9 ms·

Decentralized DNS with the Handshake Naming System

141 points by rasengan 7y ago

skrowl 7y ago
Sounds like BitTorrent DHT, but for DNS. Is that the right take?
- pinhead26 7y ago
  Not really, the DNS data is stored in a new data structure called an "Urkel Tree" that offers small proofs and fast lookup times. Full nodes (that archive and process the entire blockchain) can serve these proofs to light clients that use the data to recursively resolve DNS.
- justinmchase 7y ago
  Close enough. I think its stored in a block chain though rather than just a p2p bittorrent network.
ryandvm 7y ago
Kind of unrelated, but if there was ever a viable use case for blockchain beyond anarchist payment systems, it seems like it would be DNS.
- T1glober 7y ago
  The closest thing there is right now would be ENS - the E stands for Ethereum. ENS domain names can mainly be used for payment for now, so I'd be sending crypto to [domain].eth where the advantage is having a readable address instead of a random-looking string. You can also host web pages on it (which I believe is helped by their IPFS) but that has seen limited use as of yet.
  - troquerre 7y ago
    I work at Namebase. Handshake is compatible with ENS actually because Handshake has reserved .eth for ENS names. Since Handshake decentralizes the top-level namespace, Handshake can serve as a gateway to other naming systems like ENS and Namecoin.
    - justinmchase 7y ago
      Um, please tell me more :) It can do that or it does do that? Also, ENS doesn't typically resolve to an IP but instead a swarm hash or a block address, what would end up resolving in those cases?
      - tynes 7y ago
        The way the the ENS integration would work is the DNS request for vitalik.eth would end up at a Handshake Authoritative Name Server and then there are certain blacklisted top level domains (.onion, .tor, .i2p, .bit and a few others) where a client for that protocol is instantiated and then a request is sent out to the appropriate system and then the response would be formatted into a DNS query by the Handshake Name Server and sent back to the client. Not implemented yet, but this is where one would implement it https://github.com/handshake-org/hsd/blob/master/lib/dns/server.js#L52 https://github.com/handshake-org/hsd/blob/master/lib/dns/ser... https://github.com/handshake-org/hnsd/blob/master/src/ns.c#L323 https://github.com/handshake-org/hnsd/blob/master/src/ns.c#L...
- rasengan 7y ago
  Totally agree. Another great thing about Handshake is the fact that this removes the need to rely on SSL CAs which have seen compromises time and time again. No more rogue SSL certificates!
linsomniac 7y ago
Namecoin seemed like an interesting idea for decentralized registration, has it gone anywhere in the years I haven't been following it?
- SkyMarshal 7y ago
  Not really. One problem is most of the good names got taken by squatters right out of the gate, like hundreds of thousands of them - irl trademarks, all the nouns in the dictionary bought by one guy, etc. Mainstream business will never adopt it for that reason, so its growth is inherently capped and most crypto natives ignore it.
  - troquerre 7y ago
    I work at Namebase, which is a domain registrar and on-ramp for Handshake. That’s what makes Handshake so compelling imo. There are a lot of mechanisms that prevent squatting: bids are locked up until auctions finish, so squatters need to pick and choose where they allocate coins. Furthermore, names are rolled out over a 52 week period (hash of the name mod 52), which means that there will still be a lot of good names available 6 months into launch. And the Alexa top 100k domains have been pre-registered, in addition to the blacklisted ICANN TLDs, so that only facebook.com can register .facebook. Finally, 70% of the coins are being airdropped to developers so the bidding power will be evenly distributed from the start — it’ll be difficult for a whale to buy up $10mm of Handshake coins and outbid everyone.
mugsie 7y ago
Yeah, because I want to have to mine a token every time I update my DNS settings. -_- I get the "global, transparent, append only log" appeal, but for the reality of most people, I don't want to rely on a blockchain converging, or processing my update in a certain amount of time. And that doesn't even cover companies (I don't agree with this, but it is a reality), that consider DNS entries private, and don't want to expose an easily scannable list of DNS entries .
- rasengan 7y ago
  You don’t need to store the zone on chain - you can actually simply include NS records and have your authoritative server elsewhere - just like DNS today!
  - mugsie 7y ago
    then I don't see the point, other than a set of tlds that half the people in the world won't be able to access ...
    - rasengan 7y ago
      The DNS ROOT becomes controlled by the people instead of ICANN - it’s the end of ceased and censored domains. Additionally, HNS also fixes the problems the CA system has today. CAs can generate certificates for any domain - even if the domain owner didn’t request it. This has led to countless occurrences of abuse.
      - mugsie 7y ago
        > The DNS ROOT becomes controlled by the people instead of ICANN - it’s the end of ceased and censored domains. Good luck with that. If there is no way to have a US court take ownership of a domain (or force someone to handover a bad faith registration), someone will either end up in jail for contempt, or it will just be banned. > Additionally, HNS also fixes the problems the CA system has today. CAs can generate certificates for any domain - even if the domain owner didn’t request it. This has led to countless occurrences of abuse. It fixes the non EV cert situation (kind of - CAA records also help this, and work on the standard internet), but doesn't fix EV certs (i.e. amzon.tld is actually Amazon LLC and not Scammers R Us Ltd.) It also ignores the reality of most major companies in the world MITM'ing all outbound traffic from offices to ensure sensitive content is not exfilled from the company - there is 0 chance of them allowing traffic out that they could not MITM.
briatx 7y ago
DNS has always been decentralized. I mean, first sentence on wikipedia: > The Domain Name System (DNS) is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network.
- deweller 7y ago
  From the article: > While DNS is already fairly decentralized, the centralization exists because of ICANN’s gatekeeper control .... ICANN ultimately has control over what internet names are acceptable – and serves as a singular point of failure.
  - jude- 7y ago
    Nothing stops you or anyone from running your own DNS root. The "hard part" of making a global DNS deployment operational isn't developing the technology; it's getting everyone to agree on all the particulars of the deployment.
    - concert-gilled 7y ago
      > Nothing stops you or anyone from running your own DNS root That is what this is doing. > Handshake is a decentralized, permissionless naming protocol compatible with DNS where every peer is validating and in charge of managing the root zone with the goal of creating an alternative to existing Certificate Authorities. Its purpose is not to replace the DNS protocol, but to replace the root zone file and the root servers with a public commons. - https://handshake.org/ https://handshake.org/
- zeroxfe 7y ago
  Decentralization can occur across many axes -- our public DNS infrastructure, for example, does not have decentralized registration or governance, which is what matters for things like privacy or censorship resistance.
  - troquerre 7y ago
danShumway 7y ago
The article and Namebase faq go into some details, but just so I understand, what are the practical effects of this beyond decentralization? - If I buy a TLD, will I own it in perpetuity, even after I die? - If we're encouraging people to register their own TLDs, won't we run into the same limited-name/squatter problems as normal domains? I get that names are being released at a trickle, but that seems like it would just put off the problem a bit. - Is this going to have the same environmental problems as Bitcoin, or will having fewer transactions mean that's less of an issue? - Is Brave the only browser looking into this, or are we also seeing buy-in from browsers like Firefox and Chrome? I'll read through whitepaper and learn the details, but if possible I'd like to know if it's worth my time to do so. I'm not necessarily feeling great about the idea of having separate TLDs for every site, but I'll admit there is something attractive about being able to register 1 TLD as a namespace, one time, and then using subdomains for every other site I ever make. It's just not clear to me how that system would scale.
- crediblewitness 7y ago
  > - If I buy a TLD, will I own it in perpetuity, even after I die? No, if you don't send a renewal transaction, the name goes up for auction again. > - Is this going to have the same environmental problems as Bitcoin, or will having fewer transactions mean that's less of an issue? Yes, it's proof of work > I'm not necessarily feeling great about the idea of having separate TLDs for every site TLD owners manage the namespace as they see fit. that includes issuing/selling/giving away sub-domains. <subdomain>.<TLD namespace>
- pinhead26 7y ago
  - Handshake TLDs need to be renewed every two years or the names go back up for auction. Renewals must include a recent block hash to prove that the name owner is still active and has _recently_ signed the renewal transaction. - Yes, names are rolled out over 52 weeks based on the hash of the name (modulo 52), which was designed to prevent squatting. The auction & renewals processes should help as well. - Yes, Handshake uses proof-of-work. It's a different algorithm (Blake2b keyed with KMAC256) than Bitcoin but still essentially relies on energy consumption for security. - I'm not aware of any other major integrations. But it is easy for users to run their OWN local light client and use it as the DNS resolver for their OS: https://github.com/handshake-org/hnsd https://github.com/handshake-org/hnsd
ryacko 7y ago
If something is worth stealing, then it would be. The majority of code isn’t infrastructure quality (equivalent to setting cement and leaving it there for a hundred years with minor maintenance). Until then, the technical flaws must be balanced with collective governance. (Incidentally, cement with such long lifespans were widely used during the Roman Empire)
crediblewitness 7y ago
This is another Handshake protocol FAQ targeted at technical folks https://github.com/handshake-org/handshake-org.github.io/blob/0a3659f574d618295ecef4bab590419fbb99da49/src/guides/protocol.md https://github.com/handshake-org/handshake-org.github.io/blo... (FYI this is a file currently staged in a pull request to the handshake docs repo on github)
troquerre 7y ago
As an FYI for HN, many of y'all are probably eligible for $400-800 of Handshake coins (HNS). Handshake is airdropping coins to open-source developers to incentivize them to check out the project. If you have over 15 followers on GitHub you can use this tool to claim coins. This is a no-strings-attached giveaway so if you want to you can also sell your coins but it'd be worth it to bid on your name before you do. You can also reach out to me at tieshun at namebase.io if you have questions about the airdrop or Handshake itself. https://github.com/handshake-org/hs-airdrop https://github.com/handshake-org/hs-airdrop
- YCuN4M00v33odS 7y ago
  Where do I get this bech32 address?
  - troquerre 7y ago
    You can generate one with a Handshake client. If you’d like help with the process and an easy way to use your coins ping me at Tieshun at Namebase.io https://github.com/handshake-org/hsd https://github.com/handshake-org/hsd
- eikenberry 7y ago
  I thought about it for a minute, then quickly skipped it when I saw the instructions. If you are hoping that free software devs will help bootstrap this by using it then you'll need to make that process much easier.
DeepYogurt 7y ago
The title is a bit misleading. This is not an alteration to the DNS system, but rather a brand new naming system.
- rasengan 7y ago
  > This is not an alteration to the DNS system, but rather a brand new naming system. The existing TLDs will continue to be held by the existing TLD holders. So, as an example, news.ycombinator.com will still work! This is truly a drop-in replacement of the DNS ROOT giving power back to the people.
justinmchase 7y ago
Thats cool. Also ENS (Ethereum Name Service) on the ethereum block chain is really cool, though its more for resolving to swarm hashes or block addresses... which are for decentralized documents and apps. https://manager.ens.domains/ https://manager.ens.domains/
tittysprinkles 7y ago
This all looks and sounds really great but I have one big question. If this requires a proof of work chain, why not just build it on top of Bitcoin? Then you wouldn't have to convince people to spin up a new node for a separate chain. This seems like an obvious choice to take advantage of Bitcoin's network effects and inherent chain security. You could even lock up some bitcoin and issue bitcoin-backed Handshake tokens and continue operations as normal.
dang 7y ago
Related from last year: https://news.ycombinator.com/item?id=17673922 https://news.ycombinator.com/item?id=17673922
Proven 7y ago
Like Namecoin half a dozen years ago, but with an ICO or some other trick?

141 points by rasengan 7y ago

skrowl 7y ago

Sounds like BitTorrent DHT, but for DNS. Is that the right take?

pinhead26 7y ago
Not really, the DNS data is stored in a new data structure called an "Urkel Tree" that offers small proofs and fast lookup times. Full nodes (that archive and process the entire blockchain) can serve these proofs to light clients that use the data to recursively resolve DNS.
justinmchase 7y ago
Close enough. I think its stored in a block chain though rather than just a p2p bittorrent network.

ryandvm 7y ago

Kind of unrelated, but if there was ever a viable use case for blockchain beyond anarchist payment systems, it seems like it would be DNS.

T1glober 7y ago
The closest thing there is right now would be ENS - the E stands for Ethereum. ENS domain names can mainly be used for payment for now, so I'd be sending crypto to [domain].eth where the advantage is having a readable address instead of a random-looking string. You can also host web pages on it (which I believe is helped by their IPFS) but that has seen limited use as of yet.
- troquerre 7y ago
  I work at Namebase. Handshake is compatible with ENS actually because Handshake has reserved .eth for ENS names. Since Handshake decentralizes the top-level namespace, Handshake can serve as a gateway to other naming systems like ENS and Namecoin.
  - justinmchase 7y ago
    Um, please tell me more :) It can do that or it does do that? Also, ENS doesn't typically resolve to an IP but instead a swarm hash or a block address, what would end up resolving in those cases?
    - tynes 7y ago
      The way the the ENS integration would work is the DNS request for vitalik.eth would end up at a Handshake Authoritative Name Server and then there are certain blacklisted top level domains (.onion, .tor, .i2p, .bit and a few others) where a client for that protocol is instantiated and then a request is sent out to the appropriate system and then the response would be formatted into a DNS query by the Handshake Name Server and sent back to the client. Not implemented yet, but this is where one would implement it https://github.com/handshake-org/hsd/blob/master/lib/dns/server.js#L52 https://github.com/handshake-org/hsd/blob/master/lib/dns/ser... https://github.com/handshake-org/hnsd/blob/master/src/ns.c#L323 https://github.com/handshake-org/hnsd/blob/master/src/ns.c#L...
rasengan 7y ago
Totally agree. Another great thing about Handshake is the fact that this removes the need to rely on SSL CAs which have seen compromises time and time again. No more rogue SSL certificates!

linsomniac 7y ago

Namecoin seemed like an interesting idea for decentralized registration, has it gone anywhere in the years I haven't been following it?

SkyMarshal 7y ago
Not really. One problem is most of the good names got taken by squatters right out of the gate, like hundreds of thousands of them - irl trademarks, all the nouns in the dictionary bought by one guy, etc. Mainstream business will never adopt it for that reason, so its growth is inherently capped and most crypto natives ignore it.
- troquerre 7y ago
  I work at Namebase, which is a domain registrar and on-ramp for Handshake. That’s what makes Handshake so compelling imo. There are a lot of mechanisms that prevent squatting: bids are locked up until auctions finish, so squatters need to pick and choose where they allocate coins. Furthermore, names are rolled out over a 52 week period (hash of the name mod 52), which means that there will still be a lot of good names available 6 months into launch. And the Alexa top 100k domains have been pre-registered, in addition to the blacklisted ICANN TLDs, so that only facebook.com can register .facebook. Finally, 70% of the coins are being airdropped to developers so the bidding power will be evenly distributed from the start — it’ll be difficult for a whale to buy up $10mm of Handshake coins and outbid everyone.

mugsie 7y ago

Yeah, because I want to have to mine a token every time I update my DNS settings. -_- I get the "global, transparent, append only log" appeal, but for the reality of most people, I don't want to rely on a blockchain converging, or processing my update in a certain amount of time. And that doesn't even cover companies (I don't agree with this, but it is a reality), that consider DNS entries private, and don't want to expose an easily scannable list of DNS entries .

rasengan 7y ago
You don’t need to store the zone on chain - you can actually simply include NS records and have your authoritative server elsewhere - just like DNS today!
- mugsie 7y ago
  then I don't see the point, other than a set of tlds that half the people in the world won't be able to access ...
  - rasengan 7y ago
    The DNS ROOT becomes controlled by the people instead of ICANN - it’s the end of ceased and censored domains. Additionally, HNS also fixes the problems the CA system has today. CAs can generate certificates for any domain - even if the domain owner didn’t request it. This has led to countless occurrences of abuse.
    - mugsie 7y ago
      > The DNS ROOT becomes controlled by the people instead of ICANN - it’s the end of ceased and censored domains. Good luck with that. If there is no way to have a US court take ownership of a domain (or force someone to handover a bad faith registration), someone will either end up in jail for contempt, or it will just be banned. > Additionally, HNS also fixes the problems the CA system has today. CAs can generate certificates for any domain - even if the domain owner didn’t request it. This has led to countless occurrences of abuse. It fixes the non EV cert situation (kind of - CAA records also help this, and work on the standard internet), but doesn't fix EV certs (i.e. amzon.tld is actually Amazon LLC and not Scammers R Us Ltd.) It also ignores the reality of most major companies in the world MITM'ing all outbound traffic from offices to ensure sensitive content is not exfilled from the company - there is 0 chance of them allowing traffic out that they could not MITM.

briatx 7y ago

DNS has always been decentralized. I mean, first sentence on wikipedia: > The Domain Name System (DNS) is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network.

deweller 7y ago
From the article: > While DNS is already fairly decentralized, the centralization exists because of ICANN’s gatekeeper control .... ICANN ultimately has control over what internet names are acceptable – and serves as a singular point of failure.
- jude- 7y ago
  Nothing stops you or anyone from running your own DNS root. The "hard part" of making a global DNS deployment operational isn't developing the technology; it's getting everyone to agree on all the particulars of the deployment.
  - concert-gilled 7y ago
    > Nothing stops you or anyone from running your own DNS root That is what this is doing. > Handshake is a decentralized, permissionless naming protocol compatible with DNS where every peer is validating and in charge of managing the root zone with the goal of creating an alternative to existing Certificate Authorities. Its purpose is not to replace the DNS protocol, but to replace the root zone file and the root servers with a public commons. - https://handshake.org/ https://handshake.org/
zeroxfe 7y ago
Decentralization can occur across many axes -- our public DNS infrastructure, for example, does not have decentralized registration or governance, which is what matters for things like privacy or censorship resistance.
- troquerre 7y ago

danShumway 7y ago

The article and Namebase faq go into some details, but just so I understand, what are the practical effects of this beyond decentralization? - If I buy a TLD, will I own it in perpetuity, even after I die? - If we're encouraging people to register their own TLDs, won't we run into the same limited-name/squatter problems as normal domains? I get that names are being released at a trickle, but that seems like it would just put off the problem a bit. - Is this going to have the same environmental problems as Bitcoin, or will having fewer transactions mean that's less of an issue? - Is Brave the only browser looking into this, or are we also seeing buy-in from browsers like Firefox and Chrome? I'll read through whitepaper and learn the details, but if possible I'd like to know if it's worth my time to do so. I'm not necessarily feeling great about the idea of having separate TLDs for every site, but I'll admit there is something attractive about being able to register 1 TLD as a namespace, one time, and then using subdomains for every other site I ever make. It's just not clear to me how that system would scale.

crediblewitness 7y ago
> - If I buy a TLD, will I own it in perpetuity, even after I die? No, if you don't send a renewal transaction, the name goes up for auction again. > - Is this going to have the same environmental problems as Bitcoin, or will having fewer transactions mean that's less of an issue? Yes, it's proof of work > I'm not necessarily feeling great about the idea of having separate TLDs for every site TLD owners manage the namespace as they see fit. that includes issuing/selling/giving away sub-domains. <subdomain>.<TLD namespace>
pinhead26 7y ago
- Handshake TLDs need to be renewed every two years or the names go back up for auction. Renewals must include a recent block hash to prove that the name owner is still active and has _recently_ signed the renewal transaction. - Yes, names are rolled out over 52 weeks based on the hash of the name (modulo 52), which was designed to prevent squatting. The auction & renewals processes should help as well. - Yes, Handshake uses proof-of-work. It's a different algorithm (Blake2b keyed with KMAC256) than Bitcoin but still essentially relies on energy consumption for security. - I'm not aware of any other major integrations. But it is easy for users to run their OWN local light client and use it as the DNS resolver for their OS: https://github.com/handshake-org/hnsd https://github.com/handshake-org/hnsd

ryacko 7y ago

If something is worth stealing, then it would be. The majority of code isn’t infrastructure quality (equivalent to setting cement and leaving it there for a hundred years with minor maintenance). Until then, the technical flaws must be balanced with collective governance. (Incidentally, cement with such long lifespans were widely used during the Roman Empire)

crediblewitness 7y ago

This is another Handshake protocol FAQ targeted at technical folks https://github.com/handshake-org/handshake-org.github.io/blob/0a3659f574d618295ecef4bab590419fbb99da49/src/guides/protocol.md https://github.com/handshake-org/handshake-org.github.io/blo... (FYI this is a file currently staged in a pull request to the handshake docs repo on github)

troquerre 7y ago

As an FYI for HN, many of y'all are probably eligible for $400-800 of Handshake coins (HNS). Handshake is airdropping coins to open-source developers to incentivize them to check out the project. If you have over 15 followers on GitHub you can use this tool to claim coins. This is a no-strings-attached giveaway so if you want to you can also sell your coins but it'd be worth it to bid on your name before you do. You can also reach out to me at tieshun at namebase.io if you have questions about the airdrop or Handshake itself. https://github.com/handshake-org/hs-airdrop https://github.com/handshake-org/hs-airdrop

YCuN4M00v33odS 7y ago
Where do I get this bech32 address?
- troquerre 7y ago
  You can generate one with a Handshake client. If you’d like help with the process and an easy way to use your coins ping me at Tieshun at Namebase.io https://github.com/handshake-org/hsd https://github.com/handshake-org/hsd
eikenberry 7y ago
I thought about it for a minute, then quickly skipped it when I saw the instructions. If you are hoping that free software devs will help bootstrap this by using it then you'll need to make that process much easier.

DeepYogurt 7y ago

The title is a bit misleading. This is not an alteration to the DNS system, but rather a brand new naming system.

rasengan 7y ago
> This is not an alteration to the DNS system, but rather a brand new naming system. The existing TLDs will continue to be held by the existing TLD holders. So, as an example, news.ycombinator.com will still work! This is truly a drop-in replacement of the DNS ROOT giving power back to the people.

justinmchase 7y ago

Thats cool. Also ENS (Ethereum Name Service) on the ethereum block chain is really cool, though its more for resolving to swarm hashes or block addresses... which are for decentralized documents and apps. https://manager.ens.domains/ https://manager.ens.domains/

tittysprinkles 7y ago

This all looks and sounds really great but I have one big question. If this requires a proof of work chain, why not just build it on top of Bitcoin? Then you wouldn't have to convince people to spin up a new node for a separate chain. This seems like an obvious choice to take advantage of Bitcoin's network effects and inherent chain security. You could even lock up some bitcoin and issue bitcoin-backed Handshake tokens and continue operations as normal.

dang 7y ago

Related from last year: https://news.ycombinator.com/item?id=17673922 https://news.ycombinator.com/item?id=17673922

Proven 7y ago

Like Namecoin half a dozen years ago, but with an ICO or some other trick?