3 ms·

The reality is that most people, EVEN technical people, don't actually understand the Internet. The only people I consistently have conversed with who understa

The reality is that most people, EVEN technical people, don't actually understand the Internet. The only people I consistently have conversed with who understand the Internet are technology advocates that have a deep background in Internet networking. Even on HN, most people believe many things about how the Internet works, at the networking layer, at the application layer, and socioculturally, that are not true, and provably not true, but widely believed. A true headline would be "Hardly anyone who isn't at least a double CCIE with ~15 years of experience in web policy understands the Internet." Most technical people don't understand DNS, and it's one of the most basic and core technologies to how the Internet works today. The courts definitely don't understand DNS. The vast majority don't understand BGP, and it's literally the basis for how Internet networking works. Many don't understand the Web as a tech stack, outside possibly the basics of website design. Even people who develop web applications don't understand the Web as a tech stack. It's actually a major concern for me, because the promise that future generations would be "digital natives" with deep technology understanding didn't come to fruition. The knowledge of how all of this infrastructure actually works is dying off, and very few people are interested in learning it, and the entire global economy is now built on the Internet in a myriad of ways. Reminds me of https://xkcd.com/2347/ https://xkcd.com/2347/ except extrapolate from open source software to literally all essential technologies the world runs on.

automatoney 4y ago
> Even on HN, most people believe many things about how the Internet works, at the networking layer, at the application layer, and socioculturally, that are not true, and provably not true, but widely believed. Could you debunk some of the most common/biggest false beliefs you encounter? I'm curious to see which traps I fall into.
- tristor 4y ago
  There's so many I'm not sure where to begin. A few simple ones that most people believe about networking on the Internet that aren't true are: 1. Routing paths are primarily decided by path distance as the metric. 2. IP ownership is authenticated and therefore the global route table is deterministic and stable. 3. DNS traffic is always over UDP/53 4. DNS is controlled by the network. Related, split horizon DNS is reliable. 5. Domain registrars and the root nameservers are required to be contacted in order to get a DNS response for a given public domain. As a corollary, seizing domains or blocking DNS at the root is a sufficient method to block access to a site. Secondary corollary, a correctly configured and valid public domain is reachable from anywhere on the Internet that can make a DNS query. A lot of these are true in /some cases/, or in the general case, but not in the corner cases. A lot of policy and court decisions about the Internet assume the happy path or the common case when dealing with situations where motivated actors may take actions outside the happy path to work around that court order. It is entirely possible to bypass public DNS to resolve a public IP on the Internet as long as it routable, regardless of what registrars or public (and root) nameservers say. (see: Pirate Bay and their shenanigans, also see Tor resolvers, see non-authoritative DNS resolvers, see host file sharing, see alternate roots, etc.) A lot of policies within organizations, including those set by network admins, are based on a belief that systems in their network obey the things provided by their network, when in fact the client controls nearly everything about how it decides to interact with a network, and the network can only provide configuration as a suggestion or recommendation. There are very limited options for enforcing policy at the network level. There is no guarantee that any given client on your network is actually utilizing your local DNS resolvers or successfully will resolve split horizon DNS. A lot of configurations in the world are based on trust in systems which are inherently designed in an untrustworthy manner, or which require additional configuration and technology to provide an external basis for trust. This has had consequences with far-reaching impact and will continue to do (see BGP hijacking). DNS, except when using newer protocols and taking extra measures to authenticate responses, is easily intercepted and hijacked. It is entirely possible to capture queries and inject non-authoritative responses, including responses which claim to be authoritative at any point in the path the query traverses. This is actually commonplace in some regions of the world (see: China). DNS that is authenticated and encrypted doesn't traverse UDP/53.
  - warner25 4y ago
    I'm either feeling disappointed with this list, or feeling proud of myself that I can say, "Yes, of course, those things aren't true, and here's why..." I just have an expired CCNA and have taken a couple graduate-level courses on network security and traffic analysis. The only one I haven't heard of is "split horizon DNS."
koboll 4y ago
>The reality is that most people, EVEN technical people, don't actually understand the Internet. Nothing gives me Gell-Mann amnesia quite like the comments that get upvoted on HN posts relevant to the particular area in which I work...
- warner25 4y ago
  Yeah, I actually find it really disconcerting. It's one thing when you read mainstream news stories and see that they're inaccurate; like, "OK, sure the writer is a journalist, obviously not a specialist in this area, and the intended audience is also comprised of non-specialists." But reading HN makes me feel very inadequate 99% of the time, in terms of my knowledge of the computing domain. Then every few months I see a thread about some specific thing that I feel quite comfortable with and it's like, "What on earth? I thought these people were all smarter than me, but look at these comments..." I'm currently a PhD student doing research related to Tor, and there was a thread about Tor last month. I didn't even know where to start with the comments, so I didn't participate at all.
billythemaniam 4y ago
I don't think it is necessary to understand how the internet works technically to "understand the internet". It's like saying a race car driver can't drive fast without understanding the physics of a piston.
- tristor 4y ago
  I get what you're saying, but I think you might be missing the point that I'm making. DNS and BGP aren't JUST technical, they're also deeply geopolitical. The Internet isn't an accident, it's an intentionally and carefully formed set of peer autonomous networks, with a shared protocol and written (and unwritten) rules for how we name and resolve the path to get to those different networks from one another. These standards, the technical implementation of them, and how they interact with the real world is actually deeply geopolitical as well as socioeconomic. It's not just understanding how it works technically, it's understanding how it works from a policy, standardization, and governance perspective. Just like the law, how we arrived at the particular standards and policies informs the context for decisions we make about the technology and how its implemented. Even then, without an understanding of how it works technically, it's not possible to responsibly and accurately adjudicate the law as it relates to these technologies. How BGP and DNS work is actually front and center in many court cases, where the decision rested on a basic misunderstanding, which rendered the outcome either ineffective or unjust. Think of all the cases where DNS blocking is utilized on a court order, not realizing that this is effectively meaningless and is not actually effective. People don't often understand how deep this rabbit hole goes, even technical people who understand the basics of routing. They don't actually understand what a "peering agreement" means, especially what it means when it crosses an international border. The way that the law interacts with the Internet is an integration point that has an especially high level of complexity, and nearly no-one involved in that complexity in our current system day to day is actually qualified to discuss it. When we have failures in this integration point is has deep reaching impacts that have broad implications for how technology continues to develop into the future, and there are both positive and negative consequences for this. As a simple example, the stupidity with courts and DNS blocking and the way in which some governments around the world behave in relation to DNS is actually a core reason why DoH and DoT exist, because misapplication of law based on misunderstanding of technology risked fundamentally breaking the basic building blocks of the Internet required for it to function and for networks to successfully interoperate, so the people who actually understand how it works had to come up with new technology to "route around" stupidity in legislatures and courts around the world. These new technologies /themselves/ have geopolitical consequences (see UK and EU stupidity regarding crypto and its implications for DoH and DoT). It's not JUST understanding the technology, there's the 0th layer and the 8th layer in the reference model.
yamtaddle 4y ago
Do you thing Cisco router configurations of BGP or whatever have anything to do with how this case is going to be decided? I'm pretty sure that's not what was meant by "understand the Internet", in this context.
- tristor 4y ago
  This particular case? No. Many other cases, yes. I think there is a severe lack of understanding in the court system at every level, not just with BGP.
pixl97 4y ago
>EVEN technical people, don't actually understand the Internet Didn't Isaac Asimov write a documentary on this call 'Foundation'?

automatoney 4y ago

> Even on HN, most people believe many things about how the Internet works, at the networking layer, at the application layer, and socioculturally, that are not true, and provably not true, but widely believed. Could you debunk some of the most common/biggest false beliefs you encounter? I'm curious to see which traps I fall into.

tristor 4y ago
There's so many I'm not sure where to begin. A few simple ones that most people believe about networking on the Internet that aren't true are: 1. Routing paths are primarily decided by path distance as the metric. 2. IP ownership is authenticated and therefore the global route table is deterministic and stable. 3. DNS traffic is always over UDP/53 4. DNS is controlled by the network. Related, split horizon DNS is reliable. 5. Domain registrars and the root nameservers are required to be contacted in order to get a DNS response for a given public domain. As a corollary, seizing domains or blocking DNS at the root is a sufficient method to block access to a site. Secondary corollary, a correctly configured and valid public domain is reachable from anywhere on the Internet that can make a DNS query. A lot of these are true in /some cases/, or in the general case, but not in the corner cases. A lot of policy and court decisions about the Internet assume the happy path or the common case when dealing with situations where motivated actors may take actions outside the happy path to work around that court order. It is entirely possible to bypass public DNS to resolve a public IP on the Internet as long as it routable, regardless of what registrars or public (and root) nameservers say. (see: Pirate Bay and their shenanigans, also see Tor resolvers, see non-authoritative DNS resolvers, see host file sharing, see alternate roots, etc.) A lot of policies within organizations, including those set by network admins, are based on a belief that systems in their network obey the things provided by their network, when in fact the client controls nearly everything about how it decides to interact with a network, and the network can only provide configuration as a suggestion or recommendation. There are very limited options for enforcing policy at the network level. There is no guarantee that any given client on your network is actually utilizing your local DNS resolvers or successfully will resolve split horizon DNS. A lot of configurations in the world are based on trust in systems which are inherently designed in an untrustworthy manner, or which require additional configuration and technology to provide an external basis for trust. This has had consequences with far-reaching impact and will continue to do (see BGP hijacking). DNS, except when using newer protocols and taking extra measures to authenticate responses, is easily intercepted and hijacked. It is entirely possible to capture queries and inject non-authoritative responses, including responses which claim to be authoritative at any point in the path the query traverses. This is actually commonplace in some regions of the world (see: China). DNS that is authenticated and encrypted doesn't traverse UDP/53.
- warner25 4y ago
  I'm either feeling disappointed with this list, or feeling proud of myself that I can say, "Yes, of course, those things aren't true, and here's why..." I just have an expired CCNA and have taken a couple graduate-level courses on network security and traffic analysis. The only one I haven't heard of is "split horizon DNS."

koboll 4y ago

>The reality is that most people, EVEN technical people, don't actually understand the Internet. Nothing gives me Gell-Mann amnesia quite like the comments that get upvoted on HN posts relevant to the particular area in which I work...

warner25 4y ago
Yeah, I actually find it really disconcerting. It's one thing when you read mainstream news stories and see that they're inaccurate; like, "OK, sure the writer is a journalist, obviously not a specialist in this area, and the intended audience is also comprised of non-specialists." But reading HN makes me feel very inadequate 99% of the time, in terms of my knowledge of the computing domain. Then every few months I see a thread about some specific thing that I feel quite comfortable with and it's like, "What on earth? I thought these people were all smarter than me, but look at these comments..." I'm currently a PhD student doing research related to Tor, and there was a thread about Tor last month. I didn't even know where to start with the comments, so I didn't participate at all.

billythemaniam 4y ago

I don't think it is necessary to understand how the internet works technically to "understand the internet". It's like saying a race car driver can't drive fast without understanding the physics of a piston.

tristor 4y ago
I get what you're saying, but I think you might be missing the point that I'm making. DNS and BGP aren't JUST technical, they're also deeply geopolitical. The Internet isn't an accident, it's an intentionally and carefully formed set of peer autonomous networks, with a shared protocol and written (and unwritten) rules for how we name and resolve the path to get to those different networks from one another. These standards, the technical implementation of them, and how they interact with the real world is actually deeply geopolitical as well as socioeconomic. It's not just understanding how it works technically, it's understanding how it works from a policy, standardization, and governance perspective. Just like the law, how we arrived at the particular standards and policies informs the context for decisions we make about the technology and how its implemented. Even then, without an understanding of how it works technically, it's not possible to responsibly and accurately adjudicate the law as it relates to these technologies. How BGP and DNS work is actually front and center in many court cases, where the decision rested on a basic misunderstanding, which rendered the outcome either ineffective or unjust. Think of all the cases where DNS blocking is utilized on a court order, not realizing that this is effectively meaningless and is not actually effective. People don't often understand how deep this rabbit hole goes, even technical people who understand the basics of routing. They don't actually understand what a "peering agreement" means, especially what it means when it crosses an international border. The way that the law interacts with the Internet is an integration point that has an especially high level of complexity, and nearly no-one involved in that complexity in our current system day to day is actually qualified to discuss it. When we have failures in this integration point is has deep reaching impacts that have broad implications for how technology continues to develop into the future, and there are both positive and negative consequences for this. As a simple example, the stupidity with courts and DNS blocking and the way in which some governments around the world behave in relation to DNS is actually a core reason why DoH and DoT exist, because misapplication of law based on misunderstanding of technology risked fundamentally breaking the basic building blocks of the Internet required for it to function and for networks to successfully interoperate, so the people who actually understand how it works had to come up with new technology to "route around" stupidity in legislatures and courts around the world. These new technologies /themselves/ have geopolitical consequences (see UK and EU stupidity regarding crypto and its implications for DoH and DoT). It's not JUST understanding the technology, there's the 0th layer and the 8th layer in the reference model.

yamtaddle 4y ago

Do you thing Cisco router configurations of BGP or whatever have anything to do with how this case is going to be decided? I'm pretty sure that's not what was meant by "understand the Internet", in this context.

tristor 4y ago
This particular case? No. Many other cases, yes. I think there is a severe lack of understanding in the court system at every level, not just with BGP.

pixl97 4y ago

>EVEN technical people, don't actually understand the Internet Didn't Isaac Asimov write a documentary on this call 'Foundation'?