19 ms·

DNS Wars

211 points by r4um 7y ago

saurik 7y ago
The most interesting part of this, for me, was "Episode 6 – Resolverless DNS Wars", as it is an episode that hasn't quite started yet (and so I don't already know a lot about it).
Yuval_Halevi 7y ago
Make great infrastructure. Not war.
jacobush 7y ago
This put into words something which to me is very unsettling about the latest DNS developments. "The Internet has been changed irrevocably from being a tool that allows computers to communicate to a tool that allows enterprises to deploy tools that are intended to monetise users in a highly efficient and effective manner."
- pas 7y ago
  The basic Internet is still there. Of course the purpose changed from a defense experiment to an academic communication tool to a general communication substrate to a basic building block of a highly distributed world/society/era.
  - jacobush 7y ago
    Highly distributed? Facebook, Google, Amazon and to some extent Apple dominate and they are extremely centralized.
    - eeZah7Ux 7y ago
      Yes, but the basic Internet from 1990 is still there. E.g. small websites, self-hosted email, IRC servers.
    - pas 7y ago
      Fb, G, MS, Twitter, Atlassian, Reddit, and a lot of companies provide the infrastructure that literally billions of people use to better their lives. They are able to organize, communicate, collaborate, share, search, store, work, supervise, have fun, discuss, learn online. Is there a problem with monocultures? Yes, of course, but our lives are now spread out over space and time a lot more. I'm writing this 19 hours after your comment, very likely from a different country. Just a few minutes ago I was looking at Skype (work, a full-remote team), and Messenger (friends, a group chat where accidentally everyone happens to be hundreds of miles from each other) before that.
      - jacobush 7y ago
        So, you agree and list a bunch of benefits to the centralization.
        pas 7y ago
        What? Okay, let's forget for a moment the companies and the "implmenetation" of these functions. What I'm trying to say is that the "internet" as such is now a fundamental, essential, non-separable part of many of our lives. Companies run on slack/skype/JIRA, email, voip, businesses depend on the internet, webshopping is basically the default for millions, sports groups live on the internet (StarCraft, DotA), content creators live on the internet, citizen politics depends on the internet a lot of times in turbulent regimes (streaming rights violations). It's not just a "communications" thing anymore. And it's distributed our lives in both space and time.
  - marcosdumay 7y ago
    > The basic Internet is still there. NAT and asymmetric connections beg to differ. Also email.
pas 7y ago
The VPN over HTTPS vs DoH argument is interesting. But probably a lot more peoole will benefit from DoH if shipped by Mozilla, Google, Apple than by setting up a VPN manually. (VPNs are a lot more resource intensive than a DNS resolver. Plus they have serious legal consequences too, just like running a Tor exit node.) The Client Subnet is meh. It would be nice. Just as Akamai providing a map. But if you want that extra privacy use a resolver that always passes its own subnet forward. DNS push in the browser without DNSSEC. Wow. Now that's bad. But if it gets limited to subdomains of the current domain only, then no one will care.
- karasu 7y ago
  I think the VPN vs DoH argument is a fallacy. You could argue the same way for things like telnet vs ssh and it would make just as little sense. In addition a VPN is much more complex than simply using DoH or DoT. DoH is also not meant to "hide" what you're doing as much as it is about enabling you to protect your DNS queries from manipulation. The only difference to the more direct approach (DoT) here is that DoH acknowledges the reality we live in where networks where DoT makes the most sense block anything but http/https traffic.
  - cbzbc 7y ago
    The flip side is that on a local level (your own network) you want to be able to block all sorts of traffic for entirely good reasons.
    - Ajedi32 7y ago
      The problem is that it's not realistic to expect client machines to be able to distinguish between blocking for "good reasons" or "bad reasons". The network isn't (usually) under the user's control, and as a result any reasonable threat model for software running on client machines should assume the network is actively malicious. Ultimately, I think any sort of content blocking is going to have to happen on client machines. Or at least via a mechanism which depends the client machine's active cooperation. Anything less just opens users up to interference from malicious third parties.
bluejekyll 7y ago
This is a great history of DNS. I didn’t really notice any inaccuracies. I especially like the way that client subnet was discussed, but of course that’s because I agree with the author. I find it interesting that it avoided DNSSEC, perhaps recognizing it as a skirmish rather than an episode of the greater war. This is probably accurate, DNSSEC has never actively steered DNS in any particular direction, it’s much more passive and therefore doesn’t represent something that needs to be directly fought. Pick your battles, this one is not worth fighting, probably because there’s nothing to gain or lose (from a control perspective) in it succeeding or failing. Tying everything back together with the discussion of Westfalia is really interesting, because it raises an interesting topic. The ability to control the content that users have access to, and the ease of doing so. DoT and DoH make it much harder to easily intercept DNS packets and manipulate or deny responses to them (edit: to be clear it denies network operators this control, but of course the chosen resolver has even more ability to do so). It denies a method of control that network operators have over the users of that network. This control was never perfect, sophisticated (and not even that sophisticated) actors on the network could always circumvent this control of DNS. It really only prevents the majority of people, non-bad actors in general, from circumventing the network operators controls (when considering only DNS as that control mechanism). This is probably a good thing for the user, because it will force the network operators and countries, to start treating good actors and bad actors the same, rather than only controlling and monitoring the unsuspecting normal user, while leaving the doors open for the bad actors. In the Westfalia time period, it would be the difference between the citizen relying on traditional imports vs. the smuggler to avoid all tariffs, because the coasts were large and it was somewhat easy to avoid the navy’s of the large states at the time.
- gjvnq 7y ago
  About DNSSEC, Brazil requires it for some domains: .leg.br .jus.br .mp.br .tc.br .def.br .b.br Source: https://registro.br/dominio/categorias/ https://registro.br/dominio/categorias/
  - bluejekyll 7y ago
    My point that I was trying to make is that DNSSEC being focused on authenticating the existing DNS record data, and not on the control and protocol plane, leaves it out inside of control issues. Sure it enshrines the existing roots and the ultimate authorities for the correctness of DNS, but this is already true, and going against it means a fork of DNS in a sense which doesn’t seem like anyone really wants.
ComodoHacker 7y ago
Another point not mentioned in the article is that encrypted DNS (be it DoH or DoT) requires significantly more resources to run a public recursive resolver. You have to either monetize it somehow or fund it with money from your other business. So it means more centralization and less neutrality.
- bluejekyll 7y ago
  > requires significantly more resources to run a public recursive resolver. Do you know of any studies or released cost breakdowns that show this? Depending on your view, DNSSEC might be considered to be operationally more costly. But also modern equipment is pretty good at this task.
  - ComodoHacker 7y ago
    Not for еDNS, but I've seen such reports about HTTPS when it was in the process of wide adoption. In case of DNS, not only more CPU is consumed on encryption, but more memory too, since it's stateful. And all this both with client and upstream.
- seanhunter 7y ago
  Why do you say that it requires significantly more resources? Running a public recursive resolver has never been something to take lightly - keeping your resolver immune to DDoS, cache poisoning, general security bugs (depending on which DNS server software you run) etc has always been a major undertaking.
- karasu 7y ago
  Isn't this a really odd point? Right now, you can hardly run a public resolver in the traditional sense as UDP resolvers are prone to be used for DNS amplification attacks and TCP isn't supported/configurable on all clients. On the other hand, running a DoH or DoT resolver is no more ressource intentive than, say, hosting your own website and even Android allows you to set a DoT resolver nowadays.
- jstanley 7y ago
  A friend of mine runs a public DoH server at https://doh.li/ https://doh.li/, and is "currently handling ~220k req/day with a $10/mo DO instance, no optimisation at all, CPU load is at 20%" so I don't think running a public resolver is at all beyond the reach of a hobbyist.
noway421 7y ago
>For a short period, OpenDNS also redirected the domain name www.google.com to a different search engine. Within a few weeks, Google launched their public DNS on quad 8 and based the service on absolute integrity of both positive and negative responses in the DNS. A ‘trustable’ DNS tat undertook to never lie. >Oddly enough the result is that Google’s public DNS offering is now totally dominant in the open resolver space. If this was a three-way struggle between infrastructure-based DNS, Open Resolvers and Google’s Open Resolvers, then it looks like Google won that round. https://xkcd.com/1361/ https://xkcd.com/1361/ now sounds more true than ever
strenholme 7y ago
I am really surprised they did not mention when the Internet community got upset that ISC/BIND monetized their open source server by having a closed mailing list to discuss BIND security holes: https://old.lwn.net/2001/0208/security.php3 https://old.lwn.net/2001/0208/security.php3 This event made the Internet realize that there was, at the time (early 2001), no viable open source DNS server besides BIND out there: https://old.lwn.net/2001/0208/ https://old.lwn.net/2001/0208/ Since then, MaraDNS came out, then NSD and its sister resolver Unbound came out, djbdns finally became open source [1], and Knot DNS came out this decade. [1] As an aside, I don’t know of any currently maintained djbdns fork. N-DJBDNS has not had a formal release since 2014 ( http://pjp.dgplug.org/ndjbdns/ http://pjp.dgplug.org/ndjbdns/ ), and the maintainer has not closed a bug since 2017 ( https://github.com/pjps/ndjbdns/issues?q=is%3Aissue+is%3Aclosed https://github.com/pjps/ndjbdns/issues?q=is%3Aissue+is%3Aclo... ). Perhaps @tptacek is willing to step up to plate and make an actively maintained version of djbdns. But I get the feeling I will end up maintaining both my own MaraDNS and a fork of N-DJBDNS.
- brightball 7y ago
  Don’t forget PowerDNS and ErlDNS.
- throw0101a 7y ago
  I can understand why people got upset, and more variety is a good thing, but it should also be noted that ISC is a US non-profit, and they have to pay the bills as well: * https://en.wikipedia.org/wiki/Internet_Systems_Consortium https://en.wikipedia.org/wiki/Internet_Systems_Consortium I have no idea what the details were, but if you're going to make a buck off BIND by being a vendor of some kind, then paying for "early-access" is not crazy-unreasonable IMHO. As noted in the e-mail "Not-for-profit members can have their fees waived", so they're not trying to milk folks like the BSDs.
  - tptacek 7y ago
    Requiring payment for vulnerability fixes isn't reasonable; it deliberately externalizes security problems BIND itself creates. If they couldn't provide software for free with vulnerability fixes, they shouldn't have provided it for free at all.
teddyh 7y ago
Something not mentioned is Cloudflare’s unilateral decision in 2015 to “deprecate” DNS queries of type “ANY”, simply because they thought it would be “too expensive” to follow that part of the DNS standard. This culminated in RFC 8482, co-authored by Cloudflare, unsurprisingly legitimizing Cloudflare’s position.
- kees99 7y ago
  Cloudflare killed "ANY?" because it was a significant vector in DNS amplification attacks. Ironically enough, avoiding the "expensive" query type resulted in potentially doubling the amount of DNS traffic from a typical dual-stack client ("A?" + "AAAA?" instead of single "ANY?") EDIT: ...or warranted adding laggy heuristics that eventually settles into either, as Avamander points out below.
  - Avamander 7y ago
    I heavily doubt it's doubling, what I've seen is that double-stack software falls back to one or the other.
    - zamadatix 7y ago
      Seems to be the case: https://i.imgur.com/ACfFQwN.png https://i.imgur.com/ACfFQwN.png Edit: Also seems to still be the case when you have your resolver set to a v6 address.
  - belorn 7y ago
    It would surprise me if cloudflare relied on blocking "ANY" for DDOS mitigation. Most modern resolver have builtin response rate limiting, and I would expect cloudflare to have multiple additional mitigation methods to prevent malicious actors from exploiting their servers.
    - kees99 7y ago
      In a DNS-amplified DDoS attack, target (CF for example) would be on the receiving end (right-hand side of [1]), and blocking, while necessary, would not be terribly efficient there. On the other hand, deprecating "ANY" requests as standard, once percolated into BIND and other resolvers, would cut the attack[2] on the amplification stage (middle of the picture of [1]). [1] https://www.cloudflare.com/img/learning/ddos/dns-amplification-ddos-attack/dns-amplification-attack-1.png https://www.cloudflare.com/img/learning/ddos/dns-amplificati... [2] or at least significantly decrease choice and depth of large amplification factor requests available to the attacker.
belorn 7y ago
Looking at the last section of the article it brushes onto an other war between content delivering infrastructure. The current war for DoH dominance is between google and cloudflare, with chrome and firefox being the bannermen, but a more general perspective is that DNS data is becoming a war between CDN's. Later in the wars I would expect ISP to once again regain their access to DNS data if DoH became default. CDN's must cooperate with ISP in order to be a content delivery network. It is very hard to operate an anycast network with server located near the edges without close relation with the operators of those edges. Most times the DoH server is going to sit at the ISP server hall, next to the ISP own resolver. In some places it can be the same physical machine and just separated by software. The border is not going to be very bright between the sovereign domain of the CDN and the ISP.
- wbl 7y ago
  Why do ISPs need to see DNS data?
  - belorn 7y ago
    ISP use DNS data for monetization, like selling it to advertisers. There is also a political aspect for many ISP where there is close cooperation with local government, and the need to comply to request of filtering is pretty high in some countries. A CDN pays ISPs, carriers, and network operators for hosting its servers in their data centers. ISP do this because it provide them revenue and better service to their customers.
  - sliken 7y ago
    Need... they don't. It is a source of potential income.... at the cost of their user's privacy.
badrabbit 7y ago
We have a different kind of DNS war these days with DoH and DoT and everyone who does not know what SNI in TLS is.
- bluejekyll 7y ago
  The article does mention SNI encryption coming in TLS 1.3, and if I remember correctly, discusses how this will make the DoH and DoT privacy story stronger.
  - badrabbit 7y ago
    Makes sense to block eSNI than DoH/DoT then?(for people that desire the blockage). Even without eSNI sites can use CDN s with CNAME records being used for the TLS SNI (e.g.: site.com has xxx.cloudfront.com as CNAME,browser connects to cloudfront with CNAME record in SNI but requests site.com in the http Host header to get the correct site...essentially domain-fronting). Even now many services use domain fronting. Law enforcement and IT/corp security alike need to focus on endpoints. Dragnet surveillance and perimitet filtering never did get the real bad targets.
throw0101a 7y ago
As mentioned in the article, Paul Vixie gave the keynote at the recent NANOG 77 (October 2019 in Austin, TX) entitled "DNS Wars: Episode IV - A New Bypass" (about 14m in if the timestamp does not work; it's about an hour with Q&A): * https://www.youtube.com/watch?v=1hu6cNf0eDo&t=14m https://www.youtube.com/watch?v=1hu6cNf0eDo&t=14m He gave a similar talk at EuroBSDCon 2019 a little while ago. There were two other DNS talks at NANOG on the Wednesday: "DNS Transparency Project" (4h3m30s) and "Analyzing the Costs (and Benefits) of DNS, DoT, and DoH for the Modern Web" (7h20m20s): * https://www.youtube.com/watch?v=9JSG7RS8imk https://www.youtube.com/watch?v=9JSG7RS8imk * https://www.nanog.org/meetings/nanog-77/nanog-77-agenda/ https://www.nanog.org/meetings/nanog-77/nanog-77-agenda/ After NANOG, the DNS folks got together for DNS-OARC 31, with various talks on DoT/DoH as well (amongst other things): * https://indico.dns-oarc.net/event/32/timetable/#all https://indico.dns-oarc.net/event/32/timetable/#all * https://www.youtube.com/DNS-OARC https://www.youtube.com/DNS-OARC
- autoexec 7y ago
  Thanks, I was just about to go digging for this stuff myself!
really3452 7y ago
I am personally excited about DNS-over-HTTPS-over-TOR. No one can see what DNS you are requesting except for the TOR hidden DNS service which does not know who you are. Seems like the best possible mass-usage of TOR. Anyhow, that is my prediction where the next DNS war takes place.
- zzzcpan 7y ago
  Connecting to a centralized DNS provider over tor defeats the purpose of tor and makes it easy to deanonymize your traffic completely.
  - xg15 7y ago
    Does it? If you use regular DNS, how would it identify your requests? (as it cannot rely on the IP address) For DoH, I guess there are more pitfalls to avoid (http cookies, connection reuse, tls session cookies, etc), but those are all things you can avoid if you configure your client correctly. I don't see how using a centralised provider would automatically compromise your privacy. (It's playing with fire though, I admit that)
- indue 7y ago
  Cloudflare has done this: https://blog.cloudflare.com/welcome-hidden-resolver/ https://blog.cloudflare.com/welcome-hidden-resolver/
davidu 7y ago
"The DNS was co-opted in this effort and OpenDNS tried to achieve this with a recursive resolver that performed NXDOMAIN redirection into a search engine, in a reprise of Sitefinder. For a short period, OpenDNS also redirected the domain name www.google.com to a different search engine." Well this is false, and misleading. The connection to Sidefinder is a red herring -- sitefinder was applied Internet-wide, OpenDNS was a choice. Saying OpenDNS redirected www.google.com isn't accurate either. There was a URL that was redirected for a portion of users for a very short period of time because Google installed a hijacked version of the Google toolbar, and once we did this, they reverted their erroneous behavior and we reverted ours and we wrote about it extensively (https://umbrella.cisco.com/blog/2007/05/22/google-turns-the-page/ https://umbrella.cisco.com/blog/2007/05/22/google-turns-the-...). Geoff knows better, but is being lazy or sloppy while trying to provide a historical record. A shame, because it's a worthwhile topic to go over. The real conclusion he fails to make is that between Android, Chrome, and Google Search, there is a total monopoly on navigation for the vast majority of the Internet. That's distressing, and until there is a major platform shift, it's hard to see that changing.
- thayne 7y ago
  > The real conclusion he fails to make is that between Android, Chrome, and Google Search, there is a total monopoly on navigation for the vast majority of the Internet. I thought that was his conclusion (basically).
- autoexec 7y ago
  > Well this is false, and misleading. The connection to Sidefinder is a red herring -- sitefinder was applied Internet-wide, OpenDNS was a choice. It don't think it's entire unfair to say it was reminiscent in concept though. In both cases where someone would expect NXDOMAIN they were served something else just so a company could make money. Users did have more choice in using OpenDNS, and this was something that caused people to switch away from them. Fair point on the google thing though. That should have been clarified.
jstewartmobile 7y ago
"Part of the new world order is that the space defined by the actions of applications is well beyond the traditional domain of communications regulation and even beyond the domain of regulation trade and commerce." Russia and China would beg to differ. UK could totally dictate terms if they had protected their own market and infrastructure, but they didn't, so now Google/Apple/Mozilla call the shots.
iooi 7y ago
There is huge value in documenting the history of the internet in articles like this. I would love to see an article like this on other technologies like BGP, SSL, and Wifi for example.
auslander 7y ago
Is DoH capable of storing and serving cookies? I always wondered.

211 points by r4um 7y ago

The most interesting part of this, for me, was "Episode 6 – Resolverless DNS Wars", as it is an episode that hasn't quite started yet (and so I don't already know a lot about it).

Yuval_Halevi 7y ago

Make great infrastructure. Not war.

jacobush 7y ago

This put into words something which to me is very unsettling about the latest DNS developments. "The Internet has been changed irrevocably from being a tool that allows computers to communicate to a tool that allows enterprises to deploy tools that are intended to monetise users in a highly efficient and effective manner."

pas 7y ago
The basic Internet is still there. Of course the purpose changed from a defense experiment to an academic communication tool to a general communication substrate to a basic building block of a highly distributed world/society/era.
- jacobush 7y ago
  Highly distributed? Facebook, Google, Amazon and to some extent Apple dominate and they are extremely centralized.
  - eeZah7Ux 7y ago
    Yes, but the basic Internet from 1990 is still there. E.g. small websites, self-hosted email, IRC servers.
  - pas 7y ago
    Fb, G, MS, Twitter, Atlassian, Reddit, and a lot of companies provide the infrastructure that literally billions of people use to better their lives. They are able to organize, communicate, collaborate, share, search, store, work, supervise, have fun, discuss, learn online. Is there a problem with monocultures? Yes, of course, but our lives are now spread out over space and time a lot more. I'm writing this 19 hours after your comment, very likely from a different country. Just a few minutes ago I was looking at Skype (work, a full-remote team), and Messenger (friends, a group chat where accidentally everyone happens to be hundreds of miles from each other) before that.
    - jacobush 7y ago
      So, you agree and list a bunch of benefits to the centralization.
      - pas 7y ago
        What? Okay, let's forget for a moment the companies and the "implmenetation" of these functions. What I'm trying to say is that the "internet" as such is now a fundamental, essential, non-separable part of many of our lives. Companies run on slack/skype/JIRA, email, voip, businesses depend on the internet, webshopping is basically the default for millions, sports groups live on the internet (StarCraft, DotA), content creators live on the internet, citizen politics depends on the internet a lot of times in turbulent regimes (streaming rights violations). It's not just a "communications" thing anymore. And it's distributed our lives in both space and time.
- marcosdumay 7y ago
  > The basic Internet is still there. NAT and asymmetric connections beg to differ. Also email.

pas 7y ago

The VPN over HTTPS vs DoH argument is interesting. But probably a lot more peoole will benefit from DoH if shipped by Mozilla, Google, Apple than by setting up a VPN manually. (VPNs are a lot more resource intensive than a DNS resolver. Plus they have serious legal consequences too, just like running a Tor exit node.) The Client Subnet is meh. It would be nice. Just as Akamai providing a map. But if you want that extra privacy use a resolver that always passes its own subnet forward. DNS push in the browser without DNSSEC. Wow. Now that's bad. But if it gets limited to subdomains of the current domain only, then no one will care.

karasu 7y ago
I think the VPN vs DoH argument is a fallacy. You could argue the same way for things like telnet vs ssh and it would make just as little sense. In addition a VPN is much more complex than simply using DoH or DoT. DoH is also not meant to "hide" what you're doing as much as it is about enabling you to protect your DNS queries from manipulation. The only difference to the more direct approach (DoT) here is that DoH acknowledges the reality we live in where networks where DoT makes the most sense block anything but http/https traffic.
- cbzbc 7y ago
  The flip side is that on a local level (your own network) you want to be able to block all sorts of traffic for entirely good reasons.
  - Ajedi32 7y ago
    The problem is that it's not realistic to expect client machines to be able to distinguish between blocking for "good reasons" or "bad reasons". The network isn't (usually) under the user's control, and as a result any reasonable threat model for software running on client machines should assume the network is actively malicious. Ultimately, I think any sort of content blocking is going to have to happen on client machines. Or at least via a mechanism which depends the client machine's active cooperation. Anything less just opens users up to interference from malicious third parties.

bluejekyll 7y ago

This is a great history of DNS. I didn’t really notice any inaccuracies. I especially like the way that client subnet was discussed, but of course that’s because I agree with the author. I find it interesting that it avoided DNSSEC, perhaps recognizing it as a skirmish rather than an episode of the greater war. This is probably accurate, DNSSEC has never actively steered DNS in any particular direction, it’s much more passive and therefore doesn’t represent something that needs to be directly fought. Pick your battles, this one is not worth fighting, probably because there’s nothing to gain or lose (from a control perspective) in it succeeding or failing. Tying everything back together with the discussion of Westfalia is really interesting, because it raises an interesting topic. The ability to control the content that users have access to, and the ease of doing so. DoT and DoH make it much harder to easily intercept DNS packets and manipulate or deny responses to them (edit: to be clear it denies network operators this control, but of course the chosen resolver has even more ability to do so). It denies a method of control that network operators have over the users of that network. This control was never perfect, sophisticated (and not even that sophisticated) actors on the network could always circumvent this control of DNS. It really only prevents the majority of people, non-bad actors in general, from circumventing the network operators controls (when considering only DNS as that control mechanism). This is probably a good thing for the user, because it will force the network operators and countries, to start treating good actors and bad actors the same, rather than only controlling and monitoring the unsuspecting normal user, while leaving the doors open for the bad actors. In the Westfalia time period, it would be the difference between the citizen relying on traditional imports vs. the smuggler to avoid all tariffs, because the coasts were large and it was somewhat easy to avoid the navy’s of the large states at the time.

gjvnq 7y ago
About DNSSEC, Brazil requires it for some domains: .leg.br .jus.br .mp.br .tc.br .def.br .b.br Source: https://registro.br/dominio/categorias/ https://registro.br/dominio/categorias/
- bluejekyll 7y ago
  My point that I was trying to make is that DNSSEC being focused on authenticating the existing DNS record data, and not on the control and protocol plane, leaves it out inside of control issues. Sure it enshrines the existing roots and the ultimate authorities for the correctness of DNS, but this is already true, and going against it means a fork of DNS in a sense which doesn’t seem like anyone really wants.

ComodoHacker 7y ago

Another point not mentioned in the article is that encrypted DNS (be it DoH or DoT) requires significantly more resources to run a public recursive resolver. You have to either monetize it somehow or fund it with money from your other business. So it means more centralization and less neutrality.

bluejekyll 7y ago
> requires significantly more resources to run a public recursive resolver. Do you know of any studies or released cost breakdowns that show this? Depending on your view, DNSSEC might be considered to be operationally more costly. But also modern equipment is pretty good at this task.
- ComodoHacker 7y ago
  Not for еDNS, but I've seen such reports about HTTPS when it was in the process of wide adoption. In case of DNS, not only more CPU is consumed on encryption, but more memory too, since it's stateful. And all this both with client and upstream.
seanhunter 7y ago
Why do you say that it requires significantly more resources? Running a public recursive resolver has never been something to take lightly - keeping your resolver immune to DDoS, cache poisoning, general security bugs (depending on which DNS server software you run) etc has always been a major undertaking.
karasu 7y ago
Isn't this a really odd point? Right now, you can hardly run a public resolver in the traditional sense as UDP resolvers are prone to be used for DNS amplification attacks and TCP isn't supported/configurable on all clients. On the other hand, running a DoH or DoT resolver is no more ressource intentive than, say, hosting your own website and even Android allows you to set a DoT resolver nowadays.
jstanley 7y ago
A friend of mine runs a public DoH server at https://doh.li/ https://doh.li/, and is "currently handling ~220k req/day with a $10/mo DO instance, no optimisation at all, CPU load is at 20%" so I don't think running a public resolver is at all beyond the reach of a hobbyist.

noway421 7y ago

>For a short period, OpenDNS also redirected the domain name www.google.com to a different search engine. Within a few weeks, Google launched their public DNS on quad 8 and based the service on absolute integrity of both positive and negative responses in the DNS. A ‘trustable’ DNS tat undertook to never lie. >Oddly enough the result is that Google’s public DNS offering is now totally dominant in the open resolver space. If this was a three-way struggle between infrastructure-based DNS, Open Resolvers and Google’s Open Resolvers, then it looks like Google won that round. https://xkcd.com/1361/ https://xkcd.com/1361/ now sounds more true than ever

strenholme 7y ago

I am really surprised they did not mention when the Internet community got upset that ISC/BIND monetized their open source server by having a closed mailing list to discuss BIND security holes: https://old.lwn.net/2001/0208/security.php3 https://old.lwn.net/2001/0208/security.php3 This event made the Internet realize that there was, at the time (early 2001), no viable open source DNS server besides BIND out there: https://old.lwn.net/2001/0208/ https://old.lwn.net/2001/0208/ Since then, MaraDNS came out, then NSD and its sister resolver Unbound came out, djbdns finally became open source [1], and Knot DNS came out this decade. [1] As an aside, I don’t know of any currently maintained djbdns fork. N-DJBDNS has not had a formal release since 2014 ( http://pjp.dgplug.org/ndjbdns/ http://pjp.dgplug.org/ndjbdns/ ), and the maintainer has not closed a bug since 2017 ( https://github.com/pjps/ndjbdns/issues?q=is%3Aissue+is%3Aclosed https://github.com/pjps/ndjbdns/issues?q=is%3Aissue+is%3Aclo... ). Perhaps @tptacek is willing to step up to plate and make an actively maintained version of djbdns. But I get the feeling I will end up maintaining both my own MaraDNS and a fork of N-DJBDNS.

brightball 7y ago
Don’t forget PowerDNS and ErlDNS.
throw0101a 7y ago
I can understand why people got upset, and more variety is a good thing, but it should also be noted that ISC is a US non-profit, and they have to pay the bills as well: * https://en.wikipedia.org/wiki/Internet_Systems_Consortium https://en.wikipedia.org/wiki/Internet_Systems_Consortium I have no idea what the details were, but if you're going to make a buck off BIND by being a vendor of some kind, then paying for "early-access" is not crazy-unreasonable IMHO. As noted in the e-mail "Not-for-profit members can have their fees waived", so they're not trying to milk folks like the BSDs.
- tptacek 7y ago
  Requiring payment for vulnerability fixes isn't reasonable; it deliberately externalizes security problems BIND itself creates. If they couldn't provide software for free with vulnerability fixes, they shouldn't have provided it for free at all.

teddyh 7y ago

Something not mentioned is Cloudflare’s unilateral decision in 2015 to “deprecate” DNS queries of type “ANY”, simply because they thought it would be “too expensive” to follow that part of the DNS standard. This culminated in RFC 8482, co-authored by Cloudflare, unsurprisingly legitimizing Cloudflare’s position.

kees99 7y ago
Cloudflare killed "ANY?" because it was a significant vector in DNS amplification attacks. Ironically enough, avoiding the "expensive" query type resulted in potentially doubling the amount of DNS traffic from a typical dual-stack client ("A?" + "AAAA?" instead of single "ANY?") EDIT: ...or warranted adding laggy heuristics that eventually settles into either, as Avamander points out below.
- Avamander 7y ago
  I heavily doubt it's doubling, what I've seen is that double-stack software falls back to one or the other.
  - zamadatix 7y ago
    Seems to be the case: https://i.imgur.com/ACfFQwN.png https://i.imgur.com/ACfFQwN.png Edit: Also seems to still be the case when you have your resolver set to a v6 address.
- belorn 7y ago
  It would surprise me if cloudflare relied on blocking "ANY" for DDOS mitigation. Most modern resolver have builtin response rate limiting, and I would expect cloudflare to have multiple additional mitigation methods to prevent malicious actors from exploiting their servers.
  - kees99 7y ago
    In a DNS-amplified DDoS attack, target (CF for example) would be on the receiving end (right-hand side of [1]), and blocking, while necessary, would not be terribly efficient there. On the other hand, deprecating "ANY" requests as standard, once percolated into BIND and other resolvers, would cut the attack[2] on the amplification stage (middle of the picture of [1]). [1] https://www.cloudflare.com/img/learning/ddos/dns-amplification-ddos-attack/dns-amplification-attack-1.png https://www.cloudflare.com/img/learning/ddos/dns-amplificati... [2] or at least significantly decrease choice and depth of large amplification factor requests available to the attacker.

belorn 7y ago

Looking at the last section of the article it brushes onto an other war between content delivering infrastructure. The current war for DoH dominance is between google and cloudflare, with chrome and firefox being the bannermen, but a more general perspective is that DNS data is becoming a war between CDN's. Later in the wars I would expect ISP to once again regain their access to DNS data if DoH became default. CDN's must cooperate with ISP in order to be a content delivery network. It is very hard to operate an anycast network with server located near the edges without close relation with the operators of those edges. Most times the DoH server is going to sit at the ISP server hall, next to the ISP own resolver. In some places it can be the same physical machine and just separated by software. The border is not going to be very bright between the sovereign domain of the CDN and the ISP.

wbl 7y ago
Why do ISPs need to see DNS data?
- belorn 7y ago
  ISP use DNS data for monetization, like selling it to advertisers. There is also a political aspect for many ISP where there is close cooperation with local government, and the need to comply to request of filtering is pretty high in some countries. A CDN pays ISPs, carriers, and network operators for hosting its servers in their data centers. ISP do this because it provide them revenue and better service to their customers.
- sliken 7y ago
  Need... they don't. It is a source of potential income.... at the cost of their user's privacy.

badrabbit 7y ago

We have a different kind of DNS war these days with DoH and DoT and everyone who does not know what SNI in TLS is.

bluejekyll 7y ago
The article does mention SNI encryption coming in TLS 1.3, and if I remember correctly, discusses how this will make the DoH and DoT privacy story stronger.
- badrabbit 7y ago
  Makes sense to block eSNI than DoH/DoT then?(for people that desire the blockage). Even without eSNI sites can use CDN s with CNAME records being used for the TLS SNI (e.g.: site.com has xxx.cloudfront.com as CNAME,browser connects to cloudfront with CNAME record in SNI but requests site.com in the http Host header to get the correct site...essentially domain-fronting). Even now many services use domain fronting. Law enforcement and IT/corp security alike need to focus on endpoints. Dragnet surveillance and perimitet filtering never did get the real bad targets.

throw0101a 7y ago

As mentioned in the article, Paul Vixie gave the keynote at the recent NANOG 77 (October 2019 in Austin, TX) entitled "DNS Wars: Episode IV - A New Bypass" (about 14m in if the timestamp does not work; it's about an hour with Q&A): * https://www.youtube.com/watch?v=1hu6cNf0eDo&t=14m https://www.youtube.com/watch?v=1hu6cNf0eDo&t=14m He gave a similar talk at EuroBSDCon 2019 a little while ago. There were two other DNS talks at NANOG on the Wednesday: "DNS Transparency Project" (4h3m30s) and "Analyzing the Costs (and Benefits) of DNS, DoT, and DoH for the Modern Web" (7h20m20s): * https://www.youtube.com/watch?v=9JSG7RS8imk https://www.youtube.com/watch?v=9JSG7RS8imk * https://www.nanog.org/meetings/nanog-77/nanog-77-agenda/ https://www.nanog.org/meetings/nanog-77/nanog-77-agenda/ After NANOG, the DNS folks got together for DNS-OARC 31, with various talks on DoT/DoH as well (amongst other things): * https://indico.dns-oarc.net/event/32/timetable/#all https://indico.dns-oarc.net/event/32/timetable/#all * https://www.youtube.com/DNS-OARC https://www.youtube.com/DNS-OARC

autoexec 7y ago
Thanks, I was just about to go digging for this stuff myself!

really3452 7y ago

I am personally excited about DNS-over-HTTPS-over-TOR. No one can see what DNS you are requesting except for the TOR hidden DNS service which does not know who you are. Seems like the best possible mass-usage of TOR. Anyhow, that is my prediction where the next DNS war takes place.

zzzcpan 7y ago
Connecting to a centralized DNS provider over tor defeats the purpose of tor and makes it easy to deanonymize your traffic completely.
- xg15 7y ago
  Does it? If you use regular DNS, how would it identify your requests? (as it cannot rely on the IP address) For DoH, I guess there are more pitfalls to avoid (http cookies, connection reuse, tls session cookies, etc), but those are all things you can avoid if you configure your client correctly. I don't see how using a centralised provider would automatically compromise your privacy. (It's playing with fire though, I admit that)
indue 7y ago
Cloudflare has done this: https://blog.cloudflare.com/welcome-hidden-resolver/ https://blog.cloudflare.com/welcome-hidden-resolver/

davidu 7y ago

"The DNS was co-opted in this effort and OpenDNS tried to achieve this with a recursive resolver that performed NXDOMAIN redirection into a search engine, in a reprise of Sitefinder. For a short period, OpenDNS also redirected the domain name www.google.com to a different search engine." Well this is false, and misleading. The connection to Sidefinder is a red herring -- sitefinder was applied Internet-wide, OpenDNS was a choice. Saying OpenDNS redirected www.google.com isn't accurate either. There was a URL that was redirected for a portion of users for a very short period of time because Google installed a hijacked version of the Google toolbar, and once we did this, they reverted their erroneous behavior and we reverted ours and we wrote about it extensively (https://umbrella.cisco.com/blog/2007/05/22/google-turns-the-page/ https://umbrella.cisco.com/blog/2007/05/22/google-turns-the-...). Geoff knows better, but is being lazy or sloppy while trying to provide a historical record. A shame, because it's a worthwhile topic to go over. The real conclusion he fails to make is that between Android, Chrome, and Google Search, there is a total monopoly on navigation for the vast majority of the Internet. That's distressing, and until there is a major platform shift, it's hard to see that changing.

thayne 7y ago
> The real conclusion he fails to make is that between Android, Chrome, and Google Search, there is a total monopoly on navigation for the vast majority of the Internet. I thought that was his conclusion (basically).
autoexec 7y ago
> Well this is false, and misleading. The connection to Sidefinder is a red herring -- sitefinder was applied Internet-wide, OpenDNS was a choice. It don't think it's entire unfair to say it was reminiscent in concept though. In both cases where someone would expect NXDOMAIN they were served something else just so a company could make money. Users did have more choice in using OpenDNS, and this was something that caused people to switch away from them. Fair point on the google thing though. That should have been clarified.

jstewartmobile 7y ago

"Part of the new world order is that the space defined by the actions of applications is well beyond the traditional domain of communications regulation and even beyond the domain of regulation trade and commerce." Russia and China would beg to differ. UK could totally dictate terms if they had protected their own market and infrastructure, but they didn't, so now Google/Apple/Mozilla call the shots.

iooi 7y ago

There is huge value in documenting the history of the internet in articles like this. I would love to see an article like this on other technologies like BGP, SSL, and Wifi for example.

auslander 7y ago

Is DoH capable of storing and serving cookies? I always wondered.