7 ms·

This protocol/standard vs implementation is not uncommon. BIND was synonymous with DNS for a long time, to the point that I'd argue that some of the things spec

by js2 4y ago

This protocol/standard vs implementation is not uncommon. BIND was synonymous with DNS for a long time, to the point that I'd argue that some of the things specified in the DNS RFCs should have been considered BIND-specific implementation details. For example, RFC 1035 specifies the syntax of zone files used by BIND. I'd argue that even AXFR (zone transfers) as a replication mechanism should have been a BIND implementation detail.

tptacek 4y ago
This was Daniel Bernstein's argument, back when he was doing djbdns, and I believe it got him kicked off the IETF DNS list (he was, in this one instance, correct; I'm still confused about why zone files are a part of the DNS standard).
- AceJohnny2 4y ago
  djb is a great lesson in how "being an asshole" can be counterproductive.
  - akira2501 4y ago
    > counterproductive If the goal of a committee member is merely to be included in the committee. Otherwise, if the committee is merely operating as a rubber stamp for every one of it's members proposals, then there may not be much productive value in remaining there. Apparently that feeling was mutual.
    - imwillofficial 4y ago
      There is a middle ground to he found, in upholding high standards without getting kicked off the team
      - 1letterunixname 4y ago
        True. I think perhaps the model of IETF design-by-committee, with giant industry players who wish to sink specifications under the weight of risky and unnecessary features, is much like the "too many cooks" problem. It's better to have smaller groups of renowned experts create minimal protocols rather than force another ASN.1 or IPsec on the world.
        tptacek 4y ago
        I don't really think that stereotype holds, and, especially in the DNS case, it often seemed like random university IT administrators were the people monkeywrenching the specifications.
        ggm 4y ago
        ASN.1 is tiny. It's the encoding rules which add complications.
        pixl97 4y ago
        The rules for a turing machine are tiny... it's potential output is not. When you're looking for a small subset of well defined behaviors in order to maintain compatibility and application security those complications matter a lot.
        cryptonector 4y ago
        The IETF does not force ASN.1 on anyone. There are many Internet protocols (i.e., with RFCs published by the IETF) that use things other than ASN.1, such as, for example: - lots of protocols like HTTP and SMTP that use ABNF and text, - protocols like DNS, SSHv2, and TLS that use ad-hoc syntax and encoding, - NFSv4 (which uses ONC RPC), - protocols like XMPP that use XML and many others. The IETF doesn't care very much about those details because by the time a protocol has been brought to them for standardization it's already too late to insist on radical changes unless those radical changes are necessary to make the protocol secure or otherwise viable on the Internet.
        tptacek 4y ago
  - 0xdeadbeefbabe 4y ago
    Seems most counterproductive if you lose.
  - cvalka 4y ago
    DJB is a gift to humanity.
  - riceart 4y ago
    As if djb not being an asshole would have saved the IETF from their incompetent buffoonery. Yeah let’s just blame it all on one guy for not being a sycophant rather than lay the responsibility on the actual buffoons.
  - 1letterunixname 4y ago
    Other than source-less reputation bashing / gossip, are instances of poor behavior? Also consider TdR of OpenBSD and OpenSSH has been polarizing but impactful.
    - tptacek 4y ago
      I think the track records are tellingly comparable.
  - dehrmann 4y ago
    Sounds like Theo de Raadt.
  - Intermernet 4y ago
    Except that a huge amount of the world runs on cryptography designed by him, because all the standards committees and government orgs are somehow less trustworthy than this "asshole".
    - 1vuio0pswjnm7 4y ago
      djb is like a litmus test. How someone reacts to him can reveal whether that person is someone who thinks they are smarter than they really are, a personality type that is common amongst software developers. These are the type of people who cannot admit when they are wrong, and will never admit that they are incompetent. Arguably, it is because of such people that we are drowning in crappy software, and even worse, that crappy software is popular. IMHO, djb is on the side of the user, whether intentionally or not. djbdns allowed me, a user, to take control of DNS on the networks and computers I own. The philosophy of BIND at the time felt like "DNS is for DNS experts. We're experts. Do as we tell you."^1 I also learned nsd so I do use BIND zone file format. But I never became a BIND user. 1. I see a parallel in the context of "certificate authorities". Nothing wrong with "CAs" in theory but in practice, i.e., commercialisation of certificates and browser-centricity, the system reeks. Pay to play, or at least mandatory third party intermediaries, and generally user hostile.
      - akerl_ 4y ago
        I think it might be dangerous to elevate people in this way. Probably djb is a human, who doesn’t represent a dowsing rod for your evaluation of the world.
- throwawayapples 4y ago
  only this one instance? what about port randomization or Curve25519?
  - tptacek 4y ago
    Like everyone else, he's right sometimes and wrong others.
    - aflag 4y ago
      The two examples above are cases where he was correct actually.
      - tptacek 4y ago
        See previous statement.
- kiwijamo 4y ago
  I think it's good that there's a standard for zone files. I've migrated from one dns server to another and being able to just carry over the same zone files has been useful. I also for some time had a master using one dns software and slaves using different software (as part of a mirgariton keeping a known good server using the old software and moving others to the new software and testing to ensure both were producing the same responses). Had zone transfers not been standardised I would not have been able to do this. I agree that perhaps the easy path of just adoptong the BIND implementation should not have happened but I would argue having a standard is better than just leaving it to hoping the implementation detail remains compatible between different software.
  - tptacek 4y ago
    It's absolutely useful to have a standard form for DNS zone files; it just shouldn't be a part of the DNS standard. There's no scarcity of RFC numbers, and zone files should be a separate, optional RFC. (They're practically obsolete now, so there isn't much uncertainty about who had the better side of this argument.)
    - AndyMcConachie 4y ago
      Not sure what you mean by obsolete. https://www.internic.net/domain/root.zone https://www.internic.net/domain/root.zone I agree that they are optional, but I wouldn't go so far to say they're obsolete.
      - tptacek 4y ago
        Anybody building a new DNS server at this point is going to back it with a database, not a bunch of text files.
        stevenjgarner 4y ago
        PowerDNS [1] has been doing that under the GPL since 2002, featuring a large number of different backends ranging from simple BIND style zonefiles to relational databases and load balancing/failover algorithms. [1] https://www.powerdns.com/ https://www.powerdns.com/
mlyle 4y ago
> I'd argue that even AXFR (zone transfers) as a replication mechanism should have been a BIND implementation detail. AXFR has been valuable for interop, though, and allows you to have diverse implementations of authoritative servers.
fanf2 4y ago
The syntax of zone files originally came from JEEVES, not BIND. It’s implemented by most other DNS software, and is not at all specific to BIND. Same for AXFR and other parts of the DNS protocol.

by js2 4y ago

tptacek 4y ago

This was Daniel Bernstein's argument, back when he was doing djbdns, and I believe it got him kicked off the IETF DNS list (he was, in this one instance, correct; I'm still confused about why zone files are a part of the DNS standard).

AceJohnny2 4y ago
djb is a great lesson in how "being an asshole" can be counterproductive.
- akira2501 4y ago
  > counterproductive If the goal of a committee member is merely to be included in the committee. Otherwise, if the committee is merely operating as a rubber stamp for every one of it's members proposals, then there may not be much productive value in remaining there. Apparently that feeling was mutual.
  - imwillofficial 4y ago
    There is a middle ground to he found, in upholding high standards without getting kicked off the team
    - 1letterunixname 4y ago
      True. I think perhaps the model of IETF design-by-committee, with giant industry players who wish to sink specifications under the weight of risky and unnecessary features, is much like the "too many cooks" problem. It's better to have smaller groups of renowned experts create minimal protocols rather than force another ASN.1 or IPsec on the world.
      - tptacek 4y ago
        I don't really think that stereotype holds, and, especially in the DNS case, it often seemed like random university IT administrators were the people monkeywrenching the specifications.
      - ggm 4y ago
        ASN.1 is tiny. It's the encoding rules which add complications.
        pixl97 4y ago
        The rules for a turing machine are tiny... it's potential output is not. When you're looking for a small subset of well defined behaviors in order to maintain compatibility and application security those complications matter a lot.
      - cryptonector 4y ago
        The IETF does not force ASN.1 on anyone. There are many Internet protocols (i.e., with RFCs published by the IETF) that use things other than ASN.1, such as, for example: - lots of protocols like HTTP and SMTP that use ABNF and text, - protocols like DNS, SSHv2, and TLS that use ad-hoc syntax and encoding, - NFSv4 (which uses ONC RPC), - protocols like XMPP that use XML and many others. The IETF doesn't care very much about those details because by the time a protocol has been brought to them for standardization it's already too late to insist on radical changes unless those radical changes are necessary to make the protocol secure or otherwise viable on the Internet.
        tptacek 4y ago
- 0xdeadbeefbabe 4y ago
  Seems most counterproductive if you lose.
- cvalka 4y ago
  DJB is a gift to humanity.
- riceart 4y ago
  As if djb not being an asshole would have saved the IETF from their incompetent buffoonery. Yeah let’s just blame it all on one guy for not being a sycophant rather than lay the responsibility on the actual buffoons.
- 1letterunixname 4y ago
  Other than source-less reputation bashing / gossip, are instances of poor behavior? Also consider TdR of OpenBSD and OpenSSH has been polarizing but impactful.
  - tptacek 4y ago
    I think the track records are tellingly comparable.
- dehrmann 4y ago
  Sounds like Theo de Raadt.
- Intermernet 4y ago
  Except that a huge amount of the world runs on cryptography designed by him, because all the standards committees and government orgs are somehow less trustworthy than this "asshole".
  - 1vuio0pswjnm7 4y ago
    djb is like a litmus test. How someone reacts to him can reveal whether that person is someone who thinks they are smarter than they really are, a personality type that is common amongst software developers. These are the type of people who cannot admit when they are wrong, and will never admit that they are incompetent. Arguably, it is because of such people that we are drowning in crappy software, and even worse, that crappy software is popular. IMHO, djb is on the side of the user, whether intentionally or not. djbdns allowed me, a user, to take control of DNS on the networks and computers I own. The philosophy of BIND at the time felt like "DNS is for DNS experts. We're experts. Do as we tell you."^1 I also learned nsd so I do use BIND zone file format. But I never became a BIND user. 1. I see a parallel in the context of "certificate authorities". Nothing wrong with "CAs" in theory but in practice, i.e., commercialisation of certificates and browser-centricity, the system reeks. Pay to play, or at least mandatory third party intermediaries, and generally user hostile.
    - akerl_ 4y ago
      I think it might be dangerous to elevate people in this way. Probably djb is a human, who doesn’t represent a dowsing rod for your evaluation of the world.
throwawayapples 4y ago
only this one instance? what about port randomization or Curve25519?
- tptacek 4y ago
  Like everyone else, he's right sometimes and wrong others.
  - aflag 4y ago
    The two examples above are cases where he was correct actually.
    - tptacek 4y ago
      See previous statement.
kiwijamo 4y ago
I think it's good that there's a standard for zone files. I've migrated from one dns server to another and being able to just carry over the same zone files has been useful. I also for some time had a master using one dns software and slaves using different software (as part of a mirgariton keeping a known good server using the old software and moving others to the new software and testing to ensure both were producing the same responses). Had zone transfers not been standardised I would not have been able to do this. I agree that perhaps the easy path of just adoptong the BIND implementation should not have happened but I would argue having a standard is better than just leaving it to hoping the implementation detail remains compatible between different software.
- tptacek 4y ago
  It's absolutely useful to have a standard form for DNS zone files; it just shouldn't be a part of the DNS standard. There's no scarcity of RFC numbers, and zone files should be a separate, optional RFC. (They're practically obsolete now, so there isn't much uncertainty about who had the better side of this argument.)
  - AndyMcConachie 4y ago
    Not sure what you mean by obsolete. https://www.internic.net/domain/root.zone https://www.internic.net/domain/root.zone I agree that they are optional, but I wouldn't go so far to say they're obsolete.
    - tptacek 4y ago
      Anybody building a new DNS server at this point is going to back it with a database, not a bunch of text files.
      - stevenjgarner 4y ago
        PowerDNS [1] has been doing that under the GPL since 2002, featuring a large number of different backends ranging from simple BIND style zonefiles to relational databases and load balancing/failover algorithms. [1] https://www.powerdns.com/ https://www.powerdns.com/

mlyle 4y ago

> I'd argue that even AXFR (zone transfers) as a replication mechanism should have been a BIND implementation detail. AXFR has been valuable for interop, though, and allows you to have diverse implementations of authoritative servers.

fanf2 4y ago

The syntax of zone files originally came from JEEVES, not BIND. It’s implemented by most other DNS software, and is not at all specific to BIND. Same for AXFR and other parts of the DNS protocol.