10 ms·

Goodbye PowerDNS

214 points by jpswade 6y ago

Dahoon 6y ago
Quite a good read but I think we killed his personal blog for now. I recommend this article on the site: https://blog.powerdns.com/2019/09/25/centralised-doh-is-bad-for-privacy-in-2019-and-beyond/ https://blog.powerdns.com/2019/09/25/centralised-doh-is-bad-...
- ahubert 6y ago
  Hi - which part of my blog was down? I am trying to find problems, but I see steady visitor numbers? Can you help?
  - jtwaleson 6y ago
    You should use cloudflare to handle surges in traffic like this. (Sorry, couldn't resist ;) )
    - ahubert 6y ago
      "lol" :-) - but I checked, it never got over 4 Mbit/s.
  - Dahoon 6y ago
    Sorry I should have been more clear. The following link from the article was dead at the time: https://berthub.eu/articles/posts/history-of-powerdns-1999-2003/ https://berthub.eu/articles/posts/history-of-powerdns-1999-2...
    - ahubert 6y ago
      Hmm ok - dead as in timeout? or 404? Thanks!
greatgib 6y ago
The most important point to share from his message in my opinion: <<DNS and the Cloud Later, I saw that there was a push for “the cloud” to take over yet another part of our Internet. Encrypted DNS is great, we should all do far more of that. But I was (and am) tremendously unhappy that more and more of DNS is now set to move to (among others) Google and Cloudflare control – both of whom protest that they have nothing but the best intentions. But still I see yet more of the Internet getting centralised, and I worry where that will go. I also worry that people somehow are not worrying about this – somehow we’ve made peace with the fact that companies far away get very detailed records on everything we do online, and that we just have to live with that.>>
- gitweb 6y ago
  I don't think we have made peace. The issue is the market is being flooded with new recruits that don't care and grew up in the cloud, and these companies are actively involved in the education system to make it the new norm. We used to have actual computer science degrees and now we have IT training camps ran by the companies that have their own selfish interests.
  - matthewmacleod 6y ago
    You know that we still have actual computer science degrees though, right? I don’t even know what point you are trying to make with this misinformation.
    - onei 6y ago
      I'm not convinced a CompSci degree actually teaches the history of the internet and why being decentralised might be something worth having. I didn't learn ideals from my university, or certainly not the ideals they want me to learn.
      - not_knuth 6y ago
        Well I guess it depends on where you study. My university was full of profs that never dared to even recommend proprietary software to us and always preached to us about the open web. Though, I should disclose, that this was in Germany, and for some reason I have found Germans to be particulary strong advocates of the decentralized web and general FOSS things.
gitweb 6y ago
Sad to see you go, but kind of happy too since it appears you're now working in a position that gives you influence over government intelligence agencies and who they decide to prosecute.
tannhaeuser 6y ago
Wow, didn't know it was this bad. Though it makes sense that Google, Cloudflare, and co would grab every DNS query they can get get, as additional sensor data for tracking. As if this wasn't crystal clear already from the push towards DNS-over-HTTP.
- jasonvorhe 6y ago
  > "Moreover, Google does not use any personal information collected through the Public DNS service to target ads. We do not correlate or associate personal information in Google Public DNS logs with your information from use of any other Google service except for addressing security and abuse." https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy Do you have proof that the opposite is true?
  - sofetch 6y ago
    > Do you have proof that the opposite is true? Why would this be necessary with the big gaping hole in the assertion? > except for addressing security and abuse. I expect Google and I have very different conceptions of what qualifies as "abuse" and how to "address" it.
  - dijit 6y ago
    Even if it isn’t happening now, which I find no evidence either way (privacy policies are historically less followed than laws, and companies break laws willingly- and even then? What constitutes “abuse”?)- can you make the case that this data will never be correlated or used? In perpetuity? Seems like _not_ giving away data is the only way to be sure if that. Everything else is subject to change.
  - gsich 6y ago
    You posted it yourself. Only Google knows what "abuse" and "security" means. So you need to assume that the opposite is indeed true.
  - capableweb 6y ago
    The privacy policy starts with "We take your privacy very seriously", which coming from Google, is kind of funny. A bit like sitting on the phone in a queue for 2 hours and hearing an automated voice saying "We care about customer service!" repeatedly. The "Google does not use any personal information collected through the Public DNS service to target ads" sentence is oddly specific as well. Why is it only mentioning "targeted ads" and not "for any sort of purposed"? Why is it collected if you're not using it? What does "abuse" really mean in this context, and what does "addressing" it entail? Only the big guys at Google knows. Finally, the holy privacy policy of Google can change at any time. "We change this Privacy Policy from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent." it says, which makes sense if you're a Google user. What about me, who don't have a Google account? How do I, tell this public DNS service that I don't agree to the new privacy policy? Right, I can't, you assume I'm fine with it. I think we're long past the point of having to prove that various tech companies don't care about people's privacy. The burden of proof that you're actively taking steps to preserve it is on you, as you've already burned all the goodwill you had from the internet crowd.
skrebbel 6y ago
Bert is a common guest at my favourite Dutch podcast, the terribly named "BNR Digitaal". I hope he doesn't stop doing that! All the best to you, Bert!
- ahubert 6y ago
  Don't worry, I was on BNR last week and will be again :-)
  - skrebbel 6y ago
    Supervet!
louwrentius 6y ago
I experienced how many good tech people don’t understand DNS and how this just solidifies control over DNS by the big players. What a ton of people don’t understand is that you don’t need a DNS forwarder (google/cloud flare/ISP). If you setup your DNS right it just goes to the ROOT servers and you cut out those parties spying on DNS traffic. Initial requests are a bit slower because you don’t benefit from the forwarder’s cache, but after a while, most stuff is coached and it’s not a big deal. Maybe I’m totally wrong here, but this is how I understand it.
- pw6hv 6y ago
  Would you care to elaborate how one would start implementing a DNS that goes directly to the ROOT? Honestly interested here.
  - znpy 6y ago
    If you don't specify a forwarder in the bind9 configuration it should query the root DNS servers directly, iirc.
  - liv-io 6y ago
    I'd recommend you to use Unbound and specify the named.root or (root.hints) file: https://www.internic.net/domain/named.root https://www.internic.net/domain/named.root This Ansible role takes care of configuring it all (CentOS): https://github.com/liv-io/ansible-roles-centos/tree/master/unbound https://github.com/liv-io/ansible-roles-centos/tree/master/u... I have it for FreeBSD and OpenBSD too: https://github.com/liv-io/ansible-roles-bsd/tree/master/unbound https://github.com/liv-io/ansible-roles-bsd/tree/master/unbo...
  - aeden 6y ago
    I think the post is suggesting running your own local resolver instead of using a public resolver or an ISP resolver.
  - adrian_b 6y ago
    For example you may use the open-source program "dnscache" from Daniel Bernstein. I have been using this program on all my computers, during the last almost twenty years, without problems.
throw0101a 6y ago
Of course his most well-known Twitter handle has "PowerDNS" in it: * https://twitter.com/PowerDNS_Bert https://twitter.com/PowerDNS_Bert He also has: * https://twitter.com/bert_hubert https://twitter.com/bert_hubert * https://twitter.com/GalileoSats https://twitter.com/GalileoSats
casperb 6y ago
I met Bert a couple of times 10 years ago at meetups in the Netherlands, he is a wonderful person and a great mind. I think it is great that he walks away when his hart is not in it anymore. I think a lot of big open source projects can become a big burden on its creators and some of them not daring to move on because of the feeling of responsibility. Same with the move of Redis’ founder it think these are great examples for the community.
imrejonk 6y ago
Looks like he got the idea for PowerDNS from a URL shortening service [1]. They wanted better performance for visitors from the US, and Bert just went ahead and founded a company that made DNS load balancing software. Sounds like 1999 indeed. I got to work a lot with PowerDNS during my internship, which was at a web hosting company that wanted to implement DNSSEC. What a fantastic piece of software it has become. Thanks for your involvement Bert, and best of luck at the TIB! [1] https://berthub.eu/articles/posts/history-of-powerdns-1999-2003/ https://berthub.eu/articles/posts/history-of-powerdns-1999-2...
- ahubert 6y ago
  thanks!
- oauea 6y ago
  I've used powerdns for years to run our company DNS and it has been fantastic. We have now, unfortunately, moved to the cloud.
baggachipz 6y ago
Bye Bert, I'll miss your informative and entertaining presentations at OXmas :(
xyse53 6y ago
Cheers, and thank you! I have a vanity domain which I use to exercise my internet independence :) I've been using PowerDNS with a hidden master, public secondaries, dns updates with lua authorization for dynamic ips and let's encrypt for years. Also the recursor for local systems. I received great help and had some fun chats on IRC in the beginning. PowerDNS has been a great part of my "infrastructure". My only complaint is that packagers and other naming can't choose between 'powerdns' and 'pdns' :)
wila 6y ago
Thank you Bert for PowerDNS, it's a great tool. While not exciting for you anymore, I am happy that it continues to run without much excitement. Thanks also for making sure it is in good hands after you step down, much appreciated. Wishing you the best on your new endeavors. Keep life exciting and live it to the max :)
jart 6y ago
What an interesting story. Guy who writes dns server fights tirelessly to keep the internet under democratic control, gets bullied by google and cloudflare usurping control of the domain name system, declares defeat and decides to take an easy job being an overseer of intelligence agencies. Well maybe not exactly, but thank you for everything you did to support the community with PowerDNS. It's always a loss when founders of important projects like this need to step back because certain kinds of passion just can't be replaced, but I'm sure you left it in good hands.
- ahubert 6y ago
  Nice description :-) And yes, I am convinced PowerDNS is in good hands.
  - ahubert 6y ago
    Also, Google has been very civil.
    - thatguy0900 6y ago
      well now you've got me curious about cloudflare...
vaccinator 6y ago
Maybe we don't need encrypted DNS for each request... instead we should all have a securely downloaded mirror of all DNS records so that individual requests don't go to third parties...
- jlgaddis 6y ago
  There was a time when we all passed the hosts file around. That became unworkable about three and a half decades or so ago, however, and the DNS was created to solve that problem.
  - vaccinator 6y ago
    It can't be more then a gigabyte... I guess DNS was ahead of its time when it comes to clouds... but clouds are killing the internet as we used to know it
    - jodrellblank 6y ago
      "According to the latest data from Verisign, there were 359.8 million registered domain names at the close of 2019’s third quarter." - https://makeawebsitehub.com/how-many-domains-are-there/ https://makeawebsitehub.com/how-many-domains-are-there/ Assume each zonefile is 1Kb that could be 350GB of data, right?
sontek 6y ago
I found this blog really hard to read. It has a static font of "15px" which is an odd decision since browsers default to a 16px. I would love to see it updated to us em instead. Since I actually have tweaked my browser settings to by default use a larger font that statically defined pixels don't listen to. Once I zoomed the blog to 125% I was able to read it just fine but read it at 133% since it was more comfortable for me.

214 points by jpswade 6y ago

Quite a good read but I think we killed his personal blog for now. I recommend this article on the site: https://blog.powerdns.com/2019/09/25/centralised-doh-is-bad-for-privacy-in-2019-and-beyond/ https://blog.powerdns.com/2019/09/25/centralised-doh-is-bad-...

ahubert 6y ago
Hi - which part of my blog was down? I am trying to find problems, but I see steady visitor numbers? Can you help?
- jtwaleson 6y ago
  You should use cloudflare to handle surges in traffic like this. (Sorry, couldn't resist ;) )
  - ahubert 6y ago
    "lol" :-) - but I checked, it never got over 4 Mbit/s.
- Dahoon 6y ago
  Sorry I should have been more clear. The following link from the article was dead at the time: https://berthub.eu/articles/posts/history-of-powerdns-1999-2003/ https://berthub.eu/articles/posts/history-of-powerdns-1999-2...
  - ahubert 6y ago
    Hmm ok - dead as in timeout? or 404? Thanks!

greatgib 6y ago

The most important point to share from his message in my opinion: <<DNS and the Cloud Later, I saw that there was a push for “the cloud” to take over yet another part of our Internet. Encrypted DNS is great, we should all do far more of that. But I was (and am) tremendously unhappy that more and more of DNS is now set to move to (among others) Google and Cloudflare control – both of whom protest that they have nothing but the best intentions. But still I see yet more of the Internet getting centralised, and I worry where that will go. I also worry that people somehow are not worrying about this – somehow we’ve made peace with the fact that companies far away get very detailed records on everything we do online, and that we just have to live with that.>>

gitweb 6y ago
I don't think we have made peace. The issue is the market is being flooded with new recruits that don't care and grew up in the cloud, and these companies are actively involved in the education system to make it the new norm. We used to have actual computer science degrees and now we have IT training camps ran by the companies that have their own selfish interests.
- matthewmacleod 6y ago
  You know that we still have actual computer science degrees though, right? I don’t even know what point you are trying to make with this misinformation.
  - onei 6y ago
    I'm not convinced a CompSci degree actually teaches the history of the internet and why being decentralised might be something worth having. I didn't learn ideals from my university, or certainly not the ideals they want me to learn.
    - not_knuth 6y ago
      Well I guess it depends on where you study. My university was full of profs that never dared to even recommend proprietary software to us and always preached to us about the open web. Though, I should disclose, that this was in Germany, and for some reason I have found Germans to be particulary strong advocates of the decentralized web and general FOSS things.

gitweb 6y ago

Sad to see you go, but kind of happy too since it appears you're now working in a position that gives you influence over government intelligence agencies and who they decide to prosecute.

tannhaeuser 6y ago

Wow, didn't know it was this bad. Though it makes sense that Google, Cloudflare, and co would grab every DNS query they can get get, as additional sensor data for tracking. As if this wasn't crystal clear already from the push towards DNS-over-HTTP.

jasonvorhe 6y ago
> "Moreover, Google does not use any personal information collected through the Public DNS service to target ads. We do not correlate or associate personal information in Google Public DNS logs with your information from use of any other Google service except for addressing security and abuse." https://developers.google.com/speed/public-dns/privacy https://developers.google.com/speed/public-dns/privacy Do you have proof that the opposite is true?
- sofetch 6y ago
  > Do you have proof that the opposite is true? Why would this be necessary with the big gaping hole in the assertion? > except for addressing security and abuse. I expect Google and I have very different conceptions of what qualifies as "abuse" and how to "address" it.
- dijit 6y ago
  Even if it isn’t happening now, which I find no evidence either way (privacy policies are historically less followed than laws, and companies break laws willingly- and even then? What constitutes “abuse”?)- can you make the case that this data will never be correlated or used? In perpetuity? Seems like _not_ giving away data is the only way to be sure if that. Everything else is subject to change.
- gsich 6y ago
  You posted it yourself. Only Google knows what "abuse" and "security" means. So you need to assume that the opposite is indeed true.
- capableweb 6y ago
  The privacy policy starts with "We take your privacy very seriously", which coming from Google, is kind of funny. A bit like sitting on the phone in a queue for 2 hours and hearing an automated voice saying "We care about customer service!" repeatedly. The "Google does not use any personal information collected through the Public DNS service to target ads" sentence is oddly specific as well. Why is it only mentioning "targeted ads" and not "for any sort of purposed"? Why is it collected if you're not using it? What does "abuse" really mean in this context, and what does "addressing" it entail? Only the big guys at Google knows. Finally, the holy privacy policy of Google can change at any time. "We change this Privacy Policy from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent." it says, which makes sense if you're a Google user. What about me, who don't have a Google account? How do I, tell this public DNS service that I don't agree to the new privacy policy? Right, I can't, you assume I'm fine with it. I think we're long past the point of having to prove that various tech companies don't care about people's privacy. The burden of proof that you're actively taking steps to preserve it is on you, as you've already burned all the goodwill you had from the internet crowd.

skrebbel 6y ago

Bert is a common guest at my favourite Dutch podcast, the terribly named "BNR Digitaal". I hope he doesn't stop doing that! All the best to you, Bert!

ahubert 6y ago
Don't worry, I was on BNR last week and will be again :-)
- skrebbel 6y ago
  Supervet!

louwrentius 6y ago

I experienced how many good tech people don’t understand DNS and how this just solidifies control over DNS by the big players. What a ton of people don’t understand is that you don’t need a DNS forwarder (google/cloud flare/ISP). If you setup your DNS right it just goes to the ROOT servers and you cut out those parties spying on DNS traffic. Initial requests are a bit slower because you don’t benefit from the forwarder’s cache, but after a while, most stuff is coached and it’s not a big deal. Maybe I’m totally wrong here, but this is how I understand it.

pw6hv 6y ago
Would you care to elaborate how one would start implementing a DNS that goes directly to the ROOT? Honestly interested here.
- znpy 6y ago
  If you don't specify a forwarder in the bind9 configuration it should query the root DNS servers directly, iirc.
- liv-io 6y ago
  I'd recommend you to use Unbound and specify the named.root or (root.hints) file: https://www.internic.net/domain/named.root https://www.internic.net/domain/named.root This Ansible role takes care of configuring it all (CentOS): https://github.com/liv-io/ansible-roles-centos/tree/master/unbound https://github.com/liv-io/ansible-roles-centos/tree/master/u... I have it for FreeBSD and OpenBSD too: https://github.com/liv-io/ansible-roles-bsd/tree/master/unbound https://github.com/liv-io/ansible-roles-bsd/tree/master/unbo...
- aeden 6y ago
  I think the post is suggesting running your own local resolver instead of using a public resolver or an ISP resolver.
- adrian_b 6y ago
  For example you may use the open-source program "dnscache" from Daniel Bernstein. I have been using this program on all my computers, during the last almost twenty years, without problems.

throw0101a 6y ago

Of course his most well-known Twitter handle has "PowerDNS" in it: * https://twitter.com/PowerDNS_Bert https://twitter.com/PowerDNS_Bert He also has: * https://twitter.com/bert_hubert https://twitter.com/bert_hubert * https://twitter.com/GalileoSats https://twitter.com/GalileoSats

casperb 6y ago

I met Bert a couple of times 10 years ago at meetups in the Netherlands, he is a wonderful person and a great mind. I think it is great that he walks away when his hart is not in it anymore. I think a lot of big open source projects can become a big burden on its creators and some of them not daring to move on because of the feeling of responsibility. Same with the move of Redis’ founder it think these are great examples for the community.

imrejonk 6y ago

Looks like he got the idea for PowerDNS from a URL shortening service [1]. They wanted better performance for visitors from the US, and Bert just went ahead and founded a company that made DNS load balancing software. Sounds like 1999 indeed. I got to work a lot with PowerDNS during my internship, which was at a web hosting company that wanted to implement DNSSEC. What a fantastic piece of software it has become. Thanks for your involvement Bert, and best of luck at the TIB! [1] https://berthub.eu/articles/posts/history-of-powerdns-1999-2003/ https://berthub.eu/articles/posts/history-of-powerdns-1999-2...

ahubert 6y ago
thanks!
oauea 6y ago
I've used powerdns for years to run our company DNS and it has been fantastic. We have now, unfortunately, moved to the cloud.

baggachipz 6y ago

Bye Bert, I'll miss your informative and entertaining presentations at OXmas :(

xyse53 6y ago

Cheers, and thank you! I have a vanity domain which I use to exercise my internet independence :) I've been using PowerDNS with a hidden master, public secondaries, dns updates with lua authorization for dynamic ips and let's encrypt for years. Also the recursor for local systems. I received great help and had some fun chats on IRC in the beginning. PowerDNS has been a great part of my "infrastructure". My only complaint is that packagers and other naming can't choose between 'powerdns' and 'pdns' :)

wila 6y ago

Thank you Bert for PowerDNS, it's a great tool. While not exciting for you anymore, I am happy that it continues to run without much excitement. Thanks also for making sure it is in good hands after you step down, much appreciated. Wishing you the best on your new endeavors. Keep life exciting and live it to the max :)

jart 6y ago

What an interesting story. Guy who writes dns server fights tirelessly to keep the internet under democratic control, gets bullied by google and cloudflare usurping control of the domain name system, declares defeat and decides to take an easy job being an overseer of intelligence agencies. Well maybe not exactly, but thank you for everything you did to support the community with PowerDNS. It's always a loss when founders of important projects like this need to step back because certain kinds of passion just can't be replaced, but I'm sure you left it in good hands.

ahubert 6y ago
Nice description :-) And yes, I am convinced PowerDNS is in good hands.
- ahubert 6y ago
  Also, Google has been very civil.
  - thatguy0900 6y ago
    well now you've got me curious about cloudflare...

vaccinator 6y ago

Maybe we don't need encrypted DNS for each request... instead we should all have a securely downloaded mirror of all DNS records so that individual requests don't go to third parties...

jlgaddis 6y ago
There was a time when we all passed the hosts file around. That became unworkable about three and a half decades or so ago, however, and the DNS was created to solve that problem.
- vaccinator 6y ago
  It can't be more then a gigabyte... I guess DNS was ahead of its time when it comes to clouds... but clouds are killing the internet as we used to know it
  - jodrellblank 6y ago
    "According to the latest data from Verisign, there were 359.8 million registered domain names at the close of 2019’s third quarter." - https://makeawebsitehub.com/how-many-domains-are-there/ https://makeawebsitehub.com/how-many-domains-are-there/ Assume each zonefile is 1Kb that could be 350GB of data, right?

sontek 6y ago

I found this blog really hard to read. It has a static font of "15px" which is an odd decision since browsers default to a 16px. I would love to see it updated to us em instead. Since I actually have tweaked my browser settings to by default use a larger font that statically defined pixels don't listen to. Once I zoomed the blog to 125% I was able to read it just fine but read it at 133% since it was more comfortable for me.