14 ms·

The GNU Name System

330 points by p4bl0 4y ago

prognu 4y ago
RFC-style spec is at https://lsd.gnunet.org/lsd0001/ https://lsd.gnunet.org/lsd0001/
- hericium 4y ago
  Just came here with the same link in my clipboard and a question: What would be the reason for using "lsd" instead of popular IETF RFCs? The fact that RFC is supposed to open a dialogue/discussion and "lsd" is something final? (edit: it isn't; it's a IETF-style Internet-Draft). Other LSDs on that site link to RFCs. And, um, second question: what does "lsd" stand for in this case?
  - forgotpwd16 4y ago
    >What would be the reason for using "lsd" instead of popular IETF RFCs? Maybe due to the following? >This specification was developed outside the IETF and does not have IETF consensus.
    - capableweb 4y ago
      Most RFCs start without consensus as well, that's why they are Request For Comments, to reconcile about the idea/specification
    - schanzen 4y ago
      This sentence is usually added for specifications which are submitted independently to the Independent Stream Editor, as opposed to drafts which are discussed in a WG at IETF.
  - junon 4y ago
    I can't find much on what "LSD" means here. The root of the subdomain has no index, just a file listing.
  - schanzen 4y ago
    It stands for "Living Standards Document": https://www.gnunet.org/en/livingstandards.html https://www.gnunet.org/en/livingstandards.html
- schanzen 4y ago
  It is also currently in the "final" phases of a RFC publication (Indepdendent Stream, Informational): https://datatracker.ietf.org/doc/draft-schanzen-gns/ https://datatracker.ietf.org/doc/draft-schanzen-gns/
blippage 4y ago
Seems interesting. I've long held the view that DNS is no longer fit for purpose. It made sense back in the day, but what is the real point of TLDs these days? It means many folk have to register their name multiple times and there's problems with domain-name squatting. It's just a money-making ploy now.
- Avamander 4y ago
  It actually takes quite a bit of work to operate a registrar. In addition to the technical side, which there is plenty of, there's the human aspect. Imagine the amount of trademark disputes and abuse .com/Verisign has to deal with. Trademark or local law can rarely be automated.
  - cowtools 4y ago
    I have no doubt that there is hard work running a registrar, but it is ultimately just meaningless bureaucracy if the system it is servicing (DNS) is not actually useful to society at large. It is in essence, a "Bullshit Job"[0]: >[...] 3. duct tapers, who temporarily fix problems that could be fixed permanently, e.g., programmers repairing bloated code, airline desk staff who calm passengers whose bags do not arrive [...] [0] https://en.wikipedia.org/wiki/Bullshit_Jobs https://en.wikipedia.org/wiki/Bullshit_Jobs In any case I can only assume it is pretty profitable because I pay them several dollars a month to basically manage a single entry in a database and manage some paperwork. And considering that major businesses will pay big $$$ for (several!) domains...
    - eddieroger 4y ago
      It doesn't seem like bullshit to me to make sure that people claiming to be someone are actually them, and others who claim otherwise are not. With the anonymity the Internet brings, I find comfort in knowing that the URL I type in my browser is actually the endpoint I wish to receive. If that takes humans to deal with, so be it.
      - cowtools 4y ago
kelthuzad 4y ago
> How can a legitimate domain owner tell other people to not use his name in GNS? > A: Names have no owners in GNS, so there cannot be a "legitimate" domain owner. Any user can claim any name (as his preferred name or "pseudonym") in his NICK record. Similarly, all other users can choose to ignore this preference and use a name of their choice (or even assign no name) for this user. This is confusing me. How is it not a problem that randoms can just claim other people's domains?
- gertrunde 4y ago
  From the doc, it appears that the name isn't the name. ;) There is a global name, which is a long non-human readable unique identifier. And there is a nickname, which is only really locally significant, although the zone can publish a preferred name, the local side doesn't have to respect it.
  - hsn915 4y ago
    The whole point of DNS is for a human readable name to be globally recognized.
    - notRobot 4y ago
      Yes, that is the point of DNS, but that is not the point of GNS.
    - hansword 4y ago
      Think about how the hosts.txt file was originally used before the DNS. It's closer to that (with a lot of extra sophistication and 40+ year learning)
    - p4bl0 4y ago
      I have configured my browser to go to news.ycombinator.com when I type "hn" in its URL bar. The domain name could be anything even a b32 hash I wouldn't mind, I would still just type "hn". Granted, most people do not bother using this feature, but it is also true that most non-technical people don't even bother with typing a URL, they use a search engine as a proxy anyway. In fact it would be a good idea, ecologically, to have a system that educate its users to give their own nickname to website they visit often and use them rather than performing a search query. Especially if it is as simple as clicking a "bookmark as 'xxxxx'" with xxxxx being the default name of the service/website in your browser, with a TOFU principle :).
foxhop 4y ago
I tried to use the gns system last year & got stuck, I blogged my progress here https://russell.ballestrini.net/gnunet-gns-nameserver-operator-notes-quickstart-cheatsheet/ https://russell.ballestrini.net/gnunet-gns-nameserver-operat...
- prognu 4y ago
  To answer the last question in your blog post: gnunet-config --diagnostics tells you where the configuration file(s) are.
silvestrov 4y ago
Seems like "X Window" system: the right solution to the wrong problem. 1) Non-problem: censorship. You can register domains in many different countries. Companies have no problem registering their domain. 2) Real problem: domain squatters. Can't see GNS solves this. 3) Real problem: sometimes people need to type (or verify) domain names. If there is no global ownership of "google.com", how do I know I'm at the right site and not a phishing site? 4) Real problem: DNS records are very limited in what they can contain (so TXT is abused for many things). GNS does not improve on this and is still a binary protocol, adding more complexity. 5) Privacy is already solved using "DNS over https". No need for reinventing the wheel completely. 6) Non problem: DNS is centralized. DNS is working very reliable and the central structure makes it easy to figure out why stuff does not work. A decentralized network is a nightmare for "why does DNS resolver fail".
- ruuda 4y ago
  1) is a much smaller problem than 2) indeed, but it does still happen. 5) This hides your queries from middle boxes, but your DNS server can still see the domains you are looking up. (There are some proposals to address this that involve a proxy who can't decrypt your request, so the DNS server can't see who sent the query.)
- hericium 4y ago
  > 5) Privacy is already solved using "DNS over https". Both yes and no. It shields the user from ISP's DNS-based invigilation but at the same time it hides application requests from the user, renders user's own DNS-based filtering (pihole and such) useless and can just transfer spying ability from local ISP to big corp. Probably an unpopular opinion but personally, I don't consider DoH as an upgrade but a deprivation of user's control. I see its theoretical benefits for less technical users who haven't heard of pihole or even problems that it solves. Just theoretical, because what benefits the user is often in opposition to what benefits the corporation.
  - piaste 4y ago
    I imagine the GNU answer would be that you shouldn't run hostile / nonfree software on your machines, and you should simply be able to tell your software not to contact undesired servers (via configuration or, worst case scenario, recompilation). Having recently fully de-Big-Teched all my devices, I have the luxury of agreeing with that philosophy. As a slightly less harsh compromise, even if you run hostile apps you should be able to install a personal root certificate on your devices and MITM their traffic. Still, I imagine most IoT devices don't give you any way to do so, so you should avoid them or keep them disconnected from the wider Internet if they're still useful otherwise. Either way, the pihole corner case is not a very good argument against DoH, which is far more often a security improvement. A better argument is the big corp one, since DoH indirectly boosts their power (because a self-hosted site becomes less anonymous than one hosted on a shared AWS IP).
Anunayj 4y ago
I looked into GNS a little while ago and what I understood about how it works is: 1. I runs on top of GNUnet, which is a huge DHT that can be used for any purpose you like. 2. So GNS aims to replace DNS with a newer "modern" protocol, it is not a alternative root zone (like Handshake or such), nor does it decentralize the root zone, it just decentralizes "DNS". 3. How it is supposed to work is, instead of OS bootstrapping using root servers, they are preloaded with a root zone public key (possibly belonging to ICANN) or a list of TLDs (with corresponding owner public keys). Then the key owner can publish zones signed with the corresponding keys on the DHT, which recursively contains keys for child subdomains. It's like if torrent and DNSSEC had a baby. 4. To lookup a domain, you do a request with (tld, pubkey) and verify the response, do this recursively for each label until you have the record you want. 5. The problems with DNS it solves is: censorship (DNS is very easy to intercept and censor), query privacy (I don't know how this works, they don't seem to use onion routing or something), and secure resolution. One thing to note here is development on GNS started in the 2001s, this was before DNSSEC and DoT/DoH were a thing, and most of the DNS was unsecured (which albeit even is today), and this could have been a completely viable approach.
- cowtools 4y ago
  I was under the impression that DNSSEC is vulnerable to downgrade attacks. Is this still the case?
  - Anunayj 4y ago
    DNSSEC has support for denial of existence (NSEC/NSEC3) proofs, which means resolvers may require the resolver to provide them. This means you can't just MITM a DS record away. However practically most people dont use locally DNSSEC verifying resolvers, instead relying on upstream resolvers to do the job for them, which can be easily manipulated by your ISP. Aside from that they bloat the size of responses a lot. However if you can sign DNSSEC on the go, you can use Cloudflare's black lies approach and have small enough DNS responses. [1] 1. https://blog.cloudflare.com/black-lies/ https://blog.cloudflare.com/black-lies/
    - 4y ago
tucnak 4y ago
Hey check 'tis paper [1] by Christian Grothoff (the creator of GNU Taler) on NSA program MORECOWBELL that is mentioned in the GNS landing page. [1]: http://goodtimesweb.org/surveillance/2015/MORECOWBELL-Analysis-Grothoff-etal.pdf http://goodtimesweb.org/surveillance/2015/MORECOWBELL-Analys...
- lunalex54 4y ago
  This is completely off topic but i was interested in an old answer of yours. Why is Sasha an appropriate nickname for Alexander in all speech but reserved for informalities with Alexandra?
balentio 4y ago
Am I right to conclude you can have multiple pet names pointing to a single global name? If so, might this lead to something like brand confusion? For instance, let's say I have a place called 4rergdes0903004059 as a global identifier for my company, Xerox. I would then make a pet name of something like Xerox.com to point to said global. However, Staples.com also points as a pet name to my Xerox global identifier...
- schanzen 4y ago
  From a technical perspective this is possible, I think. But it would mean one of two things: 1. Your implementation/OSes default configuration is messed up. 2. You accidentally messed up your local configuration yourself. If 4rergdes0903004059 is a zone owned by Xerox (i.e. the zone public key), there is not reason why staples.com would point there unless 1. or 2.
  - balentio 4y ago
    Ah, so the answer is basically no, since the key to the zone would not allow this mapping so long as everything was configured correctly. I did not see the key part but I did skim the article. Thanks!
miki123211 4y ago
This might be an unpopular opinion, but I think that decentralized DNS, and decentralized naming in general, is one of the few use cases that can be neatly solved by a blockchain, but is extremely hard to solve any other way. A major problem when designing a decentralized naming system, or any naming system at all really, is preventing malicious users from grabbing all the cool names for themselves. The only way to do this is to make acquiring domains costly, and blockchains are a perfect way to enforce that in a decentralized manner. Other problems include accurately tracking domain ownership and letting the owners transfer domains to others, which cryptocurrencies have solved long ago. As an added benefit, because all domains in such a system are owned by a public key, we suddenly no longer need a root of trust for TLS, instead, we accept any TLS certificate signed by that public key.
- tsujp 4y ago
  See: Ethereum Name System (https://ens.domains/ https://ens.domains/)
  - bouncycastle 4y ago
    ENS leads by far in the blockchain space. Almost 2 million names registered. Stats: https://dune.com/makoto/ens https://dune.com/makoto/ens Note that ENS is not only ETH, it supports multiple coins, and it's also compatible with the legacy DNS namespace, so it's possible to import & use tlds such as .com
    - NoGravitas 4y ago
      How many of those names are not squatted, and have non-trivial content?
  - rvz 4y ago
    ENS is a good example of a working concept of blockchain domains and is the only type of NFT that cannot be 'right-click saved', unlike the JPEG ones. However, Coinbase (part of the 7 admin keyholders of ENS) had a closer look at .eth addresses and their use in their wallet and decided to remove support for it and instead use .id for their Coinbase wallet. [0] Why did they do this? It turns out that: "New crypto users with no previous exposure to ENS would make the false assumption that the ".eth” domain only works" for sending and receiving $ETH." I guess it really does make sense to anchor both .eth, .id, etc on Handshake [1] after all. The concept of ENS is fine for .eth, but it doesn't seem to be enough to prevent this sort of basic confusion. [0] https://twitter.com/matt_willemsen/status/1549017822855983104/photo/1 https://twitter.com/matt_willemsen/status/154901782285598310... [1] https://handshake.org https://handshake.org
pessimizer 4y ago
From a non-expert: is there any reason (other than consumer packaging and polish) that a system like this couldn't be rolled out immediately, with ICANN as the default provider?
- schanzen 4y ago
  There are a lot of stakeholders involved and a lot of applications relying on DNS may have problems (browsers). So the migration path is long and winded I guess. Other than that, no. GNS itself could also be realised on top of other DHTs, such as libp2p/IPFS (before anyone mentioned the, eh, maturity issues of the reference implementation in GNUnet.)
  - pessimizer 4y ago
    You can't shim GNS into looking like DNS to the OS?
    - schanzen 4y ago
      You can. Either using nsswitch plugins or a local DNS service that resolved the names in GNS. But, browsers are delicate when it comes to TLS certificates, for example. See also https://www.ietf.org/archive/id/draft-schanzen-gns-19.html#name-migration-paths https://www.ietf.org/archive/id/draft-schanzen-gns-19.html#n...
- t-3 4y ago
  There's no technical reason it couldn't, but a big non-technical one: it doesn't allow for the rent-seeking behavior that supports ICANN and the internet name industry.
  - pessimizer 4y ago
    But would it be necessary for ICANN to participate in or consent to someone else (trustworthy) making their registry available over GNS?
dang 4y ago
Related: The GNU Name System - https://news.ycombinator.com/item?id=30154830 https://news.ycombinator.com/item?id=30154830 - Jan 2022 (124 comments) The GNU Name System IETF Draft - https://news.ycombinator.com/item?id=23766947 https://news.ycombinator.com/item?id=23766947 - July 2020 (32 comments)

The GNU Name System

330 points by p4bl0 4y ago

prognu 4y ago

RFC-style spec is at https://lsd.gnunet.org/lsd0001/ https://lsd.gnunet.org/lsd0001/

hericium 4y ago
Just came here with the same link in my clipboard and a question: What would be the reason for using "lsd" instead of popular IETF RFCs? The fact that RFC is supposed to open a dialogue/discussion and "lsd" is something final? (edit: it isn't; it's a IETF-style Internet-Draft). Other LSDs on that site link to RFCs. And, um, second question: what does "lsd" stand for in this case?
- forgotpwd16 4y ago
  >What would be the reason for using "lsd" instead of popular IETF RFCs? Maybe due to the following? >This specification was developed outside the IETF and does not have IETF consensus.
  - capableweb 4y ago
    Most RFCs start without consensus as well, that's why they are Request For Comments, to reconcile about the idea/specification
  - schanzen 4y ago
    This sentence is usually added for specifications which are submitted independently to the Independent Stream Editor, as opposed to drafts which are discussed in a WG at IETF.
- junon 4y ago
  I can't find much on what "LSD" means here. The root of the subdomain has no index, just a file listing.
- schanzen 4y ago
  It stands for "Living Standards Document": https://www.gnunet.org/en/livingstandards.html https://www.gnunet.org/en/livingstandards.html
schanzen 4y ago
It is also currently in the "final" phases of a RFC publication (Indepdendent Stream, Informational): https://datatracker.ietf.org/doc/draft-schanzen-gns/ https://datatracker.ietf.org/doc/draft-schanzen-gns/

blippage 4y ago

Seems interesting. I've long held the view that DNS is no longer fit for purpose. It made sense back in the day, but what is the real point of TLDs these days? It means many folk have to register their name multiple times and there's problems with domain-name squatting. It's just a money-making ploy now.

Avamander 4y ago
It actually takes quite a bit of work to operate a registrar. In addition to the technical side, which there is plenty of, there's the human aspect. Imagine the amount of trademark disputes and abuse .com/Verisign has to deal with. Trademark or local law can rarely be automated.
- cowtools 4y ago
  I have no doubt that there is hard work running a registrar, but it is ultimately just meaningless bureaucracy if the system it is servicing (DNS) is not actually useful to society at large. It is in essence, a "Bullshit Job"[0]: >[...] 3. duct tapers, who temporarily fix problems that could be fixed permanently, e.g., programmers repairing bloated code, airline desk staff who calm passengers whose bags do not arrive [...] [0] https://en.wikipedia.org/wiki/Bullshit_Jobs https://en.wikipedia.org/wiki/Bullshit_Jobs In any case I can only assume it is pretty profitable because I pay them several dollars a month to basically manage a single entry in a database and manage some paperwork. And considering that major businesses will pay big $$$ for (several!) domains...
  - eddieroger 4y ago
    It doesn't seem like bullshit to me to make sure that people claiming to be someone are actually them, and others who claim otherwise are not. With the anonymity the Internet brings, I find comfort in knowing that the URL I type in my browser is actually the endpoint I wish to receive. If that takes humans to deal with, so be it.
    - cowtools 4y ago

kelthuzad 4y ago

> How can a legitimate domain owner tell other people to not use his name in GNS? > A: Names have no owners in GNS, so there cannot be a "legitimate" domain owner. Any user can claim any name (as his preferred name or "pseudonym") in his NICK record. Similarly, all other users can choose to ignore this preference and use a name of their choice (or even assign no name) for this user. This is confusing me. How is it not a problem that randoms can just claim other people's domains?

gertrunde 4y ago
From the doc, it appears that the name isn't the name. ;) There is a global name, which is a long non-human readable unique identifier. And there is a nickname, which is only really locally significant, although the zone can publish a preferred name, the local side doesn't have to respect it.
- hsn915 4y ago
  The whole point of DNS is for a human readable name to be globally recognized.
  - notRobot 4y ago
    Yes, that is the point of DNS, but that is not the point of GNS.
  - hansword 4y ago
    Think about how the hosts.txt file was originally used before the DNS. It's closer to that (with a lot of extra sophistication and 40+ year learning)
  - p4bl0 4y ago
    I have configured my browser to go to news.ycombinator.com when I type "hn" in its URL bar. The domain name could be anything even a b32 hash I wouldn't mind, I would still just type "hn". Granted, most people do not bother using this feature, but it is also true that most non-technical people don't even bother with typing a URL, they use a search engine as a proxy anyway. In fact it would be a good idea, ecologically, to have a system that educate its users to give their own nickname to website they visit often and use them rather than performing a search query. Especially if it is as simple as clicking a "bookmark as 'xxxxx'" with xxxxx being the default name of the service/website in your browser, with a TOFU principle :).

foxhop 4y ago

I tried to use the gns system last year & got stuck, I blogged my progress here https://russell.ballestrini.net/gnunet-gns-nameserver-operator-notes-quickstart-cheatsheet/ https://russell.ballestrini.net/gnunet-gns-nameserver-operat...

prognu 4y ago
To answer the last question in your blog post: gnunet-config --diagnostics tells you where the configuration file(s) are.

silvestrov 4y ago

Seems like "X Window" system: the right solution to the wrong problem. 1) Non-problem: censorship. You can register domains in many different countries. Companies have no problem registering their domain. 2) Real problem: domain squatters. Can't see GNS solves this. 3) Real problem: sometimes people need to type (or verify) domain names. If there is no global ownership of "google.com", how do I know I'm at the right site and not a phishing site? 4) Real problem: DNS records are very limited in what they can contain (so TXT is abused for many things). GNS does not improve on this and is still a binary protocol, adding more complexity. 5) Privacy is already solved using "DNS over https". No need for reinventing the wheel completely. 6) Non problem: DNS is centralized. DNS is working very reliable and the central structure makes it easy to figure out why stuff does not work. A decentralized network is a nightmare for "why does DNS resolver fail".

ruuda 4y ago
1) is a much smaller problem than 2) indeed, but it does still happen. 5) This hides your queries from middle boxes, but your DNS server can still see the domains you are looking up. (There are some proposals to address this that involve a proxy who can't decrypt your request, so the DNS server can't see who sent the query.)
hericium 4y ago
> 5) Privacy is already solved using "DNS over https". Both yes and no. It shields the user from ISP's DNS-based invigilation but at the same time it hides application requests from the user, renders user's own DNS-based filtering (pihole and such) useless and can just transfer spying ability from local ISP to big corp. Probably an unpopular opinion but personally, I don't consider DoH as an upgrade but a deprivation of user's control. I see its theoretical benefits for less technical users who haven't heard of pihole or even problems that it solves. Just theoretical, because what benefits the user is often in opposition to what benefits the corporation.
- piaste 4y ago
  I imagine the GNU answer would be that you shouldn't run hostile / nonfree software on your machines, and you should simply be able to tell your software not to contact undesired servers (via configuration or, worst case scenario, recompilation). Having recently fully de-Big-Teched all my devices, I have the luxury of agreeing with that philosophy. As a slightly less harsh compromise, even if you run hostile apps you should be able to install a personal root certificate on your devices and MITM their traffic. Still, I imagine most IoT devices don't give you any way to do so, so you should avoid them or keep them disconnected from the wider Internet if they're still useful otherwise. Either way, the pihole corner case is not a very good argument against DoH, which is far more often a security improvement. A better argument is the big corp one, since DoH indirectly boosts their power (because a self-hosted site becomes less anonymous than one hosted on a shared AWS IP).

Anunayj 4y ago

I looked into GNS a little while ago and what I understood about how it works is: 1. I runs on top of GNUnet, which is a huge DHT that can be used for any purpose you like. 2. So GNS aims to replace DNS with a newer "modern" protocol, it is not a alternative root zone (like Handshake or such), nor does it decentralize the root zone, it just decentralizes "DNS". 3. How it is supposed to work is, instead of OS bootstrapping using root servers, they are preloaded with a root zone public key (possibly belonging to ICANN) or a list of TLDs (with corresponding owner public keys). Then the key owner can publish zones signed with the corresponding keys on the DHT, which recursively contains keys for child subdomains. It's like if torrent and DNSSEC had a baby. 4. To lookup a domain, you do a request with (tld, pubkey) and verify the response, do this recursively for each label until you have the record you want. 5. The problems with DNS it solves is: censorship (DNS is very easy to intercept and censor), query privacy (I don't know how this works, they don't seem to use onion routing or something), and secure resolution. One thing to note here is development on GNS started in the 2001s, this was before DNSSEC and DoT/DoH were a thing, and most of the DNS was unsecured (which albeit even is today), and this could have been a completely viable approach.

cowtools 4y ago
I was under the impression that DNSSEC is vulnerable to downgrade attacks. Is this still the case?
- Anunayj 4y ago
  DNSSEC has support for denial of existence (NSEC/NSEC3) proofs, which means resolvers may require the resolver to provide them. This means you can't just MITM a DS record away. However practically most people dont use locally DNSSEC verifying resolvers, instead relying on upstream resolvers to do the job for them, which can be easily manipulated by your ISP. Aside from that they bloat the size of responses a lot. However if you can sign DNSSEC on the go, you can use Cloudflare's black lies approach and have small enough DNS responses. [1] 1. https://blog.cloudflare.com/black-lies/ https://blog.cloudflare.com/black-lies/
  - 4y ago

tucnak 4y ago

Hey check 'tis paper [1] by Christian Grothoff (the creator of GNU Taler) on NSA program MORECOWBELL that is mentioned in the GNS landing page. [1]: http://goodtimesweb.org/surveillance/2015/MORECOWBELL-Analysis-Grothoff-etal.pdf http://goodtimesweb.org/surveillance/2015/MORECOWBELL-Analys...

lunalex54 4y ago
This is completely off topic but i was interested in an old answer of yours. Why is Sasha an appropriate nickname for Alexander in all speech but reserved for informalities with Alexandra?

balentio 4y ago

Am I right to conclude you can have multiple pet names pointing to a single global name? If so, might this lead to something like brand confusion? For instance, let's say I have a place called 4rergdes0903004059 as a global identifier for my company, Xerox. I would then make a pet name of something like Xerox.com to point to said global. However, Staples.com also points as a pet name to my Xerox global identifier...

schanzen 4y ago
From a technical perspective this is possible, I think. But it would mean one of two things: 1. Your implementation/OSes default configuration is messed up. 2. You accidentally messed up your local configuration yourself. If 4rergdes0903004059 is a zone owned by Xerox (i.e. the zone public key), there is not reason why staples.com would point there unless 1. or 2.
- balentio 4y ago
  Ah, so the answer is basically no, since the key to the zone would not allow this mapping so long as everything was configured correctly. I did not see the key part but I did skim the article. Thanks!

miki123211 4y ago

This might be an unpopular opinion, but I think that decentralized DNS, and decentralized naming in general, is one of the few use cases that can be neatly solved by a blockchain, but is extremely hard to solve any other way. A major problem when designing a decentralized naming system, or any naming system at all really, is preventing malicious users from grabbing all the cool names for themselves. The only way to do this is to make acquiring domains costly, and blockchains are a perfect way to enforce that in a decentralized manner. Other problems include accurately tracking domain ownership and letting the owners transfer domains to others, which cryptocurrencies have solved long ago. As an added benefit, because all domains in such a system are owned by a public key, we suddenly no longer need a root of trust for TLS, instead, we accept any TLS certificate signed by that public key.

tsujp 4y ago
See: Ethereum Name System (https://ens.domains/ https://ens.domains/)
- bouncycastle 4y ago
  ENS leads by far in the blockchain space. Almost 2 million names registered. Stats: https://dune.com/makoto/ens https://dune.com/makoto/ens Note that ENS is not only ETH, it supports multiple coins, and it's also compatible with the legacy DNS namespace, so it's possible to import & use tlds such as .com
  - NoGravitas 4y ago
    How many of those names are not squatted, and have non-trivial content?
- rvz 4y ago
  ENS is a good example of a working concept of blockchain domains and is the only type of NFT that cannot be 'right-click saved', unlike the JPEG ones. However, Coinbase (part of the 7 admin keyholders of ENS) had a closer look at .eth addresses and their use in their wallet and decided to remove support for it and instead use .id for their Coinbase wallet. [0] Why did they do this? It turns out that: "New crypto users with no previous exposure to ENS would make the false assumption that the ".eth” domain only works" for sending and receiving $ETH." I guess it really does make sense to anchor both .eth, .id, etc on Handshake [1] after all. The concept of ENS is fine for .eth, but it doesn't seem to be enough to prevent this sort of basic confusion. [0] https://twitter.com/matt_willemsen/status/1549017822855983104/photo/1 https://twitter.com/matt_willemsen/status/154901782285598310... [1] https://handshake.org https://handshake.org

pessimizer 4y ago

From a non-expert: is there any reason (other than consumer packaging and polish) that a system like this couldn't be rolled out immediately, with ICANN as the default provider?

schanzen 4y ago
There are a lot of stakeholders involved and a lot of applications relying on DNS may have problems (browsers). So the migration path is long and winded I guess. Other than that, no. GNS itself could also be realised on top of other DHTs, such as libp2p/IPFS (before anyone mentioned the, eh, maturity issues of the reference implementation in GNUnet.)
- pessimizer 4y ago
  You can't shim GNS into looking like DNS to the OS?
  - schanzen 4y ago
    You can. Either using nsswitch plugins or a local DNS service that resolved the names in GNS. But, browsers are delicate when it comes to TLS certificates, for example. See also https://www.ietf.org/archive/id/draft-schanzen-gns-19.html#name-migration-paths https://www.ietf.org/archive/id/draft-schanzen-gns-19.html#n...
t-3 4y ago
There's no technical reason it couldn't, but a big non-technical one: it doesn't allow for the rent-seeking behavior that supports ICANN and the internet name industry.
- pessimizer 4y ago
  But would it be necessary for ICANN to participate in or consent to someone else (trustworthy) making their registry available over GNS?

dang 4y ago

Related: The GNU Name System - https://news.ycombinator.com/item?id=30154830 https://news.ycombinator.com/item?id=30154830 - Jan 2022 (124 comments) The GNU Name System IETF Draft - https://news.ycombinator.com/item?id=23766947 https://news.ycombinator.com/item?id=23766947 - July 2020 (32 comments)