4 ms·

Yeah, it's a highly integrated piece of Microsoft Active Directory, which is a core piece of any "Enterprise" Windows deployment. It's not just something that s

Yeah, it's a highly integrated piece of Microsoft Active Directory, which is a core piece of any "Enterprise" Windows deployment. It's not just something that stays on internal networks - organizations that have trusts between their Active Directory systems have connections too. But for public networks, I completely agree that it's insanity to run DNS on Windows.

jiggawatts 6y ago
Why? It works quite well! I just recently worked on a large government department that had approximately 100 public, Internet-facing DNS zones hosted on a pair of Windows servers. I seriously don't get this automatic dismissal of Windows Server as "not a real server operating system". An enormous fraction of large enterprises run on it, very often for Internet-facing infrastructure. Microsoft.com. Azure.net. Stackoverflow.com. You know... those teeny-tiny toy sites nobody ever visits. Just because you're not familiar with it, and just because you can't imagine how it could be managed properly doesn't mean other people don't know how to do it. PS: The list of BIND's CVE entries is here, in case you think that being UNIX-based makes it magically immune to security vulnerabilities: https://www.cvedetails.com/vulnerability-list.php?vendor_id=64&product_id=144 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
- lmm 6y ago
  If it's not open-source, then how can you be confident that it doesn't suck? Hobbyists don't tinker with it, people probably don't publish benchmarks of it. Sure, maybe it works fine, but it might also be awful. So why take the risk when there's an open-source option?
  - jodrellblank 6y ago
    "Ninety per cent of Fortune 500 companies use Azure AD, the sign-in engine for Office 365." - https://azure.microsoft.com/en-gb/services/active-directory/integrate/#features https://azure.microsoft.com/en-gb/services/active-directory/... But you can't know whether it works unless hobbyists tinker with it?? (Even though hobbyists do tinker with Windows)
    - lmm 6y ago
      Yep. I've seen lots of terrible software used by Fortune 500 companies - the person making the purchasing decision usually isn't the person actually using it, so the software quality has no impact on whether it gets bought.
      - jodrellblank 6y ago
        I've seen lots of terrible open source software - nobody is purchasing it, and the people who would normally make purchasing decisions aren't involved at all, so the software quality has no impact on whether it gets bought.
        lmm 6y ago
        Sure. But you can find what people say about a given piece of open-source software; generally people will have tinkered with it and kicked the tires a bit and written up their impressions, maybe ran some benchmarks. And maybe you miss out on the occasional gem that way because there's a really good library that just hasn't been touched by anyone for whatever reason, but at least you can avoid picking a lemon. Whereas there are lots of lemons in the proprietary software market, and no real way to distinguish them.
        jodrellblank 6y ago
        > there are lots of lemons in the proprietary software market, and no real way to distinguish them. You can find what people say about a given piece of proprietary software; generally people will have used it and written up their impressions, maybe ran some benchmarks. Have you honestly never seen a review of a closed source program? Never seen anyone write about their likes or dislikes? Never seen any shareware/try before you buy/free tier software? Never seen anyone use some, decide it was bad, and change to another vendor? Never seen someone try the free version of SQL server or comment about their experiences with IIS or review a new release of Windows? Never seen a computer game review? Or a magazine dedicated to game reviews? Or reviews of Apple app store software?
  - tomc1985 6y ago
    Call me crazy, but as a hobbyist I tinkered with (pirated) Windows Server, Exchange, and Active Directory installs. I had OWA up and running from my home IP, it synced contacts and email with my phone via some exchange integration, years before gmail. It was actually a lot of fun around the Server 2003 era. And while complex and byzantine, Windows Server was rock solid if you treat it right.
    - EvanAnderson 6y ago
      Saying this w/ extensive experience w/ Windows Server, Linux, and a couple of very old Unix flavors: Anything can be complex and byzantine if the developers put their minds to it.
      - tomc1985 6y ago
        Indeed. I have the same complaint about linux now.
        68799EE8 6y ago
        It's not "linux" it's "GNU/systemd"
        tomc1985 6y ago
        Honestly I'd prefer systemd over the mess that is init.d
        JdeBP 6y ago
        That isn't, and never was, the choice, however.
  - jiggawatts 6y ago
    Are you... joking? First of all, I have decades of experience with Windows, Linux, and BSD. I know they all suck, just in different ways. Don't automatically assume that the only operating system with which you are familiar is magically better. You've just become accustomed to its flaws and warts. It is the devil you know, and other, unfamiliar systems are scary and strange. To you. Not to other people. By the way, the hobbyist tinkering is the main cause of the things I've found to suck in Linux. It's just unprofessional, through and through. It hasn't got the "boring bits" filled out, the bits nobody could be bothered to tinker with because they weren't being paid to. It still(!) struggles with spaces in file name paths. In 2020 it still struggles to consistently handle esoteric new concepts like the backspace key. A case in point is the wailing and gnashing of teeth in the Linux community about systemd. From an external objective perspective, this is absurdly childish. Linux is missing 80% of the basic functionality that MacOS and Windows have had since forever. Since the NT4 days in the 1990 forever. In reaction to the systemd team dragging Linux into this century, people lost their minds. They got so mad they were practically frothing at the mouth. I've seen similarly amateurish, unprofessional, dismissive attitudes everywhere I've turned whenever I hit a problem with Linux. Most recently I dug into the history of why its DNS client is so incredibly bad, and it was just a shitshow of stupid, stupid arguments on various forums that have gone on for decades. Idiots arguing very loudly overruling the people giving good, but humble advice.
    - w7 6y ago
      "80% of the basic functionality" Is this a desktop functionality oriented post or something? Because there are things I find daily that can't be done with Windows Server, but come out of the box on most Linux distributions. Mostly storage, monitoring, or networking related-- aka some of the most important things.
      - jiggawatts 6y ago
        You mean like Storage Spaces, ReFS, Access Control Lists including rich Claims support, TPM-integrated volume encryption, cluster volume encryption, encrypting file system with user-friendly smart card integration? Or do you mean things like the Windows Management Instrumentation that is object oriented, works locally and remotely, and has over ten thousand counters by default? Or the event log that has had circular binary logs and log forwarding available with no extra software for two decades? Or do you mean how Windows Server has RDMA support so that even simple things like file transfers over SMB3 can run at wire speed on 40 Gbps Ethernet and replace fibre channel at a fraction of the cost? Or is it the native IPv6 support that actually works (unlike, say, MacOS)? Are you talking about the Windows DNS client, which unlike Linux can properly handle an unresponsive primary DNS server? Or the policy-driven IPsec support? The Always On VPN capability maybe? Which of these important things were you referring to?
- tremon 6y ago
  It's not about capability, it's about licensing. Exposing your Microsoft DNS Server over the Internet would require a Windows CAL for every citizen of the world, or an additional External Connector license to the tune of $5000 per server per year. That's a lot of money for the "convenience" of not having to setup a BIND slave zone.
  - jiggawatts 6y ago
    That's just not true, you don't need CALs for anonymous access, and most enterprises have different licensing such as Datacenter Edition where this just doesn't apply. Just like how you can run an Internet-facing website on IIS, you can run a DNS server on Windows. Anyway, $5000 is pocket change for most orgs, and it's a lot less than what it would cost to run an additional operating system on top of Windows. The time it would take just to choose a distro before even starting to set up several Linux or BSD servers would cost more than $5K in most places I've been. Then you have to worry about keeping them patched, backed up, in-sync with each other, etc... If you don't already run a largely Linux/UNIX shop, spinning up BIND is much, much more expensive than a couple of additional Windows VMs on top of the pile of hundreds they likely already have.
    - deleted 6y ago
      [deleted]

jiggawatts 6y ago

Why? It works quite well! I just recently worked on a large government department that had approximately 100 public, Internet-facing DNS zones hosted on a pair of Windows servers. I seriously don't get this automatic dismissal of Windows Server as "not a real server operating system". An enormous fraction of large enterprises run on it, very often for Internet-facing infrastructure. Microsoft.com. Azure.net. Stackoverflow.com. You know... those teeny-tiny toy sites nobody ever visits. Just because you're not familiar with it, and just because you can't imagine how it could be managed properly doesn't mean other people don't know how to do it. PS: The list of BIND's CVE entries is here, in case you think that being UNIX-based makes it magically immune to security vulnerabilities: https://www.cvedetails.com/vulnerability-list.php?vendor_id=64&product_id=144 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

lmm 6y ago
If it's not open-source, then how can you be confident that it doesn't suck? Hobbyists don't tinker with it, people probably don't publish benchmarks of it. Sure, maybe it works fine, but it might also be awful. So why take the risk when there's an open-source option?
- jodrellblank 6y ago
  "Ninety per cent of Fortune 500 companies use Azure AD, the sign-in engine for Office 365." - https://azure.microsoft.com/en-gb/services/active-directory/integrate/#features https://azure.microsoft.com/en-gb/services/active-directory/... But you can't know whether it works unless hobbyists tinker with it?? (Even though hobbyists do tinker with Windows)
  - lmm 6y ago
    Yep. I've seen lots of terrible software used by Fortune 500 companies - the person making the purchasing decision usually isn't the person actually using it, so the software quality has no impact on whether it gets bought.
    - jodrellblank 6y ago
      I've seen lots of terrible open source software - nobody is purchasing it, and the people who would normally make purchasing decisions aren't involved at all, so the software quality has no impact on whether it gets bought.
      - lmm 6y ago
        Sure. But you can find what people say about a given piece of open-source software; generally people will have tinkered with it and kicked the tires a bit and written up their impressions, maybe ran some benchmarks. And maybe you miss out on the occasional gem that way because there's a really good library that just hasn't been touched by anyone for whatever reason, but at least you can avoid picking a lemon. Whereas there are lots of lemons in the proprietary software market, and no real way to distinguish them.
        jodrellblank 6y ago
        > there are lots of lemons in the proprietary software market, and no real way to distinguish them. You can find what people say about a given piece of proprietary software; generally people will have used it and written up their impressions, maybe ran some benchmarks. Have you honestly never seen a review of a closed source program? Never seen anyone write about their likes or dislikes? Never seen any shareware/try before you buy/free tier software? Never seen anyone use some, decide it was bad, and change to another vendor? Never seen someone try the free version of SQL server or comment about their experiences with IIS or review a new release of Windows? Never seen a computer game review? Or a magazine dedicated to game reviews? Or reviews of Apple app store software?
- tomc1985 6y ago
  Call me crazy, but as a hobbyist I tinkered with (pirated) Windows Server, Exchange, and Active Directory installs. I had OWA up and running from my home IP, it synced contacts and email with my phone via some exchange integration, years before gmail. It was actually a lot of fun around the Server 2003 era. And while complex and byzantine, Windows Server was rock solid if you treat it right.
  - EvanAnderson 6y ago
    Saying this w/ extensive experience w/ Windows Server, Linux, and a couple of very old Unix flavors: Anything can be complex and byzantine if the developers put their minds to it.
    - tomc1985 6y ago
      Indeed. I have the same complaint about linux now.
      - 68799EE8 6y ago
        It's not "linux" it's "GNU/systemd"
        tomc1985 6y ago
        Honestly I'd prefer systemd over the mess that is init.d
        JdeBP 6y ago
        That isn't, and never was, the choice, however.
- jiggawatts 6y ago
  Are you... joking? First of all, I have decades of experience with Windows, Linux, and BSD. I know they all suck, just in different ways. Don't automatically assume that the only operating system with which you are familiar is magically better. You've just become accustomed to its flaws and warts. It is the devil you know, and other, unfamiliar systems are scary and strange. To you. Not to other people. By the way, the hobbyist tinkering is the main cause of the things I've found to suck in Linux. It's just unprofessional, through and through. It hasn't got the "boring bits" filled out, the bits nobody could be bothered to tinker with because they weren't being paid to. It still(!) struggles with spaces in file name paths. In 2020 it still struggles to consistently handle esoteric new concepts like the backspace key. A case in point is the wailing and gnashing of teeth in the Linux community about systemd. From an external objective perspective, this is absurdly childish. Linux is missing 80% of the basic functionality that MacOS and Windows have had since forever. Since the NT4 days in the 1990 forever. In reaction to the systemd team dragging Linux into this century, people lost their minds. They got so mad they were practically frothing at the mouth. I've seen similarly amateurish, unprofessional, dismissive attitudes everywhere I've turned whenever I hit a problem with Linux. Most recently I dug into the history of why its DNS client is so incredibly bad, and it was just a shitshow of stupid, stupid arguments on various forums that have gone on for decades. Idiots arguing very loudly overruling the people giving good, but humble advice.
  - w7 6y ago
    "80% of the basic functionality" Is this a desktop functionality oriented post or something? Because there are things I find daily that can't be done with Windows Server, but come out of the box on most Linux distributions. Mostly storage, monitoring, or networking related-- aka some of the most important things.
    - jiggawatts 6y ago
      You mean like Storage Spaces, ReFS, Access Control Lists including rich Claims support, TPM-integrated volume encryption, cluster volume encryption, encrypting file system with user-friendly smart card integration? Or do you mean things like the Windows Management Instrumentation that is object oriented, works locally and remotely, and has over ten thousand counters by default? Or the event log that has had circular binary logs and log forwarding available with no extra software for two decades? Or do you mean how Windows Server has RDMA support so that even simple things like file transfers over SMB3 can run at wire speed on 40 Gbps Ethernet and replace fibre channel at a fraction of the cost? Or is it the native IPv6 support that actually works (unlike, say, MacOS)? Are you talking about the Windows DNS client, which unlike Linux can properly handle an unresponsive primary DNS server? Or the policy-driven IPsec support? The Always On VPN capability maybe? Which of these important things were you referring to?
tremon 6y ago
It's not about capability, it's about licensing. Exposing your Microsoft DNS Server over the Internet would require a Windows CAL for every citizen of the world, or an additional External Connector license to the tune of $5000 per server per year. That's a lot of money for the "convenience" of not having to setup a BIND slave zone.
- jiggawatts 6y ago
  That's just not true, you don't need CALs for anonymous access, and most enterprises have different licensing such as Datacenter Edition where this just doesn't apply. Just like how you can run an Internet-facing website on IIS, you can run a DNS server on Windows. Anyway, $5000 is pocket change for most orgs, and it's a lot less than what it would cost to run an additional operating system on top of Windows. The time it would take just to choose a distro before even starting to set up several Linux or BSD servers would cost more than $5K in most places I've been. Then you have to worry about keeping them patched, backed up, in-sync with each other, etc... If you don't already run a largely Linux/UNIX shop, spinning up BIND is much, much more expensive than a couple of additional Windows VMs on top of the pile of hundreds they likely already have.
  - deleted 6y ago
    [deleted]