4 ms·

It was an alternative DNS but I forgot which it was. You had to switch to these DNS servers, which the added "benefit" that DNS queries returning NXDOMAIN were

It was an alternative DNS but I forgot which it was. You had to switch to these DNS servers, which the added "benefit" that DNS queries returning NXDOMAIN were hijacked to show you ads. I don't think this has any usefulness anymore, since gTLDs exist.

donatj 3y ago
gTLDs cost hundreds of thousands of dollars. You can run your own DNS servers for waaay less. I think the usefulness could come from community controlled TLDs. Might not be a mainstream thing but free libre TLDs for open source projects and what not?
- Towaway69 3y ago
  Something similar to what Let's Encrypt did to the SSL Certificate market. Before they came along, SSL root certificate were way over priced and overnight, the market simply disappeared. The same should happen to gTLDs.
- Ayesh 3y ago
  IIRC, the cost is ~$200k one time and ~$25/yr. Shitcoins get magnitudes higher crowd funding. Not impossible to do at all.
- alfons_foobar 3y ago
  On a technical level, this is very simple - just change the list of DNS root servers on all "participating" machines to point to your own new nameservers. But then you have the problem: Who manages your community controlled domains? Who keeps track of who owns which domain?
jesprenj 3y ago
OpenNIC is a project that replaces and extends the official DNS root maintained by Verisign. http://opennic.org http://opennic.org
- Tijdreiziger 3y ago
  Are there any notable websites actually on that infrastructure? The ‘Project Showcase’ only shows a single example.
  - duskwuff 3y ago
    No. It's an old hobby project which has nearly fizzled out; the web site hasn't been updated in years. Alternate roots are on thin ice in general nowadays, especially as there's no reasonable way to safely issue TLS certificates for domains which aren't under the ICANN root. (Running your own CA introduces a lot of messy trust issues and is inadvisable.)
    - jesprenj 3y ago
      Maybe if we switched from the current state of PKI with CAs to DNSSEC and DANE/TLSA, it would be easier. But doing that would mean to either trust the current resolver you are using, which is unacceptable, as it's sometimes cloudflare or google, or running your own resolver on every device -- which also does not work. It is absolutely crucial for the DNS system we have today that there's a small number of resolvers that have large caches, otherwise root servers would blow up. Unless we massively start implementing some novel RFCs.

donatj 3y ago

gTLDs cost hundreds of thousands of dollars. You can run your own DNS servers for waaay less. I think the usefulness could come from community controlled TLDs. Might not be a mainstream thing but free libre TLDs for open source projects and what not?

Towaway69 3y ago
Something similar to what Let's Encrypt did to the SSL Certificate market. Before they came along, SSL root certificate were way over priced and overnight, the market simply disappeared. The same should happen to gTLDs.
Ayesh 3y ago
IIRC, the cost is ~$200k one time and ~$25/yr. Shitcoins get magnitudes higher crowd funding. Not impossible to do at all.
alfons_foobar 3y ago
On a technical level, this is very simple - just change the list of DNS root servers on all "participating" machines to point to your own new nameservers. But then you have the problem: Who manages your community controlled domains? Who keeps track of who owns which domain?

jesprenj 3y ago

OpenNIC is a project that replaces and extends the official DNS root maintained by Verisign. http://opennic.org http://opennic.org

Tijdreiziger 3y ago
Are there any notable websites actually on that infrastructure? The ‘Project Showcase’ only shows a single example.
- duskwuff 3y ago
  No. It's an old hobby project which has nearly fizzled out; the web site hasn't been updated in years. Alternate roots are on thin ice in general nowadays, especially as there's no reasonable way to safely issue TLS certificates for domains which aren't under the ICANN root. (Running your own CA introduces a lot of messy trust issues and is inadvisable.)
  - jesprenj 3y ago
    Maybe if we switched from the current state of PKI with CAs to DNSSEC and DANE/TLSA, it would be easier. But doing that would mean to either trust the current resolver you are using, which is unacceptable, as it's sometimes cloudflare or google, or running your own resolver on every device -- which also does not work. It is absolutely crucial for the DNS system we have today that there's a small number of resolvers that have large caches, otherwise root servers would blow up. Unless we massively start implementing some novel RFCs.