7 ms·

This might be an unpopular opinion, but I think that decentralized DNS, and decentralized naming in general, is one of the few use cases that can be neatly solv

This might be an unpopular opinion, but I think that decentralized DNS, and decentralized naming in general, is one of the few use cases that can be neatly solved by a blockchain, but is extremely hard to solve any other way. A major problem when designing a decentralized naming system, or any naming system at all really, is preventing malicious users from grabbing all the cool names for themselves. The only way to do this is to make acquiring domains costly, and blockchains are a perfect way to enforce that in a decentralized manner. Other problems include accurately tracking domain ownership and letting the owners transfer domains to others, which cryptocurrencies have solved long ago. As an added benefit, because all domains in such a system are owned by a public key, we suddenly no longer need a root of trust for TLS, instead, we accept any TLS certificate signed by that public key.

tsujp 4y ago
See: Ethereum Name System (https://ens.domains/ https://ens.domains/)
- bouncycastle 4y ago
  ENS leads by far in the blockchain space. Almost 2 million names registered. Stats: https://dune.com/makoto/ens https://dune.com/makoto/ens Note that ENS is not only ETH, it supports multiple coins, and it's also compatible with the legacy DNS namespace, so it's possible to import & use tlds such as .com
  - NoGravitas 4y ago
    How many of those names are not squatted, and have non-trivial content?
- rvz 4y ago
  ENS is a good example of a working concept of blockchain domains and is the only type of NFT that cannot be 'right-click saved', unlike the JPEG ones. However, Coinbase (part of the 7 admin keyholders of ENS) had a closer look at .eth addresses and their use in their wallet and decided to remove support for it and instead use .id for their Coinbase wallet. [0] Why did they do this? It turns out that: "New crypto users with no previous exposure to ENS would make the false assumption that the ".eth” domain only works" for sending and receiving $ETH." I guess it really does make sense to anchor both .eth, .id, etc on Handshake [1] after all. The concept of ENS is fine for .eth, but it doesn't seem to be enough to prevent this sort of basic confusion. [0] https://twitter.com/matt_willemsen/status/1549017822855983104/photo/1 https://twitter.com/matt_willemsen/status/154901782285598310... [1] https://handshake.org https://handshake.org
  - hnthrow1010 4y ago
    There's also the matter that ENS "solves" the problem by reintroducing a central point of failure: the smart contract itself. Anything blockchain-adjacent really can't conceivably be called "decentralized".
the_gipsy 4y ago
Why does this not exist?
- Avamander 4y ago
  It does, but has tradeoffs we don't want. Like having no way to curb abuse.
  - qweqwerwerwerwr 4y ago
    on the contrary, that's the thing we want the most. having no way to curb abuse is what gave Tor a few orders of magnitude more adoption than the other alternative internets. having no way to curb abuse is what made crypto market what it is.
    - Avamander 4y ago
      it's really not. not I or anyone I know wants a web filled with malware, CSAM or spam that is difficult to remove. Onion links already being the Russian roulette they are, the tendency is rather clear, nobody* really wants that.
      - qweqwerwerwerwr 4y ago
        it's not the name servers' job to deal with any of that, especially on the clearnet
        Avamander 4y ago
        It's the host of those name servers' job, yes.
        qweqwerwerwerwr 4y ago
        you're arguing that its yellow pages job to remove the entry for businesses that violate laws. not only is that not the case, that's profoundly absurd.
timetraveller26 4y ago
See: namecoin https://www.namecoin.org/ https://www.namecoin.org/
- NoGravitas 4y ago
  Namecoin is a notable failure: https://www.cs.princeton.edu/~arvindn/publications/namespaces.pdf https://www.cs.princeton.edu/~arvindn/publications/namespace...
schanzen 4y ago
Theoretically, you could combine a blockchain-based root zone governance (e.g. Handshake) with GNS. This would give you globally unique names and efficient and private delegated names. In general, not a fan of BNS beyond that, through, as upkeep is too resource intensive. It is just not a sustainable and efficient thing to do for names.
agentultra 4y ago
Or you can simply trust the organization bootstrapping the naming system by other means and not use a blockchain to defend against this hypothetical scenario at a high energy/compute cost. Some reasonable measures: 1. the organization could be a non-profit co-operative owned individually by its investors 2. the organization could establish a contract that enforces desired behaviour of participants by the judicial system Voila, no blockchain needed.
- rvense 4y ago
  Correct. And as and user who does not understand, nor have the resources to meaningfully inspect, all the king's software and all the king's bugs, the end result is exactly the same: Good, old-fashioned analogue trust (GOFAT? to coin a phrase?) in the elves that make my computer run.
- solardev 4y ago
  That only works if the users trust their government(s), where geopolitics are stable, and where freedom from censorship is a cultural norm. All of those things are increasingly rare, and centralized domain names are an easy way for states or competing governments to block access to undesirable materials. The allure of a supranational DHT network is that it is more censorship-resistant, requiring deep packet inspection or attacks to block certain lookups. I think this hypothetical consensus-based DNS blockchain sounds nice at first glance, but really, it just means that DNS is changed from an authority-based model to a consensus-based one. But consensus of what? It's not of people, but of resources -- compute power -- which states will always have more of, anyway. Like TOR, it just means the state has to control/surveil more "trusted" nodes. So it doesn't really solve anything. You can't "web of trust" a global network of 8 billion people who don't have any interest in this stuff, don't want to peg their individual identities to some online system, and don't agree on what truth is to begin with. You can't techno-topia your way out of the cultural differences inherent in geopolitical disagreements.
  - agentultra 4y ago
    > You can't techno-topia your way out of the cultural differences inherent in geopolitical disagreements. Too true. Computers won't "solve" social/political/cultural issues. They're reflections of the creators' politics. Even blockchains that purport to be egalitarian reflect the political ideology of their creators -- often naive at best or tyrannical themselves at worst.
cowtools 4y ago
I don't have a lot of faith in the namecoin or namecoin-derivative solutions. Just because an agent has a lot of cryptocurrency or hash power doesn't mean they should be able to steal or squat a domain. There are security consequences for domain ownership. Users should get to explicitly decide for themselves who owns what domain, or delegate that power to a trusted authority to decide for them. GNS enables this behavior. I think namespacing is a rather poor use-case of this type of consensus.
- NoGravitas 4y ago
  Yeah, namecoin was a pretty dramatic failure — every interesting domain on it was squatted early on, when it was cheaper to do so.
  - aaaaaaaaata 4y ago
    Differing itself from ICANN in what way, exactly?
    - tptacek 4y ago
      In exactly the way stated.
      - User23 4y ago
        I think the point being made was that all the identifiably good DNS names got squatted back in the 90s when they were free.
edent 4y ago
Which Blockchain? If you use, for example, .eth on one chain - there's literally nothing stopping me from instigating a new chain which also uses .eth So you either have to disambiguate names at a protocol level (miki://whatever.eth vs edent://whatever.eth) or at a name level (whatever.eth.miki vs whatever.eth.edent) Or, you convince everyone in the world to standardise on one chain. In which case, how's that difference from what we have already?
deleted 4y ago
[deleted]
NoGravitas 4y ago
You could solve decentralized naming with a blockchain. But blockchains have negative externalities (yes, even proof of work), and decentralized DNS can be solved without one (with a DHT being an obvious part of the solution).
hnthrow1010 4y ago
>This might be an unpopular opinion, but I think that decentralized DNS, and decentralized naming in general, is one of the few use cases that can be neatly solved by a blockchain, but is extremely hard to solve any other way. It's an unpopular opinion because it doesn't hold up to scrutiny. Here, let's go through it piece by piece: >A major problem when designing a decentralized naming system, or any naming system at all really, is preventing malicious users from grabbing all the cool names for themselves. This has nothing to do with malicious users. Any system that allows users to exclusively claim names permanently (or semi-permanently) will have this problem. Even if you invented a way to define and eject all malicious users out of DNS, domain names like facebook.com and youtube.com would still be highly contended and expensive, because of the inherent demand of those names in the current market. >The only way to do this is to make acquiring domains costly No, that wouldn't exclude malicious customers, it would only exclude customers who don't have a lot of money. You'd just select for the customers who are both malicious and wealthy. >and blockchains are a perfect way to enforce that in a decentralized manner. In practice, blockchains aren't decentralized at all. This much was obvious to anyone involved, since the first bitcoin mining pool formed in 2010. By making the system costly to join, you're only accelerating the process of centralization. >Other problems include accurately tracking domain ownership and letting the owners transfer domains to others, which cryptocurrencies have solved long ago. Cryptocurrencies didn't solve this and never will. A blockchain isn't legally binding, so tracking ownership just can't be done there. At best, you can have something that's an approximation of ownership, but still requires a trusted authority (i.e. an oracle) to make the final say on what the ownership actually is. >As an added benefit, because all domains in such a system are owned by a public key, we suddenly no longer need a root of trust for TLS, instead, we accept any TLS certificate signed by that public key. This is just shifting the problem. Now instead of worrying about trusting the root, you have to worry about trusting every single key out there, and make an individual decision for each of them.
- miki123211 4y ago
  > No, that wouldn't exclude malicious customers, it would only exclude customers who don't have a lot of money. You'd just select for the customers who are both malicious and wealthy. If domains cost $0, claiming all potentially useful names for yourself costs x*0=$0. Someone will inevitably do that, making them the exclusive owner of almost all domains you could ever want to buy. As a consequence, 99% of potential future domains would be owned by malicious actors, who could charge astronomical prices for them. In other words, if you make domains free, somebody will snatch them all up and sell them for a lot of money. If you need to make a payment to get or renew a domain, such an attack becomes far more costly. Getting the first 100 English words is probably worth it, getting a combination of all possible names and surnames probably isn't, unlike in the free version. That way, you can still find interesting domains that you actually need for low dollar amounts. > In practice, blockchains aren't decentralized at all. This much was obvious to anyone involved, since the first bitcoin mining pool formed in 2010. By making the system costly to join, you're only accelerating the process of centralization. Even if you can make a 51% attack, the security of the system isn't compromised. Sure, you can prevent domain registrations, transfers and updates for a while, maybe even reverse transactions done in the last few blocks, but you still can't take over anybody's domain without having their private key. > Cryptocurrencies didn't solve this and never will. A blockchain isn't legally binding, so tracking ownership just can't be done there. At best, you can have something that's an approximation of ownership, but still requires a trusted authority (i.e. an oracle) to make the final say on what the ownership actually is. You don't care about ownership in the legal sense, all you care about is that if Mark Zuckerberg owns the private key for Facebook.com today, nobody can do anything to Facebook.com tomorrow without his consent. > This is just shifting the problem. Now instead of worrying about trusting the root, you have to worry about trusting every single key out there, and make an individual decision for each of them. All TLS really guarantees is that the server you're contacting is trusted by the owner of the domain you typed in. In the current system, you need a root of trust to accomplish that, blockchains give you that property for free.
PhineasRex 4y ago
As long as you don't mind the astronomical operating cost once such a system reaches the scale of DNS, sure.
colinsane 4y ago
or you can go the Secure Scuttlebutt route where the user resolves a name based on some simple function of how your peers (which you explicitly choose) resolve it. Blockchain DNS will probably happen first, but i think name resolution which doesn’t require global consensus is under-appreciated. it’s like if i ask wikipedia (or a non-localized Google) for the page on “i3”, v.s. asking a random selection of my friends for the page on “i3”: i’m just always going to get a better result by more heavily weighting the response of my peers than the responses of people far-removed from me.

tsujp 4y ago

See: Ethereum Name System (https://ens.domains/ https://ens.domains/)

bouncycastle 4y ago
ENS leads by far in the blockchain space. Almost 2 million names registered. Stats: https://dune.com/makoto/ens https://dune.com/makoto/ens Note that ENS is not only ETH, it supports multiple coins, and it's also compatible with the legacy DNS namespace, so it's possible to import & use tlds such as .com
- NoGravitas 4y ago
  How many of those names are not squatted, and have non-trivial content?
rvz 4y ago
ENS is a good example of a working concept of blockchain domains and is the only type of NFT that cannot be 'right-click saved', unlike the JPEG ones. However, Coinbase (part of the 7 admin keyholders of ENS) had a closer look at .eth addresses and their use in their wallet and decided to remove support for it and instead use .id for their Coinbase wallet. [0] Why did they do this? It turns out that: "New crypto users with no previous exposure to ENS would make the false assumption that the ".eth” domain only works" for sending and receiving $ETH." I guess it really does make sense to anchor both .eth, .id, etc on Handshake [1] after all. The concept of ENS is fine for .eth, but it doesn't seem to be enough to prevent this sort of basic confusion. [0] https://twitter.com/matt_willemsen/status/1549017822855983104/photo/1 https://twitter.com/matt_willemsen/status/154901782285598310... [1] https://handshake.org https://handshake.org
- hnthrow1010 4y ago
  There's also the matter that ENS "solves" the problem by reintroducing a central point of failure: the smart contract itself. Anything blockchain-adjacent really can't conceivably be called "decentralized".

the_gipsy 4y ago

Why does this not exist?

Avamander 4y ago
It does, but has tradeoffs we don't want. Like having no way to curb abuse.
- qweqwerwerwerwr 4y ago
  on the contrary, that's the thing we want the most. having no way to curb abuse is what gave Tor a few orders of magnitude more adoption than the other alternative internets. having no way to curb abuse is what made crypto market what it is.
  - Avamander 4y ago
    it's really not. not I or anyone I know wants a web filled with malware, CSAM or spam that is difficult to remove. Onion links already being the Russian roulette they are, the tendency is rather clear, nobody* really wants that.
    - qweqwerwerwerwr 4y ago
      it's not the name servers' job to deal with any of that, especially on the clearnet
      - Avamander 4y ago
        It's the host of those name servers' job, yes.
        qweqwerwerwerwr 4y ago
        you're arguing that its yellow pages job to remove the entry for businesses that violate laws. not only is that not the case, that's profoundly absurd.

timetraveller26 4y ago

See: namecoin https://www.namecoin.org/ https://www.namecoin.org/

NoGravitas 4y ago
Namecoin is a notable failure: https://www.cs.princeton.edu/~arvindn/publications/namespaces.pdf https://www.cs.princeton.edu/~arvindn/publications/namespace...

schanzen 4y ago

Theoretically, you could combine a blockchain-based root zone governance (e.g. Handshake) with GNS. This would give you globally unique names and efficient and private delegated names. In general, not a fan of BNS beyond that, through, as upkeep is too resource intensive. It is just not a sustainable and efficient thing to do for names.

agentultra 4y ago

Or you can simply trust the organization bootstrapping the naming system by other means and not use a blockchain to defend against this hypothetical scenario at a high energy/compute cost. Some reasonable measures: 1. the organization could be a non-profit co-operative owned individually by its investors 2. the organization could establish a contract that enforces desired behaviour of participants by the judicial system Voila, no blockchain needed.

rvense 4y ago
Correct. And as and user who does not understand, nor have the resources to meaningfully inspect, all the king's software and all the king's bugs, the end result is exactly the same: Good, old-fashioned analogue trust (GOFAT? to coin a phrase?) in the elves that make my computer run.
solardev 4y ago
That only works if the users trust their government(s), where geopolitics are stable, and where freedom from censorship is a cultural norm. All of those things are increasingly rare, and centralized domain names are an easy way for states or competing governments to block access to undesirable materials. The allure of a supranational DHT network is that it is more censorship-resistant, requiring deep packet inspection or attacks to block certain lookups. I think this hypothetical consensus-based DNS blockchain sounds nice at first glance, but really, it just means that DNS is changed from an authority-based model to a consensus-based one. But consensus of what? It's not of people, but of resources -- compute power -- which states will always have more of, anyway. Like TOR, it just means the state has to control/surveil more "trusted" nodes. So it doesn't really solve anything. You can't "web of trust" a global network of 8 billion people who don't have any interest in this stuff, don't want to peg their individual identities to some online system, and don't agree on what truth is to begin with. You can't techno-topia your way out of the cultural differences inherent in geopolitical disagreements.
- agentultra 4y ago
  > You can't techno-topia your way out of the cultural differences inherent in geopolitical disagreements. Too true. Computers won't "solve" social/political/cultural issues. They're reflections of the creators' politics. Even blockchains that purport to be egalitarian reflect the political ideology of their creators -- often naive at best or tyrannical themselves at worst.

cowtools 4y ago

I don't have a lot of faith in the namecoin or namecoin-derivative solutions. Just because an agent has a lot of cryptocurrency or hash power doesn't mean they should be able to steal or squat a domain. There are security consequences for domain ownership. Users should get to explicitly decide for themselves who owns what domain, or delegate that power to a trusted authority to decide for them. GNS enables this behavior. I think namespacing is a rather poor use-case of this type of consensus.

NoGravitas 4y ago
Yeah, namecoin was a pretty dramatic failure — every interesting domain on it was squatted early on, when it was cheaper to do so.
- aaaaaaaaata 4y ago
  Differing itself from ICANN in what way, exactly?
  - tptacek 4y ago
    In exactly the way stated.
    - User23 4y ago
      I think the point being made was that all the identifiably good DNS names got squatted back in the 90s when they were free.

edent 4y ago

Which Blockchain? If you use, for example, .eth on one chain - there's literally nothing stopping me from instigating a new chain which also uses .eth So you either have to disambiguate names at a protocol level (miki://whatever.eth vs edent://whatever.eth) or at a name level (whatever.eth.miki vs whatever.eth.edent) Or, you convince everyone in the world to standardise on one chain. In which case, how's that difference from what we have already?

deleted 4y ago

[deleted]

NoGravitas 4y ago

You could solve decentralized naming with a blockchain. But blockchains have negative externalities (yes, even proof of work), and decentralized DNS can be solved without one (with a DHT being an obvious part of the solution).

hnthrow1010 4y ago

>This might be an unpopular opinion, but I think that decentralized DNS, and decentralized naming in general, is one of the few use cases that can be neatly solved by a blockchain, but is extremely hard to solve any other way. It's an unpopular opinion because it doesn't hold up to scrutiny. Here, let's go through it piece by piece: >A major problem when designing a decentralized naming system, or any naming system at all really, is preventing malicious users from grabbing all the cool names for themselves. This has nothing to do with malicious users. Any system that allows users to exclusively claim names permanently (or semi-permanently) will have this problem. Even if you invented a way to define and eject all malicious users out of DNS, domain names like facebook.com and youtube.com would still be highly contended and expensive, because of the inherent demand of those names in the current market. >The only way to do this is to make acquiring domains costly No, that wouldn't exclude malicious customers, it would only exclude customers who don't have a lot of money. You'd just select for the customers who are both malicious and wealthy. >and blockchains are a perfect way to enforce that in a decentralized manner. In practice, blockchains aren't decentralized at all. This much was obvious to anyone involved, since the first bitcoin mining pool formed in 2010. By making the system costly to join, you're only accelerating the process of centralization. >Other problems include accurately tracking domain ownership and letting the owners transfer domains to others, which cryptocurrencies have solved long ago. Cryptocurrencies didn't solve this and never will. A blockchain isn't legally binding, so tracking ownership just can't be done there. At best, you can have something that's an approximation of ownership, but still requires a trusted authority (i.e. an oracle) to make the final say on what the ownership actually is. >As an added benefit, because all domains in such a system are owned by a public key, we suddenly no longer need a root of trust for TLS, instead, we accept any TLS certificate signed by that public key. This is just shifting the problem. Now instead of worrying about trusting the root, you have to worry about trusting every single key out there, and make an individual decision for each of them.

miki123211 4y ago
> No, that wouldn't exclude malicious customers, it would only exclude customers who don't have a lot of money. You'd just select for the customers who are both malicious and wealthy. If domains cost $0, claiming all potentially useful names for yourself costs x*0=$0. Someone will inevitably do that, making them the exclusive owner of almost all domains you could ever want to buy. As a consequence, 99% of potential future domains would be owned by malicious actors, who could charge astronomical prices for them. In other words, if you make domains free, somebody will snatch them all up and sell them for a lot of money. If you need to make a payment to get or renew a domain, such an attack becomes far more costly. Getting the first 100 English words is probably worth it, getting a combination of all possible names and surnames probably isn't, unlike in the free version. That way, you can still find interesting domains that you actually need for low dollar amounts. > In practice, blockchains aren't decentralized at all. This much was obvious to anyone involved, since the first bitcoin mining pool formed in 2010. By making the system costly to join, you're only accelerating the process of centralization. Even if you can make a 51% attack, the security of the system isn't compromised. Sure, you can prevent domain registrations, transfers and updates for a while, maybe even reverse transactions done in the last few blocks, but you still can't take over anybody's domain without having their private key. > Cryptocurrencies didn't solve this and never will. A blockchain isn't legally binding, so tracking ownership just can't be done there. At best, you can have something that's an approximation of ownership, but still requires a trusted authority (i.e. an oracle) to make the final say on what the ownership actually is. You don't care about ownership in the legal sense, all you care about is that if Mark Zuckerberg owns the private key for Facebook.com today, nobody can do anything to Facebook.com tomorrow without his consent. > This is just shifting the problem. Now instead of worrying about trusting the root, you have to worry about trusting every single key out there, and make an individual decision for each of them. All TLS really guarantees is that the server you're contacting is trusted by the owner of the domain you typed in. In the current system, you need a root of trust to accomplish that, blockchains give you that property for free.

PhineasRex 4y ago

As long as you don't mind the astronomical operating cost once such a system reaches the scale of DNS, sure.

colinsane 4y ago

or you can go the Secure Scuttlebutt route where the user resolves a name based on some simple function of how your peers (which you explicitly choose) resolve it. Blockchain DNS will probably happen first, but i think name resolution which doesn’t require global consensus is under-appreciated. it’s like if i ask wikipedia (or a non-localized Google) for the page on “i3”, v.s. asking a random selection of my friends for the page on “i3”: i’m just always going to get a better result by more heavily weighting the response of my peers than the responses of people far-removed from me.