5 ms·

Deens: 2x faster than BIND, 25x less code [pdf]

14 points by jamii 16y ago

tptacek 16y ago
An OCaml DNS server. Or, you could just run djbdns.
- comice 16y ago
  Or powerdns: http://www.powerdns.com/content/open-source-community.aspx http://www.powerdns.com/content/open-source-community.aspx
  - tptacek 16y ago
    Your call. PowerDNS: "Over a thousand users are subscribed to our mailing list!" djbdns: No serious vulnerability has ever been found in djbdns or, if almost a decade's worth of trends continue, will ever be found in djbdns, a track record unsurpassed by any modern Internet-connected software ever written by team of people anywhere.
    - aaronblohowiak 16y ago
      A $1000 prize[1] for the first person to find a privilege escalation security hole in djbdns was awarded[2] in March 2009 to Matthew Dempsky. [1]http://cr.yp.to/djbdns/guarantee.html http://cr.yp.to/djbdns/guarantee.html [2]http://article.gmane.org/gmane.network.djbdns/13864 http://article.gmane.org/gmane.network.djbdns/13864 From: http://en.wikipedia.org/wiki/Djbdns http://en.wikipedia.org/wiki/Djbdns Of course, this may not qualify for "serious", given the very specific nature of the issue.
      - tptacek 16y ago
        The bug you cited is hard to explain in less than 4 sentences (I just tried, hard) and allows people to whom you've given control over some of your DNS records to take control over more of your DNS records. PowerDNS, on the other hand, has had remote buffer overflows. Again, your call.
- swaits 16y ago
  Or maradns. Also secure, and damn simple.
  - tptacek 16y ago
    I'll give it "more secure than BIND", but the security history page for MaraDNS does not inspire great confidence; note that several of these are memory corruption flaws, meaning you're kind of taking Trenholme's word for it on "denial of service". He does seem pretty smart, though. http://www.maradns.org/security.html#history http://www.maradns.org/security.html#history
    - foobarbazetc 16y ago
      The stuff from http://www.nlnetlabs.nl/ http://www.nlnetlabs.nl/ is better.
      - swaits 16y ago
        Thanks, I'll check it out.
- jws 16y ago
  Running djbdns wouldn't do much to demonstrate the lack of a performance penalty for type safe functional languages or the expressive power of declarative protocol specifications.
  - tptacek 16y ago
    It does if you, like many people, believe DJB isn't actually writing in C.
    - maw 16y ago
      What do you think you'd call it? I'm not disagreeing here; I've learned something (likely not enough!) from the code of his that I've read.
davidu 16y ago
Really inaccurate title. The paper says nothing about what Deens is. BIND does a lot. What does Deens do?
jamii 16y ago
More detail: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.64.1016&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.64....
deleted 16y ago
[deleted]

14 points by jamii 16y ago

tptacek 16y ago

An OCaml DNS server. Or, you could just run djbdns.

comice 16y ago
Or powerdns: http://www.powerdns.com/content/open-source-community.aspx http://www.powerdns.com/content/open-source-community.aspx
- tptacek 16y ago
  Your call. PowerDNS: "Over a thousand users are subscribed to our mailing list!" djbdns: No serious vulnerability has ever been found in djbdns or, if almost a decade's worth of trends continue, will ever be found in djbdns, a track record unsurpassed by any modern Internet-connected software ever written by team of people anywhere.
  - aaronblohowiak 16y ago
    A $1000 prize[1] for the first person to find a privilege escalation security hole in djbdns was awarded[2] in March 2009 to Matthew Dempsky. [1]http://cr.yp.to/djbdns/guarantee.html http://cr.yp.to/djbdns/guarantee.html [2]http://article.gmane.org/gmane.network.djbdns/13864 http://article.gmane.org/gmane.network.djbdns/13864 From: http://en.wikipedia.org/wiki/Djbdns http://en.wikipedia.org/wiki/Djbdns Of course, this may not qualify for "serious", given the very specific nature of the issue.
    - tptacek 16y ago
      The bug you cited is hard to explain in less than 4 sentences (I just tried, hard) and allows people to whom you've given control over some of your DNS records to take control over more of your DNS records. PowerDNS, on the other hand, has had remote buffer overflows. Again, your call.
swaits 16y ago
Or maradns. Also secure, and damn simple.
- tptacek 16y ago
  I'll give it "more secure than BIND", but the security history page for MaraDNS does not inspire great confidence; note that several of these are memory corruption flaws, meaning you're kind of taking Trenholme's word for it on "denial of service". He does seem pretty smart, though. http://www.maradns.org/security.html#history http://www.maradns.org/security.html#history
  - foobarbazetc 16y ago
    The stuff from http://www.nlnetlabs.nl/ http://www.nlnetlabs.nl/ is better.
    - swaits 16y ago
      Thanks, I'll check it out.
jws 16y ago
Running djbdns wouldn't do much to demonstrate the lack of a performance penalty for type safe functional languages or the expressive power of declarative protocol specifications.
- tptacek 16y ago
  It does if you, like many people, believe DJB isn't actually writing in C.
  - maw 16y ago
    What do you think you'd call it? I'm not disagreeing here; I've learned something (likely not enough!) from the code of his that I've read.

davidu 16y ago

Really inaccurate title. The paper says nothing about what Deens is. BIND does a lot. What does Deens do?

jamii 16y ago

More detail: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.64.1016&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.64....

deleted 16y ago

[deleted]