3 ms·

Your house must look like a hoarder house, then. I mean, there was all that space in there, and space is meant for filling, so why not fill it up? /s Like an

Your house must look like a hoarder house, then. I mean, there was all that space in there, and space is meant for filling, so why not fill it up? /s Like any computer system, Root DNS was designed around expectations of typical utilization and expected response time, with margins for burst traffic. Capacity was left unused for a reason. Google's action here is an example of cost shifting. It doesn't cost Google or the individual user anything to test for a hijacked DNS resolver, because the costs are shifted to the Root DNS. As the article puts it, this cost shifting is indistinguishable from a DDoS because it consumes network capacity and CPU resources and electrical power in an unplanned fashion. Root DNS was designed around resolving names, not testing for hijacked DNS. And just because you can use DNS to test for hijacked DNS doesn't mean you should.

tptacek 4y ago
Root DNS was designed around resolving names, not testing for hijacked DNS. Says who? You? Have you double checked that belief with the RFCs? Last I looked, there's a lot more than just name->IP in the DNS. "Testing for hijacked DNS" is a DNS function. The root servers are there to make applications work, not the other way around. They're fine, and people watching them don't dictate terms to the browsers.
- Karellen 4y ago
  Well, I just searched RFCs 1034, 1035, 1101, 1183, 1348, 1876, 1982, 1995, 1996, 2065, 2136, 2181, 2137, 2308, 2535, 2673, 2845, 3425, 3658, 4033, 4034, 4035, 4343, 4592, 5936, 5966, 6604, 7766, 8020, 8482, 8490, and 8767 for the word "hijack", and the only reference I can find is rfc2845 §4.4, and that's referencing using TSIG to prevent man-in-the-middle TCP connection-hijacking of a DNS-over-TCP request. Nothing that I can find there about checking for hijacked DNS. Did you have a specific RFC/section in mind that you were thinking of? (Damn, there are a lot of RFCs devoted to DNS!)
  - nightpool 4y ago
    What else could DNSSEC possibly be for, if not for testing whether DNS has been hijacked?

tptacek 4y ago

Root DNS was designed around resolving names, not testing for hijacked DNS. Says who? You? Have you double checked that belief with the RFCs? Last I looked, there's a lot more than just name->IP in the DNS. "Testing for hijacked DNS" is a DNS function. The root servers are there to make applications work, not the other way around. They're fine, and people watching them don't dictate terms to the browsers.

Karellen 4y ago
Well, I just searched RFCs 1034, 1035, 1101, 1183, 1348, 1876, 1982, 1995, 1996, 2065, 2136, 2181, 2137, 2308, 2535, 2673, 2845, 3425, 3658, 4033, 4034, 4035, 4343, 4592, 5936, 5966, 6604, 7766, 8020, 8482, 8490, and 8767 for the word "hijack", and the only reference I can find is rfc2845 §4.4, and that's referencing using TSIG to prevent man-in-the-middle TCP connection-hijacking of a DNS-over-TCP request. Nothing that I can find there about checking for hijacked DNS. Did you have a specific RFC/section in mind that you were thinking of? (Damn, there are a lot of RFCs devoted to DNS!)
- nightpool 4y ago
  What else could DNSSEC possibly be for, if not for testing whether DNS has been hijacked?