2 ms·

> Then there's a misguided but common phenomenon called split-horizon DNS is also common, where you serve different records as answers to the same query based o

by mmt 8y ago

> Then there's a misguided but common phenomenon called split-horizon DNS is also common, where you serve different records as answers to the same query based on what the query originator's address is. Do you consider the whole functionality of views to be misguided, or just predicating the selection of view solely on source address? I'm not sure if there's a way to handle multi-homed hosts in a more simple/elegant fashion than with views. Merely for serving distinct "internal" and "external" zones from the same server, it seems like a convenience fraught with pitfalls.

fulafel 8y ago
It's all part of the pit you start digging yourself when you start using context dependent (eg rfc1918) addresses. Everything with the IP/Internet architecture was designed to work with globally unique addresseses.
- mmt 8y ago
  > Everything with the IP/Internet architecture was designed Sure, but that statement is only true in the past tense and only for a sufficiently-past definition of "everything". One could make a similar complaint about the breakdown of classful routing and subnets, but the Internet has morphed beyond its original design, in response to the realities of how it's been used [1]. Regardless, it seems your objection is to the non-global-uniqueness of private addressing, which existed well before split-dns. Is there any separate objection you have to split-dns? [1] The wisdom of each particular decision is debatable, but I, personally, find little interest in exploring alternate-history/what-if scenarios, technical or otherwise.
  - fulafel 8y ago
    I don't really see the CIDR analogy - CIDR is in line with the end-to-end architecture and doesn't break applications using IP addresses. Anyway, consider a basic use case like an application (correctly) caching DNS records for the duration of their time-to-live metadata - and moving between networks that yield different reponses to these queries. With the added twist that different applications cache differently so now you have an incoherent view of the DNS on the same system. Another comment said it won't work with DNSSEC, that's another example stemming from going against the design and basic principles of the DNS. It's true that there are some reasonable use cases context dependent DNS replies, such CDN's returning a nearby address from a set of geographically replicated content servers, but the common internal/external split-dns setup is fundamentally unsound.
    - mmt 8y ago
      > I don't really see the CIDR analogy As an analogy, it doesn't directly apply to your particular point, which is why it's an analogy. It would apply to, say, a network engineer. > an application (correctly) caching DNS records I'm pretty sure that merely putting the word "correctly" in parentheses doesn't make it so, nor, more to the point, remove the fact of the controversy on that point. > that different applications cache differently This is merely an argument in favor of the caching being done by the OS, which would also be aware of a device moving networks. Device mobility (without reboot) is one of those relatively recent uses imposed onto the Internet. > Another comment said it won't work with DNSSEC, that's another example stemming from going against the design and basic principles of the DNS. One could lay the blame for incompatibility at the feet of DNSSEC, too, as that technology is also a response to modern needs of the Internet that has little, if anything, to do with any original design or basic principles. > the common internal/external split-dns setup is fundamentally unsound. So, again, I still can't tell what it is you're opposed to, on so fundamental a level that you would call it "unsound", with split-dns specifically, separate from the issue of private addressing being used. Is it any different if two separate nameservers are used instead of split-dns on one? Perhaps, most importantly, what's the sound, not-misguided, alternative that provides a comparable (maybe even better) experience for the user?
      - fulafel 8y ago
        Sorry to butt out, seems this deteriorated into talking past each other and is unlikely to recover.
        mmt 8y ago
        Well, OK, but I really do wish you would answer my original question as to whether you have an objection to split-dns separate/independent of anything to do with rfc1918. That's what I've been trying to do all along, which I admit requires talking past whatever point you're trying to make about private addressing and non-uniqueness. I have made a concerted attempt to address those points as they pertain specifically to my question. Of course, I also hope you'd share your proposed alternative, even for 1918. I doubt anyone here actually enjoys the pain brought about by forced NAT and non-unique IPs (naive VPNs!).

by mmt 8y ago

fulafel 8y ago

It's all part of the pit you start digging yourself when you start using context dependent (eg rfc1918) addresses. Everything with the IP/Internet architecture was designed to work with globally unique addresseses.

mmt 8y ago
> Everything with the IP/Internet architecture was designed Sure, but that statement is only true in the past tense and only for a sufficiently-past definition of "everything". One could make a similar complaint about the breakdown of classful routing and subnets, but the Internet has morphed beyond its original design, in response to the realities of how it's been used [1]. Regardless, it seems your objection is to the non-global-uniqueness of private addressing, which existed well before split-dns. Is there any separate objection you have to split-dns? [1] The wisdom of each particular decision is debatable, but I, personally, find little interest in exploring alternate-history/what-if scenarios, technical or otherwise.
- fulafel 8y ago
  I don't really see the CIDR analogy - CIDR is in line with the end-to-end architecture and doesn't break applications using IP addresses. Anyway, consider a basic use case like an application (correctly) caching DNS records for the duration of their time-to-live metadata - and moving between networks that yield different reponses to these queries. With the added twist that different applications cache differently so now you have an incoherent view of the DNS on the same system. Another comment said it won't work with DNSSEC, that's another example stemming from going against the design and basic principles of the DNS. It's true that there are some reasonable use cases context dependent DNS replies, such CDN's returning a nearby address from a set of geographically replicated content servers, but the common internal/external split-dns setup is fundamentally unsound.
  - mmt 8y ago
    > I don't really see the CIDR analogy As an analogy, it doesn't directly apply to your particular point, which is why it's an analogy. It would apply to, say, a network engineer. > an application (correctly) caching DNS records I'm pretty sure that merely putting the word "correctly" in parentheses doesn't make it so, nor, more to the point, remove the fact of the controversy on that point. > that different applications cache differently This is merely an argument in favor of the caching being done by the OS, which would also be aware of a device moving networks. Device mobility (without reboot) is one of those relatively recent uses imposed onto the Internet. > Another comment said it won't work with DNSSEC, that's another example stemming from going against the design and basic principles of the DNS. One could lay the blame for incompatibility at the feet of DNSSEC, too, as that technology is also a response to modern needs of the Internet that has little, if anything, to do with any original design or basic principles. > the common internal/external split-dns setup is fundamentally unsound. So, again, I still can't tell what it is you're opposed to, on so fundamental a level that you would call it "unsound", with split-dns specifically, separate from the issue of private addressing being used. Is it any different if two separate nameservers are used instead of split-dns on one? Perhaps, most importantly, what's the sound, not-misguided, alternative that provides a comparable (maybe even better) experience for the user?
    - fulafel 8y ago
      Sorry to butt out, seems this deteriorated into talking past each other and is unlikely to recover.
      - mmt 8y ago
        Well, OK, but I really do wish you would answer my original question as to whether you have an objection to split-dns separate/independent of anything to do with rfc1918. That's what I've been trying to do all along, which I admit requires talking past whatever point you're trying to make about private addressing and non-uniqueness. I have made a concerted attempt to address those points as they pertain specifically to my question. Of course, I also hope you'd share your proposed alternative, even for 1918. I doubt anyone here actually enjoys the pain brought about by forced NAT and non-unique IPs (naive VPNs!).