28 ms·

The GNU Name System

307 points by simonpure 5y ago

skybrian 5y ago
I was wondering which names are currently available. Apparently there is a first-come, first serve domain ending in ".pin" but the server is down. "Bad gateway." So it seems like more of a software project than a running service at this point?
- capableweb 5y ago
  What server are you getting a 502 from? It's supposedly a decentralized naming system, so running a node/client yourself should be enough to get started, otherwise I don't see how they can call it decentralized. But I'm not finding any links to any source code from this specification, which is to be expected, but my searches are not helping me either.
  - skybrian 5y ago
    Start [here](https://www.gnunet.org/en/index.html https://www.gnunet.org/en/index.html). The release notes for 0.15.0 talk about about the "First-come-first-served GNUnet top-level domain ".pin" zone key."
deleted 5y ago
[deleted]
jll29 5y ago
...best used with GTML over GTTP! ;) But joking aside, it's good to have a censor-resistant resolution protocol. This is a more radical idea than the EU's recent proposal to have parallel name servers that obey Europe's GDPR rules. Still, a lot of power is given to those that control the cables and satellites, and of course the electricity that powers the Internet's hardware. The commercialisation of the Internet has led to more centralization since the 2000s. A true state of freedom and safety from repression, censorship and dictatorships can perhaps be only achieved with more ad-hoc mesh networks.
- discardedrefuse 5y ago
  > A true state of freedom and safety from repression, censorship and dictatorships can perhaps be only achieved with more ad-hoc mesh networks. I've recently started playing with mesh networks. Yggdrasil is excellent. They haven't solved naming, they're focused on mesh routing with e2e encryption. There's a public network. It's very experimental. But it works and its just so cool! Also worth mentioning is Nebula (made by the Slack devs). Nebula is great for building private mesh networks. Its a very exciting space right now! I'm hopeful; an open internet is possible.
- immibis 5y ago
  Give Google 30 years of Chrome monopoly, and we will see GTML. It already uses GTTP.
  - sreevisakh 5y ago
    You could argue that HTML is GTML already. Their is practically no one else deciding how it evolves.
  - jackshaw 5y ago
    I like GTML and GTTP. We only need to make sure that the G stands for GNU.
AlternateData 5y ago
Gonna name my future kids in accordance to the GNU name system!
- Bilal_io 5y ago
  GNUSON
- oever 5y ago
  A boy named GNU!
- einpoklum 5y ago
  Gnunior.
guerrilla 5y ago
So what does an example name look like?
- nerdponx 5y ago
  > A name in GNS is a domain name as defined in [RFC8499] as an ordered list of labels. The labels in a name are separated using the character "." (dot). Names, like labels, are encoded in UTF-8.
  - jesprenj 5y ago
    > UTF-8 Yes! Finally a protocol that does not discriminate against non-ASCII languages (like punycode does in my opinion). Hello, my name is xn--jeprenj-rqb! </rant> (:
    - spullara 5y ago
      They would likely still be displayed like that so people don't get tricked with look-a-like characters from other languages.
      - Arnavion 5y ago
        It's possible to be smarter than that. I believe Chrome doesn't drop down to punycode if it sees the string is entirely within a single language so that there is no possibility of look-alike characters. It might even be checking explicitly for the presence of look-alike character pairs, since they're known ahead of time.
      - teddyh 5y ago
        “People whose names break my system are weird outliers. They should have had solid, acceptable names, like 田中太郎.” — Falsehoods Programmers Believe About Names https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...
        5y ago
encryptluks2 5y ago
I really like the idea of a pinning service for domains that uses provider lists, where you can subscribe to ICANN and root name servers but then override or add your own domains and TLDs.
- 0xbadcafebee 5y ago
  Is that different than just running your own nameserver and root? Or could you do what you describe with dnsmasq?
  - southerntofu 5y ago
    It's different because it's not subject to IP spoofing, and does not require to run specific infra to setup a zone. Your zones live in the DHT not on a nameserver of yours, so even your less-technical friends given the right software UX could publish their favorite domain names in their zones for them to be forever resolvable, or as shortcuts. Like maybe there's this super cool blog about guitars my friend akhmad follows but i can't remember the URL right now and of course Google is giving me the worst SEO-induced results. But i know my friend akhmad published it as "guitar" in his zone because he also forgets the name every now and then, so now i can just go to "guitar.akhmad" in my browser (assuming i already have akhmad in my hyper-hyper local root). Yes this does have some consequences for some things such as TLS validation, but if you want we could get into the details of why that's OK (TLDR: CAs are only good because DNS is bad security for key distribution, DANE over GNS would be arguably more secure).
- southerntofu 5y ago
  When reading about GNS for the first time, that was really the killer feature for me. How many times have i failed to resolve domains that were either censored, seized or simply forgotten to renew?! With GNS, as long as the public key lives in my zone i'd be very confident i can resolve thepiratebay.org or wikileaks.org no matter what some government has to say about it.
KennyBlanken 5y ago
- ratsmack 5y ago
  Everything has to start somewhere.
- southerntofu 5y ago
  I didn't downvote, but let me give context for the downvotes: GNS is not a special-use TLD (like .onion/.i2p is) and it should not be something you have to setup as a user, either because your distro will set it up for you, or because your ISP will use it on their infra transparently to you (GNS is backwards-compatible with DNS protocol). It's that kind of project that either everybody will use, or nobody will. It's a serious research project (with usability studies and all) intending to replace the DNS in its entirety, solving whole classes of problems related to enumeration, amplification attacks, query privacy... If you don't trust me you should probably check out the ICANN presentation video about GNS, it's really short and instructive. Not that ICANN is advocating for GNS, but ICANN regularly holds "future identifiers" sessions during which projects can present their R&D.
- wolverine876 5y ago
  That could be, and probably has been, said about every startup. I don't know about the parent, but it has been a big trend- it's said how many people have bought into powerlessness. It's got to be killing innovation.
creeble 5y ago
See also (2016) https://news.ycombinator.com/item?id=11641626 https://news.ycombinator.com/item?id=11641626 Edit: added date
- dang 5y ago
  Thanks! Macroexpanded: The GNU Name System IETF Draft - https://news.ycombinator.com/item?id=23766947 https://news.ycombinator.com/item?id=23766947 - July 2020 (32 comments) GNU name system - https://news.ycombinator.com/item?id=11641626 https://news.ycombinator.com/item?id=11641626 - May 2016 (58 comments)
  - DonHopkins 5y ago
    Good thing you didn't try to recursively macroexpand GNU, or your post would be infinitely long!
huslage 5y ago
Replacing one centralized protocol with another (x.509) is not particularly useful.
- Arnavion 5y ago
  The only mention of X.509 on the page is a sentence saying that the protocol does not use X.509. Certainly reading it in full I did not see any usage of X.509. So I'm not sure what you're trying to say. Not to mention, X.509 is not centralized to begin with.
deleted 5y ago
[deleted]
zxcvbn4038 5y ago
Nice try but no different then any of the other attempts to unseat ICANN. This has absolutely no chance of working unless incumbents get their cut or you find some reason to have this, that is so compelling that average people will take it upon themselves to install and use it. There is endless free porn with regular DNS so you can't use that. Pirate music and video has been done to death, don't think you can use that to roll out your own DNS. If facebook wanted to have their own DNS and rolled out their software with their clients then they could probably pull it off. China will do it at some point but only for their citizens in their territories.
- southerntofu 5y ago
  Nice try but it appears you didn't even read the draft RFC or any of the related resources. GNS is not trying to unseat ICANN it's trying to modernize the technical infrastructure. The GNS project does stand for user rights by advocating for a hyper-hyper local root but that's irrelevant to ICANN/registry governance as i explained in other comments on this thread.
- drran 5y ago
  ICANN is easy to unseat: just point your computer to an alternative DNS server.
  - alvarlagerlof 5y ago
    People won't do that.
    - CamperBob2 5y ago
      My understanding is that anyone running Firefox already has, unless they went out of their way not to. Is that no longer the case?
      - quickthrower2 5y ago
        "People" means common folk, with their Edge, Chrome, Android Chrome and iOS Safari. There is the web that 'just works' and the web where you need to open up the back of the unit and start swapping wires.
hkt 5y ago
Could this be used with Tor, I wonder? GNS over TCP would make it possible and friendly names would be a welcome addition to tor.
1vuio0pswjnm7 5y ago
FYI- I have seen DJ Bernstein mention this project in the past on a mailing list. It appeared he had looked at it. I am guessing the developer Christian Grotholff is a djb fan.
- capableweb 5y ago
  It'd be a exercise in futility to implement/create something based on modern cryptography and not be a fan of djb
- schanzen 5y ago
  We did receive feedback on the concept in general and draft in particular. We reworked the crypto significantly from the initial draft, both the key blinding as well as the symmetric encryption. Notably, the crypto is now more agile (you can add new zone types if applicably cryptographic primitives emerge that allow for this particular key bliding)
a-dub 5y ago
before diving into a deep and complicated rfc, is there a short document somewhere that describes at a high level the various threat models and mitigations that the system proposes? i had a look on the website and the closest thing i could find were some videos of talks, which i don't have time to invest in... edit: these slides are a start: https://git.gnunet.org/presentations.git/plain/icann66/20191105_icann66_gns.pdf https://git.gnunet.org/presentations.git/plain/icann66/20191...
- southerntofu 5y ago
  TLDR taken from one of those slides: > Query privacy: Queries do not reveal domain name > Record confidentiality: Values in DHT are signed and encrypted by zone owner. > Zone privacy: Zones cannot be enumerated > Censorship and DDoS resistance That's the key security properties compared to DNS.
  - a-dub 5y ago
    went back and watched the video. actually only 20m and totally worth it. i'm left with a few big questions: 1) how can you have query privacy and zone privacy in the same system? seems like query privacy would open the system up to dictionary attacks at least; with a possibility that depending on how the dht is implemented, perhaps even high performance locally distributed dictionary attacks could be executed? 2) the issues of economics and property rights (as well as invested parties in the economy of name sales and registration) seem like they could collide with the technical goals with something like this gaining traction, has there been any thought given as how these political/economic concerns could be addressed?
    - schanzen 5y ago
      To 1) Yes, IF you know the zone key (which is a public key). You can perform a dictionary attack for common label values. This is discussed in the security considerations To 2) This is a governance issue. Theoretically, you could deploy GNS with an ICANN root zone. BUT, the system is designed to give users the freedom to override defaults if necessary (see the root zone section in the draft). GNS clients will likely ship with a default zone configuration. If you operate a zone and are a considered trustworthy third party, nobody can prevent you from taking coin for adding delegations to your zone or offering a platform on which you can trade the labels.
southerntofu 5y ago
Related: short video recording of an ICANN session discussing Handshake and GNS as possible replacement for DNS https://icann.zoom.us/recording/share/M8N-Duq935XheIZoBedIwmi3VqRUAe2iOPwECiTNLxKwIumekTziMw?startTime=1572978711000 https://icann.zoom.us/recording/share/M8N-Duq935XheIZoBedIwm... If you know nothing of these two protocols or the different problems they try to address, that's a good start!
- lupire 5y ago
  - esjeon 5y ago
    And there's the transcript on the right side...
  - a-dub 5y ago
    the entire session, which is a roundtable on on the future of DNS is 1h+. the section on GNS specifically is only about 20 minutes (at the very start) and the section on handshake is an additional 20 minutes. i agree though, i prefer to be able to rapidly seek and skim for interesting things, rather than commit time to videos when i'm not sure if it's something i want to invest time in. this is good material though.
- immibis 5y ago
  Handshake will suffer all the same problems as other cryptocurrency-based systems: centralized control in the hands of whoever is the most ruthless at acquiring currency. Handshake is even worse because it claims to assert control over top-level domains. Most other systems just claim one top-level domain (e.g. .bit) and assert control over that one.
  - southerntofu 5y ago
    I thought handshake was pretty cool when they handed out millions of dollars to free-software project (although that was a little fishy). But i think this video presentation does a fair job of explaining the problems (or imo non-problems) they try to solve with Handshake (auctions for names) and the actual problem GNS tries to solve (crypto-secure resolution without enumeration/amplification). Handshake is focused on fixing something that isn't broken to introduce auctions instead of first-come-first-served in the DNS world. I personally don't see any interest in that, but i also don't see much wrong, except of course my clever names are going to be outbid by people with more money :'(.
ttymck 5y ago
The HN comments are of course great, but what is the best way to follow the ongoing discussion of this proposal, it's merits/drawbacks and barriers to adoption? Is the working group's mailing list used for this purpose, or does feedback come from the public forum, i.e. This comments section, blog posts, etc.?
- schanzen 5y ago
  To be honest: I would prefer our mailing list for discussions (see top post). Our email addresses are also in the draft. A lot of discussions happen via the IETF Datatracker infrastructure and internal email discussions/meetings. We have a monthly gnunet jour fixe and we do post news entries (https://www.gnunet.org https://www.gnunet.org) We dropped our IRC channel when the freenode apocalypse happened.
rhabarba 5y ago
Ah, GNU people fighting standards again.
- immibis 5y ago
  GNU's Not Unified
chrismsimpson 5y ago
Can we please stop naming things with the GNU/G* prefix? Hasn't RMS been cancelled several times already? And this proposal looks to be BSD centric rather than GPL centric anyway.
pabs3 5y ago
Has anyone tried setting up a GNS zone with gnunet?
foxhop 5y ago
octoberfranklin 5y ago
If this is decentralized, what is its solution to Zooko's Trilemma? https://en.m.wikipedia.org/wiki/Zooko%27s_triangle https://en.m.wikipedia.org/wiki/Zooko%27s_triangle I searched around the GNS site quite a bit and couldn't find an answer. It is pretty well understood today that the main obstacle to decentralized naming is Zooko's Trilemma, much as it was well understood pre-2009 that the main obstacle to decentralized cryptocurrencies was the double-spend problem. I'm a bit surprised that "here's how we solve Zooko's Trilemma" isn't front-and center on the GNS website.
- syrrim 5y ago
  > GNS is based on the principle of a petname system That might be part of the answer
  - octoberfranklin 5y ago
    So called "pet names" like /etc/hosts span only two of the three corners of the triangle: http://www.skyhunter.com/marcs/petnames/zooko-triangle.gif http://www.skyhunter.com/marcs/petnames/zooko-triangle.gif
    - Karrot_Kream 5y ago
      GNS does not "square" Zooko's Triangle. It relies on petnames as said above, so names are purely local, like /etc/hosts. The global identifier used by each Zone is an opaque identifier, like IPFS hashes, that is not human memorable.
      - octoberfranklin 5y ago
        It sounds to me like an elaborate scheme for managing your personal collection of *.onion url bookmarks.
        Karrot_Kream 5y ago
        It's a very similar UX, but doesn't have anything to do with onion routing.
ChuckMcM 5y ago
I wish them luck. As being one of a handful of people who have designed a scalable naming system that made it into production I can tell you that there are a lot of dragons there. A good start would be to look at the work done by the IETF on DNSSEC. That said, as systems problems go, it is a really juicy one and brings a lot of understanding to all those who undertake it!
- cpach 5y ago
  Hi Chuck! May I ask what naming system you designed? Sounds interesting!
  - mzi 5y ago
    Chuck McManis developed NIS+ while he was at Sun Microsystems
    - cpach 5y ago
      Ah, cool!
schanzen 5y ago
Author here. The draft is currently in ISE review (there was not enough interest at IETF or IRTF). If you want to engage or need more info gnunet-developers@gnunet.org is a good place to start and ask questions. A lot of work has been going in over the last years to separate the protocol properly from the underlying stack (gnunet). We are currently also working on a spec for our DHT (which is a required basis for GNS). One of the reasons we specified GNS first is because of the order of fundings we receive(d). happy hacking
- southerntofu 5y ago
  Thanks for working on GNS. It's genuinely the most exciting tech project i've heard about in the past few years and i'm sure many people would like to try it out or get involved given proper communications channel. A few questions: - are you people open to the idea of an IRC/XMPP chan or a weblog/gemlog? following from afar (without being on the ML) looks like there's not a lot of activity, although i can see with my bare eyes the draft spec has evolved a lot - how confident are you in your DHT spec/implementation for scalability and security? are other people working on different implementations? is there a testbed one can run scalability checks with? - are you actively cooperating with other non-profit projects such as Tor? GNS sounds like it could be the missing piece in such crypto-secure routing schemes without memorable names ; i understand that GNS is part of GNUNet, but i'm asking about other ties/cooperations - why is it called "hyper hyper" local root? maybe i'm missing some context (despite reading about RFC7706 and froot), but "local root" or "user-editable root" sounds clearer to me - did i faithfully represent the technics/politics of GNS in those posts? if not please let me know so i can avoid to repeat the same mistakes: https://news.ycombinator.com/item?id=30155773 https://news.ycombinator.com/item?id=30155773 https://news.ycombinator.com/item?id=30156097 https://news.ycombinator.com/item?id=30156097 https://news.ycombinator.com/item?id=30156175 https://news.ycombinator.com/item?id=30156175 - how can we support GNS and help make it a reality?
  - schanzen 5y ago
    > - are you people open to the idea of an IRC/XMPP chan or a weblog/gemlog? following from afar (without being on the ML) looks like there's not a lot of activity, although i can see with my bare eyes the draft spec has evolved a lot Yes, the only reason why there are no posts on the ML and very little posts on the GNUnet news archive is that I do this in my spare time. Now, the draft is mostly(TM) finished. So I do not see a reason for blogging anymore. > how confident are you in your DHT spec/implementation for scalability and security? are other people working on different implementations? is there a testbed one can run scalability checks with? That is a good question. GNUnet is still figuring out the transport layer. Until that is in a state that we are satisfied with, we will conduct performance tests. That being said, looking at other DHT proposals out there we think that R5N (and especially the improvements we have planned) are far superior. It still has strong roots in Kademlia though. > are you actively cooperating with other non-profit projects such as Tor? GNS sounds like it could be the missing piece in such crypto-secure routing schemes without memorable names ; i understand that GNS is part of GNUNet, but i'm asking about other ties/cooperations Yes. I think there was some collaboration here: https://datatracker.ietf.org/doc/html/draft-grothoff-iesg-special-use-p2p-names-02 https://datatracker.ietf.org/doc/html/draft-grothoff-iesg-sp... But we are not in regular contact and tor seems to go their own route. There are, however, similarities: https://gitweb.torproject.org/torspec.git/tree/proposals/224-rend-spec-ng.txt#n2135 https://gitweb.torproject.org/torspec.git/tree/proposals/224... > - why is it called "hyper hyper" local root? maybe i'm missing some context (despite reading about RFC7706 and froot), but "local root" or "user-editable root" sounds clearer to me As this was confusing, it is removed from the draft. I think you can still find it on some slides when you look for it. In general, what is currently explained in the draft should be correct and there is no need to think about this too hard ;) > - did i faithfully represent the technics/politics of GNS in those posts? if not please let me know so i can avoid to repeat the same mistakes: https://news.ycombinator.com/item?id=30155773 https://news.ycombinator.com/item?id=30155773 https://news.ycombinator.com/item?id=30156097 https://news.ycombinator.com/item?id=30156097 https://news.ycombinator.com/item?id=30156175 https://news.ycombinator.com/item?id=30156175 I think so. There seems to be an understandable conflation of the technical means of name resolution (the draft) and the governance issues related to zones and names. Governance of zones (but especially root zone governance) is out of scope of the draft. But it is of major importance for any real world use. > - how can we support GNS and help make it a reality? My usual response would be: Install GNUnet and run a zone. But, we are currently in the process of fixing some major bugs in GNUnet and it is just not yet ready. As you correctly assessed, we are a very small team at the moment.
shp0ngle 5y ago
Everything under the umbrella of “gnu net” always struck me as both pie-in-the-sky redo-everything, and vaporware, at the same time. I did not look at any details, just were at some talks of its proponents (now almost 10 years ago!). But maybe some small parts will work and survive. Let’s see.
- schanzen 5y ago
  On the other hand what is the alternative? The current blockchain/dlt hype is built on top of technology that severely impacts its security promise (https://btc-hijack.ethz.ch/ https://btc-hijack.ethz.ch/). The reason why gnunet appears to be "redo-everything" is because that is exactly what is necessary if you take the issues seriously and think them through. The reason why it takes so long is also because we are a small team and the goal does not provide instant gratification while at the same time being very hard to achieve. It is a lot of systems programming and engineering. It is a lot more fun to reinvent the wheel in the newest shiny technology.
einpoklum 5y ago
Can someone provide a layman's explanation of what the Internet would look like, server-name-wise, if GNS was widely adopted?

307 points by simonpure 5y ago

I was wondering which names are currently available. Apparently there is a first-come, first serve domain ending in ".pin" but the server is down. "Bad gateway." So it seems like more of a software project than a running service at this point?

capableweb 5y ago
What server are you getting a 502 from? It's supposedly a decentralized naming system, so running a node/client yourself should be enough to get started, otherwise I don't see how they can call it decentralized. But I'm not finding any links to any source code from this specification, which is to be expected, but my searches are not helping me either.
- skybrian 5y ago
  Start [here](https://www.gnunet.org/en/index.html https://www.gnunet.org/en/index.html). The release notes for 0.15.0 talk about about the "First-come-first-served GNUnet top-level domain ".pin" zone key."

deleted 5y ago

[deleted]

jll29 5y ago

...best used with GTML over GTTP! ;) But joking aside, it's good to have a censor-resistant resolution protocol. This is a more radical idea than the EU's recent proposal to have parallel name servers that obey Europe's GDPR rules. Still, a lot of power is given to those that control the cables and satellites, and of course the electricity that powers the Internet's hardware. The commercialisation of the Internet has led to more centralization since the 2000s. A true state of freedom and safety from repression, censorship and dictatorships can perhaps be only achieved with more ad-hoc mesh networks.

discardedrefuse 5y ago
> A true state of freedom and safety from repression, censorship and dictatorships can perhaps be only achieved with more ad-hoc mesh networks. I've recently started playing with mesh networks. Yggdrasil is excellent. They haven't solved naming, they're focused on mesh routing with e2e encryption. There's a public network. It's very experimental. But it works and its just so cool! Also worth mentioning is Nebula (made by the Slack devs). Nebula is great for building private mesh networks. Its a very exciting space right now! I'm hopeful; an open internet is possible.
immibis 5y ago
Give Google 30 years of Chrome monopoly, and we will see GTML. It already uses GTTP.
- sreevisakh 5y ago
  You could argue that HTML is GTML already. Their is practically no one else deciding how it evolves.
- jackshaw 5y ago
  I like GTML and GTTP. We only need to make sure that the G stands for GNU.

AlternateData 5y ago

Gonna name my future kids in accordance to the GNU name system!

Bilal_io 5y ago
GNUSON
oever 5y ago
A boy named GNU!
einpoklum 5y ago
Gnunior.

guerrilla 5y ago

So what does an example name look like?

nerdponx 5y ago
> A name in GNS is a domain name as defined in [RFC8499] as an ordered list of labels. The labels in a name are separated using the character "." (dot). Names, like labels, are encoded in UTF-8.
- jesprenj 5y ago
  > UTF-8 Yes! Finally a protocol that does not discriminate against non-ASCII languages (like punycode does in my opinion). Hello, my name is xn--jeprenj-rqb! </rant> (:
  - spullara 5y ago
    They would likely still be displayed like that so people don't get tricked with look-a-like characters from other languages.
    - Arnavion 5y ago
      It's possible to be smarter than that. I believe Chrome doesn't drop down to punycode if it sees the string is entirely within a single language so that there is no possibility of look-alike characters. It might even be checking explicitly for the presence of look-alike character pairs, since they're known ahead of time.
    - teddyh 5y ago
      “People whose names break my system are weird outliers. They should have had solid, acceptable names, like 田中太郎.” — Falsehoods Programmers Believe About Names https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-...
      - 5y ago

encryptluks2 5y ago

I really like the idea of a pinning service for domains that uses provider lists, where you can subscribe to ICANN and root name servers but then override or add your own domains and TLDs.

0xbadcafebee 5y ago
Is that different than just running your own nameserver and root? Or could you do what you describe with dnsmasq?
- southerntofu 5y ago
  It's different because it's not subject to IP spoofing, and does not require to run specific infra to setup a zone. Your zones live in the DHT not on a nameserver of yours, so even your less-technical friends given the right software UX could publish their favorite domain names in their zones for them to be forever resolvable, or as shortcuts. Like maybe there's this super cool blog about guitars my friend akhmad follows but i can't remember the URL right now and of course Google is giving me the worst SEO-induced results. But i know my friend akhmad published it as "guitar" in his zone because he also forgets the name every now and then, so now i can just go to "guitar.akhmad" in my browser (assuming i already have akhmad in my hyper-hyper local root). Yes this does have some consequences for some things such as TLS validation, but if you want we could get into the details of why that's OK (TLDR: CAs are only good because DNS is bad security for key distribution, DANE over GNS would be arguably more secure).
southerntofu 5y ago
When reading about GNS for the first time, that was really the killer feature for me. How many times have i failed to resolve domains that were either censored, seized or simply forgotten to renew?! With GNS, as long as the public key lives in my zone i'd be very confident i can resolve thepiratebay.org or wikileaks.org no matter what some government has to say about it.

KennyBlanken 5y ago

ratsmack 5y ago
Everything has to start somewhere.
southerntofu 5y ago
I didn't downvote, but let me give context for the downvotes: GNS is not a special-use TLD (like .onion/.i2p is) and it should not be something you have to setup as a user, either because your distro will set it up for you, or because your ISP will use it on their infra transparently to you (GNS is backwards-compatible with DNS protocol). It's that kind of project that either everybody will use, or nobody will. It's a serious research project (with usability studies and all) intending to replace the DNS in its entirety, solving whole classes of problems related to enumeration, amplification attacks, query privacy... If you don't trust me you should probably check out the ICANN presentation video about GNS, it's really short and instructive. Not that ICANN is advocating for GNS, but ICANN regularly holds "future identifiers" sessions during which projects can present their R&D.
wolverine876 5y ago
That could be, and probably has been, said about every startup. I don't know about the parent, but it has been a big trend- it's said how many people have bought into powerlessness. It's got to be killing innovation.

creeble 5y ago

See also (2016) https://news.ycombinator.com/item?id=11641626 https://news.ycombinator.com/item?id=11641626 Edit: added date

dang 5y ago
Thanks! Macroexpanded: The GNU Name System IETF Draft - https://news.ycombinator.com/item?id=23766947 https://news.ycombinator.com/item?id=23766947 - July 2020 (32 comments) GNU name system - https://news.ycombinator.com/item?id=11641626 https://news.ycombinator.com/item?id=11641626 - May 2016 (58 comments)
- DonHopkins 5y ago
  Good thing you didn't try to recursively macroexpand GNU, or your post would be infinitely long!

huslage 5y ago

Replacing one centralized protocol with another (x.509) is not particularly useful.

Arnavion 5y ago
The only mention of X.509 on the page is a sentence saying that the protocol does not use X.509. Certainly reading it in full I did not see any usage of X.509. So I'm not sure what you're trying to say. Not to mention, X.509 is not centralized to begin with.

deleted 5y ago

[deleted]

zxcvbn4038 5y ago

Nice try but no different then any of the other attempts to unseat ICANN. This has absolutely no chance of working unless incumbents get their cut or you find some reason to have this, that is so compelling that average people will take it upon themselves to install and use it. There is endless free porn with regular DNS so you can't use that. Pirate music and video has been done to death, don't think you can use that to roll out your own DNS. If facebook wanted to have their own DNS and rolled out their software with their clients then they could probably pull it off. China will do it at some point but only for their citizens in their territories.

southerntofu 5y ago
Nice try but it appears you didn't even read the draft RFC or any of the related resources. GNS is not trying to unseat ICANN it's trying to modernize the technical infrastructure. The GNS project does stand for user rights by advocating for a hyper-hyper local root but that's irrelevant to ICANN/registry governance as i explained in other comments on this thread.
drran 5y ago
ICANN is easy to unseat: just point your computer to an alternative DNS server.
- alvarlagerlof 5y ago
  People won't do that.
  - CamperBob2 5y ago
    My understanding is that anyone running Firefox already has, unless they went out of their way not to. Is that no longer the case?
    - quickthrower2 5y ago
      "People" means common folk, with their Edge, Chrome, Android Chrome and iOS Safari. There is the web that 'just works' and the web where you need to open up the back of the unit and start swapping wires.

hkt 5y ago

Could this be used with Tor, I wonder? GNS over TCP would make it possible and friendly names would be a welcome addition to tor.

1vuio0pswjnm7 5y ago

FYI- I have seen DJ Bernstein mention this project in the past on a mailing list. It appeared he had looked at it. I am guessing the developer Christian Grotholff is a djb fan.

capableweb 5y ago
It'd be a exercise in futility to implement/create something based on modern cryptography and not be a fan of djb
schanzen 5y ago
We did receive feedback on the concept in general and draft in particular. We reworked the crypto significantly from the initial draft, both the key blinding as well as the symmetric encryption. Notably, the crypto is now more agile (you can add new zone types if applicably cryptographic primitives emerge that allow for this particular key bliding)

a-dub 5y ago

before diving into a deep and complicated rfc, is there a short document somewhere that describes at a high level the various threat models and mitigations that the system proposes? i had a look on the website and the closest thing i could find were some videos of talks, which i don't have time to invest in... edit: these slides are a start: https://git.gnunet.org/presentations.git/plain/icann66/20191105_icann66_gns.pdf https://git.gnunet.org/presentations.git/plain/icann66/20191...

southerntofu 5y ago
TLDR taken from one of those slides: > Query privacy: Queries do not reveal domain name > Record confidentiality: Values in DHT are signed and encrypted by zone owner. > Zone privacy: Zones cannot be enumerated > Censorship and DDoS resistance That's the key security properties compared to DNS.
- a-dub 5y ago
  went back and watched the video. actually only 20m and totally worth it. i'm left with a few big questions: 1) how can you have query privacy and zone privacy in the same system? seems like query privacy would open the system up to dictionary attacks at least; with a possibility that depending on how the dht is implemented, perhaps even high performance locally distributed dictionary attacks could be executed? 2) the issues of economics and property rights (as well as invested parties in the economy of name sales and registration) seem like they could collide with the technical goals with something like this gaining traction, has there been any thought given as how these political/economic concerns could be addressed?
  - schanzen 5y ago
    To 1) Yes, IF you know the zone key (which is a public key). You can perform a dictionary attack for common label values. This is discussed in the security considerations To 2) This is a governance issue. Theoretically, you could deploy GNS with an ICANN root zone. BUT, the system is designed to give users the freedom to override defaults if necessary (see the root zone section in the draft). GNS clients will likely ship with a default zone configuration. If you operate a zone and are a considered trustworthy third party, nobody can prevent you from taking coin for adding delegations to your zone or offering a platform on which you can trade the labels.

southerntofu 5y ago

Related: short video recording of an ICANN session discussing Handshake and GNS as possible replacement for DNS https://icann.zoom.us/recording/share/M8N-Duq935XheIZoBedIwmi3VqRUAe2iOPwECiTNLxKwIumekTziMw?startTime=1572978711000 https://icann.zoom.us/recording/share/M8N-Duq935XheIZoBedIwm... If you know nothing of these two protocols or the different problems they try to address, that's a good start!

lupire 5y ago
- esjeon 5y ago
  And there's the transcript on the right side...
- a-dub 5y ago
  the entire session, which is a roundtable on on the future of DNS is 1h+. the section on GNS specifically is only about 20 minutes (at the very start) and the section on handshake is an additional 20 minutes. i agree though, i prefer to be able to rapidly seek and skim for interesting things, rather than commit time to videos when i'm not sure if it's something i want to invest time in. this is good material though.
immibis 5y ago
Handshake will suffer all the same problems as other cryptocurrency-based systems: centralized control in the hands of whoever is the most ruthless at acquiring currency. Handshake is even worse because it claims to assert control over top-level domains. Most other systems just claim one top-level domain (e.g. .bit) and assert control over that one.
- southerntofu 5y ago
  I thought handshake was pretty cool when they handed out millions of dollars to free-software project (although that was a little fishy). But i think this video presentation does a fair job of explaining the problems (or imo non-problems) they try to solve with Handshake (auctions for names) and the actual problem GNS tries to solve (crypto-secure resolution without enumeration/amplification). Handshake is focused on fixing something that isn't broken to introduce auctions instead of first-come-first-served in the DNS world. I personally don't see any interest in that, but i also don't see much wrong, except of course my clever names are going to be outbid by people with more money :'(.

ttymck 5y ago

The HN comments are of course great, but what is the best way to follow the ongoing discussion of this proposal, it's merits/drawbacks and barriers to adoption? Is the working group's mailing list used for this purpose, or does feedback come from the public forum, i.e. This comments section, blog posts, etc.?

schanzen 5y ago
To be honest: I would prefer our mailing list for discussions (see top post). Our email addresses are also in the draft. A lot of discussions happen via the IETF Datatracker infrastructure and internal email discussions/meetings. We have a monthly gnunet jour fixe and we do post news entries (https://www.gnunet.org https://www.gnunet.org) We dropped our IRC channel when the freenode apocalypse happened.

rhabarba 5y ago

Ah, GNU people fighting standards again.

immibis 5y ago
GNU's Not Unified

chrismsimpson 5y ago

Can we please stop naming things with the GNU/G* prefix? Hasn't RMS been cancelled several times already? And this proposal looks to be BSD centric rather than GPL centric anyway.

pabs3 5y ago

Has anyone tried setting up a GNS zone with gnunet?

foxhop 5y ago

octoberfranklin 5y ago

If this is decentralized, what is its solution to Zooko's Trilemma? https://en.m.wikipedia.org/wiki/Zooko%27s_triangle https://en.m.wikipedia.org/wiki/Zooko%27s_triangle I searched around the GNS site quite a bit and couldn't find an answer. It is pretty well understood today that the main obstacle to decentralized naming is Zooko's Trilemma, much as it was well understood pre-2009 that the main obstacle to decentralized cryptocurrencies was the double-spend problem. I'm a bit surprised that "here's how we solve Zooko's Trilemma" isn't front-and center on the GNS website.

syrrim 5y ago
> GNS is based on the principle of a petname system That might be part of the answer
- octoberfranklin 5y ago
  So called "pet names" like /etc/hosts span only two of the three corners of the triangle: http://www.skyhunter.com/marcs/petnames/zooko-triangle.gif http://www.skyhunter.com/marcs/petnames/zooko-triangle.gif
  - Karrot_Kream 5y ago
    GNS does not "square" Zooko's Triangle. It relies on petnames as said above, so names are purely local, like /etc/hosts. The global identifier used by each Zone is an opaque identifier, like IPFS hashes, that is not human memorable.
    - octoberfranklin 5y ago
      It sounds to me like an elaborate scheme for managing your personal collection of *.onion url bookmarks.
      - Karrot_Kream 5y ago
        It's a very similar UX, but doesn't have anything to do with onion routing.

ChuckMcM 5y ago

I wish them luck. As being one of a handful of people who have designed a scalable naming system that made it into production I can tell you that there are a lot of dragons there. A good start would be to look at the work done by the IETF on DNSSEC. That said, as systems problems go, it is a really juicy one and brings a lot of understanding to all those who undertake it!

cpach 5y ago
Hi Chuck! May I ask what naming system you designed? Sounds interesting!
- mzi 5y ago
  Chuck McManis developed NIS+ while he was at Sun Microsystems
  - cpach 5y ago
    Ah, cool!

schanzen 5y ago

Author here. The draft is currently in ISE review (there was not enough interest at IETF or IRTF). If you want to engage or need more info gnunet-developers@gnunet.org is a good place to start and ask questions. A lot of work has been going in over the last years to separate the protocol properly from the underlying stack (gnunet). We are currently also working on a spec for our DHT (which is a required basis for GNS). One of the reasons we specified GNS first is because of the order of fundings we receive(d). happy hacking

southerntofu 5y ago
Thanks for working on GNS. It's genuinely the most exciting tech project i've heard about in the past few years and i'm sure many people would like to try it out or get involved given proper communications channel. A few questions: - are you people open to the idea of an IRC/XMPP chan or a weblog/gemlog? following from afar (without being on the ML) looks like there's not a lot of activity, although i can see with my bare eyes the draft spec has evolved a lot - how confident are you in your DHT spec/implementation for scalability and security? are other people working on different implementations? is there a testbed one can run scalability checks with? - are you actively cooperating with other non-profit projects such as Tor? GNS sounds like it could be the missing piece in such crypto-secure routing schemes without memorable names ; i understand that GNS is part of GNUNet, but i'm asking about other ties/cooperations - why is it called "hyper hyper" local root? maybe i'm missing some context (despite reading about RFC7706 and froot), but "local root" or "user-editable root" sounds clearer to me - did i faithfully represent the technics/politics of GNS in those posts? if not please let me know so i can avoid to repeat the same mistakes: https://news.ycombinator.com/item?id=30155773 https://news.ycombinator.com/item?id=30155773 https://news.ycombinator.com/item?id=30156097 https://news.ycombinator.com/item?id=30156097 https://news.ycombinator.com/item?id=30156175 https://news.ycombinator.com/item?id=30156175 - how can we support GNS and help make it a reality?
- schanzen 5y ago
  > - are you people open to the idea of an IRC/XMPP chan or a weblog/gemlog? following from afar (without being on the ML) looks like there's not a lot of activity, although i can see with my bare eyes the draft spec has evolved a lot Yes, the only reason why there are no posts on the ML and very little posts on the GNUnet news archive is that I do this in my spare time. Now, the draft is mostly(TM) finished. So I do not see a reason for blogging anymore. > how confident are you in your DHT spec/implementation for scalability and security? are other people working on different implementations? is there a testbed one can run scalability checks with? That is a good question. GNUnet is still figuring out the transport layer. Until that is in a state that we are satisfied with, we will conduct performance tests. That being said, looking at other DHT proposals out there we think that R5N (and especially the improvements we have planned) are far superior. It still has strong roots in Kademlia though. > are you actively cooperating with other non-profit projects such as Tor? GNS sounds like it could be the missing piece in such crypto-secure routing schemes without memorable names ; i understand that GNS is part of GNUNet, but i'm asking about other ties/cooperations Yes. I think there was some collaboration here: https://datatracker.ietf.org/doc/html/draft-grothoff-iesg-special-use-p2p-names-02 https://datatracker.ietf.org/doc/html/draft-grothoff-iesg-sp... But we are not in regular contact and tor seems to go their own route. There are, however, similarities: https://gitweb.torproject.org/torspec.git/tree/proposals/224-rend-spec-ng.txt#n2135 https://gitweb.torproject.org/torspec.git/tree/proposals/224... > - why is it called "hyper hyper" local root? maybe i'm missing some context (despite reading about RFC7706 and froot), but "local root" or "user-editable root" sounds clearer to me As this was confusing, it is removed from the draft. I think you can still find it on some slides when you look for it. In general, what is currently explained in the draft should be correct and there is no need to think about this too hard ;) > - did i faithfully represent the technics/politics of GNS in those posts? if not please let me know so i can avoid to repeat the same mistakes: https://news.ycombinator.com/item?id=30155773 https://news.ycombinator.com/item?id=30155773 https://news.ycombinator.com/item?id=30156097 https://news.ycombinator.com/item?id=30156097 https://news.ycombinator.com/item?id=30156175 https://news.ycombinator.com/item?id=30156175 I think so. There seems to be an understandable conflation of the technical means of name resolution (the draft) and the governance issues related to zones and names. Governance of zones (but especially root zone governance) is out of scope of the draft. But it is of major importance for any real world use. > - how can we support GNS and help make it a reality? My usual response would be: Install GNUnet and run a zone. But, we are currently in the process of fixing some major bugs in GNUnet and it is just not yet ready. As you correctly assessed, we are a very small team at the moment.

shp0ngle 5y ago

Everything under the umbrella of “gnu net” always struck me as both pie-in-the-sky redo-everything, and vaporware, at the same time. I did not look at any details, just were at some talks of its proponents (now almost 10 years ago!). But maybe some small parts will work and survive. Let’s see.

schanzen 5y ago
On the other hand what is the alternative? The current blockchain/dlt hype is built on top of technology that severely impacts its security promise (https://btc-hijack.ethz.ch/ https://btc-hijack.ethz.ch/). The reason why gnunet appears to be "redo-everything" is because that is exactly what is necessary if you take the issues seriously and think them through. The reason why it takes so long is also because we are a small team and the goal does not provide instant gratification while at the same time being very hard to achieve. It is a lot of systems programming and engineering. It is a lot more fun to reinvent the wheel in the newest shiny technology.

einpoklum 5y ago

Can someone provide a layman's explanation of what the Internet would look like, server-name-wise, if GNS was widely adopted?