7 ms·

DNS is the literally the only compelling use case for blockchain that I have ever been able to come up with (besides paying for contraband). A distributed datab

DNS is the literally the only compelling use case for blockchain that I have ever been able to come up with (besides paying for contraband). A distributed database that no single entity owns is a perfect match for name resolution. Kind of amusing to me that blockchain DNS hasn't gotten off the ground. What hope do the less compelling blockchains have?

rasengan 5y ago
There is Handshake [1] which is getting significant [2] adoption [3]. [1] https://handshake.org/ https://handshake.org/ [2] https://twitter.com/opera/status/1476841607005622273?s=20 https://twitter.com/opera/status/1476841607005622273?s=20 [3] https://www.namecheap.com/about/press-releases/21-09-22/namecheap-now-offers-handshake-domain-names https://www.namecheap.com/about/press-releases/21-09-22/name...
- tptacek 5y ago
  Handshake has no meaningful adoption. It's a pre-mined cryptotoken, traded on exchanges; essentially, the Handshake founders decided to sell the Brooklyn Bridge, which is something that blockchains make feasible. No mainstream browser will ever support Handshake. More's the pity! If the Handshake DNS root heist works, it'd open up new business models for all of us. I had been looking forward to minting ARPCoin and charging everyone to join their WiFi networks.
  - rasengan 5y ago
    - tptacek 5y ago
      I work every day on DNS stuff (I own our firm's DNS server, and we're in an environment where it's truly "always DNS") and land naturally on any thread about DNS here. This particular thread isn't about Handshake; it's about setting up an alternate root hierarchy with standard DNS. Regardless of that fact: the guidelines demand that we not make insinuations about other commenters here, and this is the second weird interaction we've had in a row where you've done that. Please stop. My understanding is that you're a strong supporter of Handshake. I think Handshake is a crock. It is fine for us to disagree. But you will disagree with me civilly.
      - rasengan 5y ago
        > essentially, the Handshake founders decided to sell the Brooklyn Bridge, which is something that blockchains make feasible. > the guidelines demand that we not make insinuations about other commenters here, and this is the second weird interaction we've had in a row where you've done that. Please stop. Not that two wrongs make a right (nor did I state anything that isn't provable), but the insinuations started with your comment (including from previous comments) which was more than an insinuation but actually borderline slanderous (claiming fraudulent activity including stating things were sold that weren't owned, etc.). I also hope that you too will follow the same guidelines that we all strive to follow. > I think Handshake is a crock. It is fine for us to disagree. But you will disagree with me civilly. What about that comment is civil? What about your previous slanderous comments are civil? Finally, what about my factual statements aren't civil? I really hope 2022 is a better year for you.
        tptacek 5y ago
        The guidelines require us to be civil to each other. They do not require me to generous or to assume good faith of Handshake. I believe Handshake is a crock, you do not. I'm not impugning you (as you did me); you are not Handshake, or, as far as I know, any of its founders. It is fine for us to disagree. I have the better of the two arguments and am very comfortable leaving it there.
        rasengan 5y ago
        Where was I impugning you? Can you point to the specific text/example? I'm genuinely curious and wish to have a better understanding of how you are interpreting and seeing things as I've asked the opinion of others and none seem to agree with you. Despite what you claim in your slander, what [1] I [2] said [3] is [4] backed [5] by [6] fact [7]. [1] https://news.ycombinator.com/item?id=24241737 https://news.ycombinator.com/item?id=24241737 [2] https://news.ycombinator.com/item?id=22908576 https://news.ycombinator.com/item?id=22908576 [3] https://news.ycombinator.com/item?id=23350441 https://news.ycombinator.com/item?id=23350441 [4] https://news.ycombinator.com/item?id=29929657 https://news.ycombinator.com/item?id=29929657 [5] https://news.ycombinator.com/item?id=22900567 https://news.ycombinator.com/item?id=22900567 [6] https://news.ycombinator.com/item?id=22900986 https://news.ycombinator.com/item?id=22900986 [7] Your comments serve as the facts.
- DenseComet 5y ago
  You can't really count Opera as "significant". Handshake domains are only accessible by a tiny percent of people, make stuff like HTTPS very difficult[1], and no matter how devices eventually use Handshake, you'll always need to have a domain on a normal TLD because there will always be devices (like TVs and old phones) that will not support it. And what benefit do you get anyways? A custom TLD? There's already so many new TLDs but most domains are on gTLDs or ccTLDs because thats what people recognize. Even Google and Apple barely use theirs. Ownership? Not really. Handshake only manages TLDs. Buying a subdomain (like you can on Namecheap) doesn't happen on the blockchain, the owner of the TLD can take it away anytime. Say what you want to say about ICANN, but they do have rules (such as contingency plans) that new TLD owners have to follow. In what world is buying a handshake subdomain from an unknown person beholden to nobody better in any way? [1] https://www.namecheap.com/support/knowledgebase/article.aspx/10484/2278/namecheap-handshake-tlds/ https://www.namecheap.com/support/knowledgebase/article.aspx...
  - rasengan 5y ago
    > You can't really count Opera as "significant". 380m+ users seems significant to me. > Handshake domains are only accessible by a tiny percent of people Actually, NextDNS which is a Firefox resolver also supports Handshake, so I imagine it's not a tiny percent of people. > make stuff like HTTPS very difficult Additionally, HTTPS is completed by Handshake since it removes the need for a "trusted certificate authority" which, as many articles have mentioned as of late, is not so trusted [1][2]. > you'll always need to have a domain on a normal TLD because there will always be devices (like TVs and old phones) that will not support it. TVs and old phones can support handshake since it's just regular DNS protocol. > And what benefit do you get anyways? You will cryptographically own your own name. > A custom TLD? A name all-inclusive. Hard stop. > There's already so many new TLDs but most domains are on gTLDs or ccTLDs because thats what people recognize. I've been around for a long time -- the internet has evolved and continues to evolve. People change quickly. > Ownership? Not really. Handshake only manages TLDs. Cryptographically owning things is likely a more constant ownership than a 'binding ownership' by a legal contract in some jurisdiction. Some of the statements you made about subdomains may or may not be true, but it's not any worse than today and likely better since there will be more options of TLD owners to choose from should one choose to purchase a TLD. [1] https://github.com/imperviousinc/beacon-ios https://github.com/imperviousinc/beacon-ios [2] https://blog.mozilla.org/security/2021/12/09/improved-quality-of-intermediate-certificates-with-enhanced-oversight-and-automation/ https://blog.mozilla.org/security/2021/12/09/improved-qualit...
1vuio0pswjnm7 5y ago
From what I have seen the existing/proposed implementations suffer from the same problems that ICANN DNS has had, namely, artificial scarcity, vanity names, "gold rush/land grab" and commercialisation schemes. The ideal system, IMO, would be one where anyone can get a name, no one can "hoard" names, and all names are of equal value. As such, the profit motive, and thereby the impetus for corruption, is removed. I have created such DNS at home, I run an "alternate root" on the loopback. It's ideal for me.
- Tijdreiziger 5y ago
  > The ideal system, IMO, would be one where anyone can get a name, no one can "hoard" names, and all names are of equal value. I’m immediately reminded of Tor .onion names, though those aren’t exactly user-friendly…
  - egberts1 5y ago
    Neither are telephone numbers … being exactly a user-friendly thingie but there we go.
    - Tijdreiziger 5y ago
      Vastly more user-friendly than .onion names, I'd say :P
      - egberts1 5y ago
        Only by the virtue of being a less combinatorial options of the few, 10 to 15 digit telephone number that is.
    - aflag 5y ago
      That's why people have phone books and contact lists.
    - technothrasher 5y ago
      Phone numbers are the IP addresses. Your contact list (or the yellow/white pages in days long past) is the DNS server for them.
tptacek 5y ago
How would you actually accomplish a DNS blockchain? To run DNS-style Internet naming on a blockchain, you have to take control of the DNS roots. The DNS roots are community property. Unless ICANN came up with some process for starting a blockchain-based DNS, any new blockchain-based DNS would essentially be seizing community property by fiat. Nobody is going to let any private organization do that.
- easrng 5y ago
  Nope, sane projects would have 1 TLD they have names under and clients opt-in to resolution. Handshake is awful because it pretends it has the right to control the root and adds TLDs in such a way that there's no way to tell if a given domain needs to be resolved with handshake. Also it allows for numerical names which could collide with IPs. Don't use Handshake. ENS is also bad (no SPV, you usually end up relying on Infura), "Unstoppable" domains has all the problems of ENS, plus too many TLDs, and names can only be registered through the official servers. NameCoin might be ok, haven't looked into it too much. EmerCoin promises too much which makes me suspicious. (Like blockchain VoIP? What?) If I missed any, please let me know.
  - WanderPanda 5y ago
    ENS is not necessarily relying on Infura, I could imagine resolution being run by your ISP like it is common with DNS.
    - easrng 5y ago
      Because ISPs do such a great job with DNS now...
  - southerntofu 5y ago
    Sounds pretty much like the GNU Name System. With what they call a hyper hyper local root, you as a client define your own TLDs in addition to the root your system has configured (the system is intended to replace the existing ICANN root in a backwards-compatible manner). Delegation happens via public key and records are resolved through a DHT. The idea is you could add your friend/org's key to your root, and from there you could resolve recursively using your friend/org's zone. Pretty neat stuff, at least on paper.
lowwave 5y ago
handshake.org
xorcist 5y ago
As per usual, it depends very much on what you consider a blockchain. Is Certificate Transparency a blockchain? It's a Merkle tree, without any tokens involved. What would something like AlterNIC have looked like if it was backed by a blockchain? Would it have had easier acceptance, or more reliability?
- tptacek 5y ago
  No, AlterNIC would have failed regardless of the underlying technology. Its founder became a pariah. It's similar in a lot of ways to Handshake; just imagine that Handshake gets tired of nobody but Opera resolving its names, and then it hacks ICANN, and you've got pretty much a replay of that situation. It's worth comparing 1997 to 2022 to see why attempts to seize the Internet roots are unlikely to go anywhere. It's similar in a bunch of ways to the WebPKI. For all its faults, AlterNIC had a better case against Network Solutions than anyone has against ICANN: Internet governance at the time prohibited new TLDs, and registrars were rapacious. But over the next 10 years, that mostly changed, just like the WebPKI has been drastically cleaned up after abuses in the 2000s. People continually propose replacements for the WebPKI today that seem premised on a CA system that works like it did in 2005. But we don't have the 2005 WebPKI; we have 2022's. (I was doing DNS security work at the time Kashpureff cache poisoned internic.net, and it was a pretty formative experience for me, if people wonder why I'm so shocked that anyone would take Handshake seriously).
  - rasengan 5y ago
    Comparing Eugene's exploit to a decentralized root owned by the commons that complements ICANN's system is confusing to me. I can understand how his exploit could be a formative experience for you, what I can't understand is how that experience relates to Handshake. What you're saying is like, "imagine if a security researcher decided he was tired of getting paid much less than he deserves and decides to hack a bank," and then using this imagined experience as a "logical" reason to hold disdain for something. You're welcome to your opinion, but please stop trying to paint a false picture about Handshake specifically unless you're using actual facts that are real life and not imagined.

rasengan 5y ago

There is Handshake [1] which is getting significant [2] adoption [3]. [1] https://handshake.org/ https://handshake.org/ [2] https://twitter.com/opera/status/1476841607005622273?s=20 https://twitter.com/opera/status/1476841607005622273?s=20 [3] https://www.namecheap.com/about/press-releases/21-09-22/namecheap-now-offers-handshake-domain-names https://www.namecheap.com/about/press-releases/21-09-22/name...

tptacek 5y ago
Handshake has no meaningful adoption. It's a pre-mined cryptotoken, traded on exchanges; essentially, the Handshake founders decided to sell the Brooklyn Bridge, which is something that blockchains make feasible. No mainstream browser will ever support Handshake. More's the pity! If the Handshake DNS root heist works, it'd open up new business models for all of us. I had been looking forward to minting ARPCoin and charging everyone to join their WiFi networks.
- rasengan 5y ago
  - tptacek 5y ago
    I work every day on DNS stuff (I own our firm's DNS server, and we're in an environment where it's truly "always DNS") and land naturally on any thread about DNS here. This particular thread isn't about Handshake; it's about setting up an alternate root hierarchy with standard DNS. Regardless of that fact: the guidelines demand that we not make insinuations about other commenters here, and this is the second weird interaction we've had in a row where you've done that. Please stop. My understanding is that you're a strong supporter of Handshake. I think Handshake is a crock. It is fine for us to disagree. But you will disagree with me civilly.
    - rasengan 5y ago
      > essentially, the Handshake founders decided to sell the Brooklyn Bridge, which is something that blockchains make feasible. > the guidelines demand that we not make insinuations about other commenters here, and this is the second weird interaction we've had in a row where you've done that. Please stop. Not that two wrongs make a right (nor did I state anything that isn't provable), but the insinuations started with your comment (including from previous comments) which was more than an insinuation but actually borderline slanderous (claiming fraudulent activity including stating things were sold that weren't owned, etc.). I also hope that you too will follow the same guidelines that we all strive to follow. > I think Handshake is a crock. It is fine for us to disagree. But you will disagree with me civilly. What about that comment is civil? What about your previous slanderous comments are civil? Finally, what about my factual statements aren't civil? I really hope 2022 is a better year for you.
      - tptacek 5y ago
        The guidelines require us to be civil to each other. They do not require me to generous or to assume good faith of Handshake. I believe Handshake is a crock, you do not. I'm not impugning you (as you did me); you are not Handshake, or, as far as I know, any of its founders. It is fine for us to disagree. I have the better of the two arguments and am very comfortable leaving it there.
        rasengan 5y ago
        Where was I impugning you? Can you point to the specific text/example? I'm genuinely curious and wish to have a better understanding of how you are interpreting and seeing things as I've asked the opinion of others and none seem to agree with you. Despite what you claim in your slander, what [1] I [2] said [3] is [4] backed [5] by [6] fact [7]. [1] https://news.ycombinator.com/item?id=24241737 https://news.ycombinator.com/item?id=24241737 [2] https://news.ycombinator.com/item?id=22908576 https://news.ycombinator.com/item?id=22908576 [3] https://news.ycombinator.com/item?id=23350441 https://news.ycombinator.com/item?id=23350441 [4] https://news.ycombinator.com/item?id=29929657 https://news.ycombinator.com/item?id=29929657 [5] https://news.ycombinator.com/item?id=22900567 https://news.ycombinator.com/item?id=22900567 [6] https://news.ycombinator.com/item?id=22900986 https://news.ycombinator.com/item?id=22900986 [7] Your comments serve as the facts.
DenseComet 5y ago
You can't really count Opera as "significant". Handshake domains are only accessible by a tiny percent of people, make stuff like HTTPS very difficult[1], and no matter how devices eventually use Handshake, you'll always need to have a domain on a normal TLD because there will always be devices (like TVs and old phones) that will not support it. And what benefit do you get anyways? A custom TLD? There's already so many new TLDs but most domains are on gTLDs or ccTLDs because thats what people recognize. Even Google and Apple barely use theirs. Ownership? Not really. Handshake only manages TLDs. Buying a subdomain (like you can on Namecheap) doesn't happen on the blockchain, the owner of the TLD can take it away anytime. Say what you want to say about ICANN, but they do have rules (such as contingency plans) that new TLD owners have to follow. In what world is buying a handshake subdomain from an unknown person beholden to nobody better in any way? [1] https://www.namecheap.com/support/knowledgebase/article.aspx/10484/2278/namecheap-handshake-tlds/ https://www.namecheap.com/support/knowledgebase/article.aspx...
- rasengan 5y ago
  > You can't really count Opera as "significant". 380m+ users seems significant to me. > Handshake domains are only accessible by a tiny percent of people Actually, NextDNS which is a Firefox resolver also supports Handshake, so I imagine it's not a tiny percent of people. > make stuff like HTTPS very difficult Additionally, HTTPS is completed by Handshake since it removes the need for a "trusted certificate authority" which, as many articles have mentioned as of late, is not so trusted [1][2]. > you'll always need to have a domain on a normal TLD because there will always be devices (like TVs and old phones) that will not support it. TVs and old phones can support handshake since it's just regular DNS protocol. > And what benefit do you get anyways? You will cryptographically own your own name. > A custom TLD? A name all-inclusive. Hard stop. > There's already so many new TLDs but most domains are on gTLDs or ccTLDs because thats what people recognize. I've been around for a long time -- the internet has evolved and continues to evolve. People change quickly. > Ownership? Not really. Handshake only manages TLDs. Cryptographically owning things is likely a more constant ownership than a 'binding ownership' by a legal contract in some jurisdiction. Some of the statements you made about subdomains may or may not be true, but it's not any worse than today and likely better since there will be more options of TLD owners to choose from should one choose to purchase a TLD. [1] https://github.com/imperviousinc/beacon-ios https://github.com/imperviousinc/beacon-ios [2] https://blog.mozilla.org/security/2021/12/09/improved-quality-of-intermediate-certificates-with-enhanced-oversight-and-automation/ https://blog.mozilla.org/security/2021/12/09/improved-qualit...

1vuio0pswjnm7 5y ago

From what I have seen the existing/proposed implementations suffer from the same problems that ICANN DNS has had, namely, artificial scarcity, vanity names, "gold rush/land grab" and commercialisation schemes. The ideal system, IMO, would be one where anyone can get a name, no one can "hoard" names, and all names are of equal value. As such, the profit motive, and thereby the impetus for corruption, is removed. I have created such DNS at home, I run an "alternate root" on the loopback. It's ideal for me.

Tijdreiziger 5y ago
> The ideal system, IMO, would be one where anyone can get a name, no one can "hoard" names, and all names are of equal value. I’m immediately reminded of Tor .onion names, though those aren’t exactly user-friendly…
- egberts1 5y ago
  Neither are telephone numbers … being exactly a user-friendly thingie but there we go.
  - Tijdreiziger 5y ago
    Vastly more user-friendly than .onion names, I'd say :P
    - egberts1 5y ago
      Only by the virtue of being a less combinatorial options of the few, 10 to 15 digit telephone number that is.
  - aflag 5y ago
    That's why people have phone books and contact lists.
  - technothrasher 5y ago
    Phone numbers are the IP addresses. Your contact list (or the yellow/white pages in days long past) is the DNS server for them.

tptacek 5y ago

How would you actually accomplish a DNS blockchain? To run DNS-style Internet naming on a blockchain, you have to take control of the DNS roots. The DNS roots are community property. Unless ICANN came up with some process for starting a blockchain-based DNS, any new blockchain-based DNS would essentially be seizing community property by fiat. Nobody is going to let any private organization do that.

easrng 5y ago
Nope, sane projects would have 1 TLD they have names under and clients opt-in to resolution. Handshake is awful because it pretends it has the right to control the root and adds TLDs in such a way that there's no way to tell if a given domain needs to be resolved with handshake. Also it allows for numerical names which could collide with IPs. Don't use Handshake. ENS is also bad (no SPV, you usually end up relying on Infura), "Unstoppable" domains has all the problems of ENS, plus too many TLDs, and names can only be registered through the official servers. NameCoin might be ok, haven't looked into it too much. EmerCoin promises too much which makes me suspicious. (Like blockchain VoIP? What?) If I missed any, please let me know.
- WanderPanda 5y ago
  ENS is not necessarily relying on Infura, I could imagine resolution being run by your ISP like it is common with DNS.
  - easrng 5y ago
    Because ISPs do such a great job with DNS now...
- southerntofu 5y ago
  Sounds pretty much like the GNU Name System. With what they call a hyper hyper local root, you as a client define your own TLDs in addition to the root your system has configured (the system is intended to replace the existing ICANN root in a backwards-compatible manner). Delegation happens via public key and records are resolved through a DHT. The idea is you could add your friend/org's key to your root, and from there you could resolve recursively using your friend/org's zone. Pretty neat stuff, at least on paper.

lowwave 5y ago

handshake.org

xorcist 5y ago

As per usual, it depends very much on what you consider a blockchain. Is Certificate Transparency a blockchain? It's a Merkle tree, without any tokens involved. What would something like AlterNIC have looked like if it was backed by a blockchain? Would it have had easier acceptance, or more reliability?

tptacek 5y ago
No, AlterNIC would have failed regardless of the underlying technology. Its founder became a pariah. It's similar in a lot of ways to Handshake; just imagine that Handshake gets tired of nobody but Opera resolving its names, and then it hacks ICANN, and you've got pretty much a replay of that situation. It's worth comparing 1997 to 2022 to see why attempts to seize the Internet roots are unlikely to go anywhere. It's similar in a bunch of ways to the WebPKI. For all its faults, AlterNIC had a better case against Network Solutions than anyone has against ICANN: Internet governance at the time prohibited new TLDs, and registrars were rapacious. But over the next 10 years, that mostly changed, just like the WebPKI has been drastically cleaned up after abuses in the 2000s. People continually propose replacements for the WebPKI today that seem premised on a CA system that works like it did in 2005. But we don't have the 2005 WebPKI; we have 2022's. (I was doing DNS security work at the time Kashpureff cache poisoned internic.net, and it was a pretty formative experience for me, if people wonder why I'm so shocked that anyone would take Handshake seriously).
- rasengan 5y ago
  Comparing Eugene's exploit to a decentralized root owned by the commons that complements ICANN's system is confusing to me. I can understand how his exploit could be a formative experience for you, what I can't understand is how that experience relates to Handshake. What you're saying is like, "imagine if a security researcher decided he was tired of getting paid much less than he deserves and decides to hack a bank," and then using this imagined experience as a "logical" reason to hold disdain for something. You're welcome to your opinion, but please stop trying to paint a false picture about Handshake specifically unless you're using actual facts that are real life and not imagined.