2 ms·

No, it isn’t. DNS converts domain names to IP addresses. All you are doing here is saying you don’t want to talk to certain domain names. That’s not hacking; t

by borski 2y ago

No, it isn’t. DNS converts domain names to IP addresses. All you are doing here is saying you don’t want to talk to certain domain names. That’s not hacking; that’s literally how DNS works and what it is for. You are using it for its intended purpose, which is to map domain names to IP addresses. What those IP addresses are often changes and is dependent on the network, which is why organizations have internal DNS servers.

TZubiri 2y ago
I guess it comes down to subjective definitions and semantics. I get that DNS works by converting domains to ips, I've implemented DNS server protocol in C. Whenever you 'hack' something, you can always frame it in terms of its intended purpose. You are not hacking the ping binary to ddos a website, you are merely configuring it to send ICMP packets of 1TB of size at a very high frequency. In this case DNS is originally a mechanism to convert hierarchical numerical ip adresses with geographical info, to human memorable textual names. It serves a role of helping humans memorize, of providing textual names to servers. When you use it as a firewall tool, it is not its intended purpose, I'm not against it, in fact I think dns based firewalls are great, especially at the state level. But they are strictly a creative usage of a protocol that was not designed for that purpose, and its an additive modification, you add a blacklist to a DNS that has all of the addresses and you filter some out. Therefore, it is two things, a DNS and a firewall. The firewall is not a DNS, it's a domain based blacklist something else.
- borski 2y ago
  By your definition, every CDN is a hack, which is absurd on its face. Your assertion that "DNS is originally a mechanism to convert hierarchical numerical ip adresses with geographical info" is incorrect; geography has nothing to do with it. It does convert memorable names to IP addresses, but what those IP addresses are and where they are has nothing to do with DNS. Is Dynamic DNS a hack, if you have a dynamic IP and the DNS map changes every time your IP updates? If you set up a public DNS server to serve internal addresses that nobody else can access unless they're on your internal network, is that a hack? No, it's literally just using DNS.
  - TZubiri 2y ago
    >Your assertion that "DNS is originally a mechanism to convert hierarchical numerical ip adresses with geographical info" is incorrect; geography has nothing to do with it. Your assertion that my assertion is incorrect is incorrect, maybe your understanding of the subject matter is restricted to textbook definitions and you can't handle words and definitions in an order that is different than the intro sentence on the wikipedia page for DNS. IP addresses contain geographic information (hierarchically), maybe reread my sentence. Incidentally domains also contain geographical information, albeit strictly of the domains. See all TLDs, and even non-TLDs like .COM and inevitably linked to a geography and jurisdiction, namely VeriSign (which is the TLD registrar) is a US company and is the ultimate authority for those records. >By your definition, every CDN is a hack. I'm not exactly sure how CDNs operate, my understanding is that they host the same data on multiple locations on the globe and redirct to the nearest location? They use domains to route to the nearest ip, and use HTTP mechanisms for explicitly proxying content. Seems like all is used as design. The only exception would be if a single IP address points to multiple geodistributed servers like 8.8.8.8, that is indeed a hack. >Is Dynamic DNS a hack Yes, god, yes. It's also something no reputable sysadmin or programmer does. It's a technique used by people who can't afford a domain name, or convince an ISP to unblock their ports. > If you set up a public DNS server to serve internal addresses that nobody else can access unless they're on your internal network, is that a hack? I don't think so, no. Counterpoint. If a DNS server converts empty responses into an ad server (dsajndjandsa.com redirects to ISP's page with ads), is that a hack? Hint it's not theoretical, actually happened. It's similar to an ad blocking DNS, but in the inverse, it's an ad adding DNS. If your answer is different, it's because your definition of a hack is loaded with your ethical position.

by borski 2y ago

TZubiri 2y ago

I guess it comes down to subjective definitions and semantics. I get that DNS works by converting domains to ips, I've implemented DNS server protocol in C. Whenever you 'hack' something, you can always frame it in terms of its intended purpose. You are not hacking the ping binary to ddos a website, you are merely configuring it to send ICMP packets of 1TB of size at a very high frequency. In this case DNS is originally a mechanism to convert hierarchical numerical ip adresses with geographical info, to human memorable textual names. It serves a role of helping humans memorize, of providing textual names to servers. When you use it as a firewall tool, it is not its intended purpose, I'm not against it, in fact I think dns based firewalls are great, especially at the state level. But they are strictly a creative usage of a protocol that was not designed for that purpose, and its an additive modification, you add a blacklist to a DNS that has all of the addresses and you filter some out. Therefore, it is two things, a DNS and a firewall. The firewall is not a DNS, it's a domain based blacklist something else.

borski 2y ago
By your definition, every CDN is a hack, which is absurd on its face. Your assertion that "DNS is originally a mechanism to convert hierarchical numerical ip adresses with geographical info" is incorrect; geography has nothing to do with it. It does convert memorable names to IP addresses, but what those IP addresses are and where they are has nothing to do with DNS. Is Dynamic DNS a hack, if you have a dynamic IP and the DNS map changes every time your IP updates? If you set up a public DNS server to serve internal addresses that nobody else can access unless they're on your internal network, is that a hack? No, it's literally just using DNS.
- TZubiri 2y ago
  >Your assertion that "DNS is originally a mechanism to convert hierarchical numerical ip adresses with geographical info" is incorrect; geography has nothing to do with it. Your assertion that my assertion is incorrect is incorrect, maybe your understanding of the subject matter is restricted to textbook definitions and you can't handle words and definitions in an order that is different than the intro sentence on the wikipedia page for DNS. IP addresses contain geographic information (hierarchically), maybe reread my sentence. Incidentally domains also contain geographical information, albeit strictly of the domains. See all TLDs, and even non-TLDs like .COM and inevitably linked to a geography and jurisdiction, namely VeriSign (which is the TLD registrar) is a US company and is the ultimate authority for those records. >By your definition, every CDN is a hack. I'm not exactly sure how CDNs operate, my understanding is that they host the same data on multiple locations on the globe and redirct to the nearest location? They use domains to route to the nearest ip, and use HTTP mechanisms for explicitly proxying content. Seems like all is used as design. The only exception would be if a single IP address points to multiple geodistributed servers like 8.8.8.8, that is indeed a hack. >Is Dynamic DNS a hack Yes, god, yes. It's also something no reputable sysadmin or programmer does. It's a technique used by people who can't afford a domain name, or convince an ISP to unblock their ports. > If you set up a public DNS server to serve internal addresses that nobody else can access unless they're on your internal network, is that a hack? I don't think so, no. Counterpoint. If a DNS server converts empty responses into an ad server (dsajndjandsa.com redirects to ISP's page with ads), is that a hack? Hint it's not theoretical, actually happened. It's similar to an ad blocking DNS, but in the inverse, it's an ad adding DNS. If your answer is different, it's because your definition of a hack is loaded with your ethical position.