3 ms·

Ask HN: What would you like to see in hosted DNS? (Free account for feedback)

2 points by ra 16y ago

<EDIT> FREE 1 year pro account for all HN'ers who offer suggestions ;-) </EDIT> I have written a web app to manage authoritative DNS, something along the lines of Zonedit or the DNS editors you get with Slicehost / Linode. My question is, what would you like to see in a hosted DNS service? Some things I have thought of so far: - name servers hosted entirely in disparate jurisdictions, eg: Sweden, Iceland. - Recaptcha authentication (This is your DNS we're talking about here). - Optional SMS authentication for DNS changes. - Clone a domain (so, everything is a template) - Shortcuts for adding onerous configurations (looking at you "gmail for domains") What would make YOU want to use my DNS service? Is there anything that would be a deal breaker if I didn't offer it? thanks

mopoke 16y ago
Bulk change of records (change all instances of IP address x.x.x.x to y.y.y.y) Import/export zone files (useful for migrating to/from the service) Low cost :-)
- ra 16y ago
  Thanks for that. What would you consider as "low cost"?
  - mopoke 16y ago
    I think amazon have set a pretty competitive benchmark with Route 53. ($1 per zone per month plus $0.50 per million queries)
mooism2 16y ago
(Caveat: my dns is hosted by my registrar; I am currently happy with them and not looking to switch.) Recaptcha would protect my account how? If you mean I have to pass a recaptcha in addition to providing my username+password when I log in, then (a) I don't see that this adds much security; and (b) the presence of the captcha would put me off using your service. I like the idea of sms authentication for making dns changes. Does where name servers are make any difference? Surely what matters is where your company is based? (If you have a good answer to this, you should put it in your faq.) Something I'd like to see as an option on this sort of technical webapp, is that as an ALTERNATIVE to the webapp I can ssh in and use a curses app to change settings, using a private key to authenticate myself, and disable use of the webapp for managing my account. (You might implement this using a suitably restricted curses-based web browser, that's not the point. The point is that I don't need to manage yet another password for a service I will not login to frequently.) Not being able to register domains would be a minus point.
- ra 16y ago
  Thanks for all of that! The recaptcha on login would only be presented after 3 failed login attempts, much like what happens at googles authentication. It protects your account from brute force. Nameserver location: I was thinking of, eg: ns1.nameserver.ch in switzerland, ns2.nameserver.co.uk in the UK, etc etc... basically to make it harder for a single jurisdiction to take down your site without a good reason. That idea came from the "poker-site takedown thread" at the weekend. SSH interface ... that's brilliant! Although if your goal is to not manage another password, what if I offered OAuth w/ gmail / facebook? Regarding registering domains. I think you're right. Thanks once again for the feedback. (Feel free to pass your free year on to a friend when I launch :-)
  - mooism2 16y ago
    Recaptcha after failed logins --- yes, that makes sense. Nameserver locations. If you are based in (e.g.) Belgium, with nameservers in Switzerland, the UK and France, then my .com is at risk from the US (can order the registry to kill my domain) and Belgian (can (potentially) order you to kill my domain) police / justice systems. In addition, the Swiss, British and French can each block a substantial proportion of my visitors. On the other hand, if you were based in the US and all your nameservers were in the US, then my .com would only be at risk from the US police/judiciary. Similarly, my .co.uk is surely safest when hosted by a UK company on nameservers located only in the UK. I didn't read most of the poker site takedown thread, so maybe there is a good counter-argument there. But as a random web developer, that's my concern. (There are other reasons for spreading nameservers around though --- as a customer I wouldn't worry about the increased legal attack surface unless I had concerns about specific countries.) Logging in via Facebook/Gmail/Twitter/etc. I wouldn't use Gmail because when Gmail goes down and prevents me from logging in, there's not much point asking for a password reset e-mail to be sent to my Gmail account. I'm not sure how safe it is to rely on my Facebook or Twitter credentials for something like dns hosting. I login to HN and StackOverflow using OpenID, and I use OpenID for commenting on blogs sometimes as well, and although I'd be upset if my OpenID got compromised and I got locked out of these accounts, I'd be much much more upset if my domain names were suddenly being used to sell Viagra as well. Meanwhile, if my ssh private key gets compromised, it's overwhelmingly likely that my Twitter+Facebook+Gmail passwords get compromised as well, because a machine I access the net from will have been compromised. The reverse is not true. I think on balance for this sort of website I prefer using (and writing down somewhere) yet another password over entrusting my dns security to Facebook/Twitter. I'd prefer a properly maintained public key ssh interface to either. I do appreciate that it's another interface that needs maintaining though; I don't know what Javascript support text mode browsers have.

2 points by ra 16y ago

mopoke 16y ago

Bulk change of records (change all instances of IP address x.x.x.x to y.y.y.y) Import/export zone files (useful for migrating to/from the service) Low cost :-)

ra 16y ago
Thanks for that. What would you consider as "low cost"?
- mopoke 16y ago
  I think amazon have set a pretty competitive benchmark with Route 53. ($1 per zone per month plus $0.50 per million queries)

mooism2 16y ago

(Caveat: my dns is hosted by my registrar; I am currently happy with them and not looking to switch.) Recaptcha would protect my account how? If you mean I have to pass a recaptcha in addition to providing my username+password when I log in, then (a) I don't see that this adds much security; and (b) the presence of the captcha would put me off using your service. I like the idea of sms authentication for making dns changes. Does where name servers are make any difference? Surely what matters is where your company is based? (If you have a good answer to this, you should put it in your faq.) Something I'd like to see as an option on this sort of technical webapp, is that as an ALTERNATIVE to the webapp I can ssh in and use a curses app to change settings, using a private key to authenticate myself, and disable use of the webapp for managing my account. (You might implement this using a suitably restricted curses-based web browser, that's not the point. The point is that I don't need to manage yet another password for a service I will not login to frequently.) Not being able to register domains would be a minus point.

ra 16y ago
Thanks for all of that! The recaptcha on login would only be presented after 3 failed login attempts, much like what happens at googles authentication. It protects your account from brute force. Nameserver location: I was thinking of, eg: ns1.nameserver.ch in switzerland, ns2.nameserver.co.uk in the UK, etc etc... basically to make it harder for a single jurisdiction to take down your site without a good reason. That idea came from the "poker-site takedown thread" at the weekend. SSH interface ... that's brilliant! Although if your goal is to not manage another password, what if I offered OAuth w/ gmail / facebook? Regarding registering domains. I think you're right. Thanks once again for the feedback. (Feel free to pass your free year on to a friend when I launch :-)
- mooism2 16y ago
  Recaptcha after failed logins --- yes, that makes sense. Nameserver locations. If you are based in (e.g.) Belgium, with nameservers in Switzerland, the UK and France, then my .com is at risk from the US (can order the registry to kill my domain) and Belgian (can (potentially) order you to kill my domain) police / justice systems. In addition, the Swiss, British and French can each block a substantial proportion of my visitors. On the other hand, if you were based in the US and all your nameservers were in the US, then my .com would only be at risk from the US police/judiciary. Similarly, my .co.uk is surely safest when hosted by a UK company on nameservers located only in the UK. I didn't read most of the poker site takedown thread, so maybe there is a good counter-argument there. But as a random web developer, that's my concern. (There are other reasons for spreading nameservers around though --- as a customer I wouldn't worry about the increased legal attack surface unless I had concerns about specific countries.) Logging in via Facebook/Gmail/Twitter/etc. I wouldn't use Gmail because when Gmail goes down and prevents me from logging in, there's not much point asking for a password reset e-mail to be sent to my Gmail account. I'm not sure how safe it is to rely on my Facebook or Twitter credentials for something like dns hosting. I login to HN and StackOverflow using OpenID, and I use OpenID for commenting on blogs sometimes as well, and although I'd be upset if my OpenID got compromised and I got locked out of these accounts, I'd be much much more upset if my domain names were suddenly being used to sell Viagra as well. Meanwhile, if my ssh private key gets compromised, it's overwhelmingly likely that my Twitter+Facebook+Gmail passwords get compromised as well, because a machine I access the net from will have been compromised. The reverse is not true. I think on balance for this sort of website I prefer using (and writing down somewhere) yet another password over entrusting my dns security to Facebook/Twitter. I'd prefer a properly maintained public key ssh interface to either. I do appreciate that it's another interface that needs maintaining though; I don't know what Javascript support text mode browsers have.