3 ms·

This should be a warning to everyone that was affected by this. Even the dependencies that you don't normally think about go down at some point. For DNS, make s

• buro9 10y ago
  > For DNS, make sure you are using multiple DNS providers. In this case, that would have made it worse. If your domain CNAMEs off another provider (as nearly all SaaS solutions do, as do mapping to AWS servers, etc) then you would have been affected by the attack on Dyn regardless of whether you could change your nameserver in time and have multiple providers at that level. If you don't have any CNAMEs, then I think the better choice is to go same-origin same-provider for everything. Which may sound bizarre... my personal sites (a lot of forums) would either be up or down. I would argue that availability having a binary nature is a lot better for end users than a constantly broken half-state that is frustrating or impossible to use at any time even though a graph might show partial availability. A hard sudden failure shows up better in monitoring, triggers end user feedback faster, and is in many ways easier to debug and solve. With so much CNAME'd, and SaaS still growing, replicating and failing over DNS that sits above those wouldn't buy you anything. A lot of sites lost Zendesk (their support.), Statuspage (their status.), Pagerduty (hey, they were quiet because no-one could let them know). They couldn't even help the end users having a bad time.
  • eslater 10y ago
    > In this case, that would have made it worse. It might have made little difference depending on the specifics of the records in question but it would not have made things worse.