4 ms·
It's probably a good idea for all IT people to have a working knowledge of how to debug DNS issues. DNS has historically been a vector for significant security
by gunapologist99 3y ago
It's probably a good idea for all IT people to have a working knowledge of how to debug DNS issues.
DNS has historically been a vector for significant security holes and it's likely that this will continue to be true for the indefinite future. These holes also lead to other vectors in nearly every other protocol like SMTP. Even the CA system used for HTTPS is highly dependent on a basically insecure protocol. (Would you notice if your bank bought a DV certificate instead of OV? likely not)
So, perhaps it's not such a bad thing that it seems hard to learn to those who don't have enough interest, since even now we see people building DNS things without taking the time to really understand the history of things like port randomization, cache poisoning, AXFR, etc.
- dgb23 3y agoIt seems to me that everything which broadcasts/asserts routing decisions in a network (any layer) is deceptively simple and potentially dangerous.
- chasd00 3y ago> deceptively simple and potentially dangerous Also, there's not a lot of people keeping the whole thing running. iirc there's only like 13 or 14 root DNS servers on earth.
- gloria_mundi 3y agoThere are 13 root name server addresses, but most (all?) of these use anycast, i.e. there are actually several servers with the same address, and your traffic will usually be routed to the one closest to you. There are over 1500 root name servers. https://wikipedia.org/wiki/Root_name_server https://wikipedia.org/wiki/Root_name_server