3 ms·

Not sure if you’re being sarcastic. In my experience DNS is probably in the top 2-3 causes of global outages at large internet tech companies. It is a giant SP

by nvarsj 3y ago

Not sure if you’re being sarcastic. In my experience DNS is probably in the top 2-3 causes of global outages at large internet tech companies. It is a giant SPOF in most services, often having many hidden dependencies. I can generally tell the maturity of a service based on whether it has stopped using DNS in favour of anycast or static IP lists.

pixl97 3y ago
Eh, you can also tell the size and scaling of a service if it went to static list, and I'd say pretty damned small. Most problems with DNS are ones of dependency loops from cold start conditions. It's kinda difficult to blame DNS on bad design. Edit: Oh, anycast routing at IP level...Also, anycast is DNS, so I'm not sure how anycast saves you from DNS?
- cuu508 3y ago
  > Also, anycast is DNS, so I'm not sure how anycast saves you from DNS? Are you sure about that? I thought anycast is a routing methodology where many servers share a single IP (example: 1.1.1.1).
tambourine_man 3y ago
Not sarcastic at all. DNS solves a difficult problem (decentralized identity) in a deceptively simple way. We have the “it was DNS” joke because it’s a hard problem with lots of unforeseeable edge cases, not because DNS is poorly designed.
crote 3y ago
How many of those are due to companies trying to do weird things with DNS, though? DNS itself is quite well-designed for its age. It is decentralized, so there is no single-point-of-failure. A request can fit in a single UDP package, so load balancing is trivial. A response can contain multiple records, making it possible to use it for load balancing or failover. The format is designed to be extensible, so it can be used for more than just the original few applications. It is definitely showing its age when it comes to privacy and security, though. Can a failure of an authoritative DNS server bring down a website? Absolutely! Set a short TTL and bring down the servers due to fatfingering a config, and your website will go offline. But you can hardly blame DNS itself for that.
- nvarsj 3y ago
  What do you mean it's decentralised? It's a central service you have to query for name->IP lookup, with authoritative name servers for every domain. It's the very definition of centralised. Just because it's hierarchical doesn't mean it's not centralised. A decentralised DNS system would be more like a p2p network where you can perform name lookups from any participant in the system. Companies aren't trying to do anything weird with DNS. It's just how most things work in service architectures. Every network query will start with a DNS query. You might depend on 50 services, with circuit breakers and all kinds of great logic so a single service won't bring you down - but there is that DNS lookup which will break everything if it fails.
hot_gril 3y ago
This doesn't mean that DNS is a bad example for a distributed system. But I appreciate the anecdote of DNS being a common spof.
jeroenhd 3y ago
Almost every service or website uses DNS. DNS load balancing is problematic and anycast is a much better solution for services that need that level of traffic management, but that's not DNS' fault. DNS is meant to be "computer A asks computer B what the IP address of google.com is", not "five million computers on five continents all need to be grouped into ten different groups based on nearest subnet and directed to a randomly organised list of servers", even if it does technically work.

by nvarsj 3y ago

pixl97 3y ago

Eh, you can also tell the size and scaling of a service if it went to static list, and I'd say pretty damned small. Most problems with DNS are ones of dependency loops from cold start conditions. It's kinda difficult to blame DNS on bad design. Edit: Oh, anycast routing at IP level...Also, anycast is DNS, so I'm not sure how anycast saves you from DNS?

cuu508 3y ago
> Also, anycast is DNS, so I'm not sure how anycast saves you from DNS? Are you sure about that? I thought anycast is a routing methodology where many servers share a single IP (example: 1.1.1.1).

tambourine_man 3y ago

Not sarcastic at all. DNS solves a difficult problem (decentralized identity) in a deceptively simple way. We have the “it was DNS” joke because it’s a hard problem with lots of unforeseeable edge cases, not because DNS is poorly designed.

crote 3y ago

How many of those are due to companies trying to do weird things with DNS, though? DNS itself is quite well-designed for its age. It is decentralized, so there is no single-point-of-failure. A request can fit in a single UDP package, so load balancing is trivial. A response can contain multiple records, making it possible to use it for load balancing or failover. The format is designed to be extensible, so it can be used for more than just the original few applications. It is definitely showing its age when it comes to privacy and security, though. Can a failure of an authoritative DNS server bring down a website? Absolutely! Set a short TTL and bring down the servers due to fatfingering a config, and your website will go offline. But you can hardly blame DNS itself for that.

nvarsj 3y ago
What do you mean it's decentralised? It's a central service you have to query for name->IP lookup, with authoritative name servers for every domain. It's the very definition of centralised. Just because it's hierarchical doesn't mean it's not centralised. A decentralised DNS system would be more like a p2p network where you can perform name lookups from any participant in the system. Companies aren't trying to do anything weird with DNS. It's just how most things work in service architectures. Every network query will start with a DNS query. You might depend on 50 services, with circuit breakers and all kinds of great logic so a single service won't bring you down - but there is that DNS lookup which will break everything if it fails.

hot_gril 3y ago

This doesn't mean that DNS is a bad example for a distributed system. But I appreciate the anecdote of DNS being a common spof.

jeroenhd 3y ago

Almost every service or website uses DNS. DNS load balancing is problematic and anycast is a much better solution for services that need that level of traffic management, but that's not DNS' fault. DNS is meant to be "computer A asks computer B what the IP address of google.com is", not "five million computers on five continents all need to be grouped into ten different groups based on nearest subnet and directed to a randomly organised list of servers", even if it does technically work.