible 2) Legitimate domain owners can't recover from key loss 3) Onerous storage requirements for every node
- the8472 10y ago
  > 2) Legitimate domain owners can't recover from key loss That doesn't seem like an insurmountable obstacle to me. You could devise a scheme where there's the option of a majority of multiple offline backup keys can be used to invalidate and replace the current online key. Then it's up to the legitimate owner whether the domain is valuable enough to do that kind of key management and backup.
- kerkeslager 10y ago
  This is a problem of interest to me because I've just started working on a P2P project in Erlang that would benefit a lot from having DNS that isn't as easily squattable. Do you know of any solutions to that, or attempted solutions?
mifreewil 10y ago
Related: * Namecoin https://namecoin.info/ https://namecoin.info/ * cjdns https://github.com/cjdelisle/cjdns https://github.com/cjdelisle/cjdns
- lgierth 10y ago
  Cjdns is a p2p IPv6 network and doesn't do DNS -- I see how the name can be confusing though :) (I'm one of the developers)
  - mifreewil 10y ago
    Thanks for clarifying that - I remember hearing about the project a while ago. I looked at the most recent documentation and it did seem more like a P2P network, although I just assumed there was also some concept of decentralized DNS within the project as well.

69 points by mikemoka 10y ago

Some historical context from 2010: http://arstechnica.com/tech-policy/2010/11/fed-up-with-icann-pirate-bay-cofounder-floats-p2p-dns-system/ http://arstechnica.com/tech-policy/2010/11/fed-up-with-icann... Codebase has not seen significant recent activity.

nly 10y ago
So it predates Namecoin.

simoncion 10y ago

Not that I'm criticising the work, but DNS is already P2P; it is -by design- a federated system. However, -as Mononofu's project's README notes- it is not highly tamper resistant. [0] I know that one could see this as a petty quibble, but just because something isn't tamper resistant doesn't mean it's not a P2P system. :) [0] I make liberal use of this lack of tamper resistance to provide various levels of ad and tracking blocking for all systems on my LAN. BIND's RPZs (and mechanisms similar to them) are pretty great.

teddyh 10y ago
What about DNSSEC? Does this not add tamper proofing?
- simoncion 10y ago
  I'm not going to talk about DNSSEC [0], but I will make the argument that DNSSEC isn't DNS, but rather a DNS extension. [0] Mostly because being able to intelligently talk about it is currently way above my pay grade.
  - teddyh 10y ago
    That’s slightly like arguing that TCP is not IP but an extension of IP.
- KaiserPro 10y ago
  It does, to a lesser or greater extent. The problem is that the root node/TLD provides trust for everything below it. This means that like HTTPS trust is also centralised (but also federated, which is even worse.) However I'm not an expert in DNSSEC so there could be nuances that I'm missing
- agumonkey 10y ago
  Just yesterday I was reading and trying to setup dnscrypt. I don't understand how it differs with DNSSEC yet (if it does).
  - pilif 10y ago
    dnscrypt protects the traffic between you and your resolver. DNSSEC makes sure that the records presented by your domain have not been tampered with (though in fact it only makes sure that the records have not been tampered with by anyone but the registry or the government the registry is controlled by)
sargun 10y ago
I don't think DNS is P2P in the sense that all actors in the system are homogenous and equipotent. Although modern P2P systems have supernodes, they usually serve the purpose of rendezvous, and not typical operationl DNS is a more of a hierarchical system, where the roots are at the center, and they delegate trust and responsibility as necessary.
- yyin 10y ago
  This is a more accurate description IMO. However DNS does not have to be that way. Before DNS there used to be file sharing of all the data via a single file in the simple "HOSTS file" format. Then there was a feature in DNS for sharing all the data of each nameserver, in a "zone file" format. With network bandwidth as it is today, sharing of data in bulk could be quite useful to make DNS more peer-to-peer like. People still share data, e.g., block lists. But, practically speaking, everyone running a nameserver connected to the public internet disables axfr. Also, in my view peer-to-peer supernodes do not monitor or forward all data, they only maintain address information of the peers (rendezvous as you say). DNS, as it is implemented on the public internet, is ripe with passive monitoring as all data flows through centralised points in the tree. Leaves, at the network's edge, are expected to be "dumb", needing to make hundreds single requests for the same information, 365 days per year, even when the majority of it is relatively static. Every query and response packet containing a seemingly useless "Query" field that never varies from "1". There's no pipelining (when using TCP) or packets containing more than one query. From what I understand there was interest in so-called "P2P DNS" in reaction to various incidents of censorship via the centralised points in the tree. If the leaves were truly connected as "peers", and sharing the database data directly "peer to peer", then we might have better protections against censorship. Incidentally, "DNSSEC", as advertised, appears to anticipate centralisation and usage as a CA-like system where peers at the network edge are not only dumb but incapable or verifying messages themselves without involvement of third parties. In contrast, encrypting DNS packets requires no third party assistance. It can be done by peers all by themselves. A client can encrypt queries and a nameserver can encrypt replies. Well suited to peer-to-peer style usage of DNS. Bulk DNS data can be rysnc'd between peers over SSH, or perhaps mrysnc'd among groups of peers. There is "DNS" as implemented so far and then there is "what's possible" using DNS. Peer to peer sharing of the data is hardly far-fetched. But it does not yet seem to have caught on outside of small groups doing passive monitoring, blocking and other manipulation.
chris_wot 10y ago
A federated system does not necessarily imply that it is a P2P system. A P2P system, however, is definitely federated.

chris_wot 10y ago

The link to the .mu site is, slightly ironically, not resolving. Anyone got a different URL/

deleted 10y ago

[deleted]

Canada 10y ago

Decentralized naming is an interesting problem. There are several problems with this design though: 1) Cheap, permanent domain squatting is possible 2) Legitimate domain owners can't recover from key loss 3) Onerous storage requirements for every node

the8472 10y ago
> 2) Legitimate domain owners can't recover from key loss That doesn't seem like an insurmountable obstacle to me. You could devise a scheme where there's the option of a majority of multiple offline backup keys can be used to invalidate and replace the current online key. Then it's up to the legitimate owner whether the domain is valuable enough to do that kind of key management and backup.
kerkeslager 10y ago
This is a problem of interest to me because I've just started working on a P2P project in Erlang that would benefit a lot from having DNS that isn't as easily squattable. Do you know of any solutions to that, or attempted solutions?

mifreewil 10y ago

Related: * Namecoin https://namecoin.info/ https://namecoin.info/ * cjdns https://github.com/cjdelisle/cjdns https://github.com/cjdelisle/cjdns

lgierth 10y ago
Cjdns is a p2p IPv6 network and doesn't do DNS -- I see how the name can be confusing though :) (I'm one of the developers)
- mifreewil 10y ago
  Thanks for clarifying that - I remember hearing about the project a while ago. I looked at the most recent documentation and it did seem more like a P2P network, although I just assumed there was also some concept of decentralized DNS within the project as well.