m3047

74 ms·

781.
by m3047 6y ago
I agree, I upvoted it because it's better technically than some of the others I've seen recently. But having DNS and HTTP conceptually jammed sideways into the networking stack makes my head hurt. You're also correct about th
782.
Show HN: Rust (PyO3) deserializer callable from Python(github.com)
1 points by m3047 6y ago|0 comments
783.
by m3047 6y ago
The article is factually wrong about DNS over TLS. The article states: "DoT adds TLS encryption on top of the user datagram protocol (UDP)...". In fact, it uses TCP which is also an acceptable protocol for DNS queries. It encapsul
784.
by m3047 6y ago
Tip o' th' hat to Ken Hansen @ Neustar for bringing this to my attention. The author, Geoff Huston, is a credible observer.
785.
A Deeper Dive into DNS over HTTP or TLS and Impacts on the Ecosystem(blog.apnic.net)
1 points by m3047 6y ago|1 comments
786.
by m3047 6y ago
I grow sprouts on my kitchen counter. Mostly they require lavage. For the last day or two they require light to turn green and possibly develop flavor; they don't need much.
787.
by m3047 6y ago
I'm not going to provide a source, but my understanding is that one square meter can provide roughly 1 KW of electricity at noon on the equator. Looks like that's about 4MW per acre. Five acres for the "traditional" fami
788.
by m3047 6y ago
What about goats with earphones, trained to stimuli? I'm not actually "rural", but I have chickens. (One of which is 10 years old!) There is such a thing as a "judas goat"; or "judas chicken". I've be
789.
by m3047 6y ago
I bookmarked that site, I hope they keep posting.
790.
by m3047 6y ago
The DNS already supports NOTIFY, which is a push notification for updates to a zone (this is something set up by the operators of the auth servers, typically for mirrors/secondaries so that they know when to request a zone transfer); t
791.
by m3047 6y ago
> So in worst case scenario for a recursive resolver in EU tries a DNS server in USA, and it happens to be down, and then gives up. Recursive resolving algorithm for caching servers is actually addressed in the RFCs, it /should&#x2F
792.
by m3047 6y ago
> But most domains eg. websites dont have Anycast. Are you talking about the (mathematical) "domain" in the DNS specs, or the popular domain i.e. the web server? The latter is arguably true, in which case the geoip proposition
793.
by m3047 6y ago
> port 852 Typo, meant 853.
794.
by m3047 6y ago
Yeah, flushing the cache in your own recursive resolver doesn't flush them all over the internet.
795.
by m3047 6y ago
Thow off the chains of victimhood and run your own caching resolver: flush cache anytime you want!
796.
by m3047 6y ago
My favorite dig trick is asking caching resolvers with +norecurse to see what's in the cache. Of course some resolvers don't honor it, just like they don't support ANY.
797.
by m3047 6y ago
Those are IP packet TTLs. Also useful in some cases for diagnosing mysterious RSTs and SYNs. Also useful in some cases to purposefully set low if there is route flapping.
798.
by m3047 6y ago
Unless you're using DoH, in most cases the browser is using the device's stub resolver just like all other apps on the device.
799.
by m3047 6y ago
Why doesn't a stub resolver do this, and try (plain) TCP and DoT (port 852) opportunistically while it's at it: you know, good for the whole device?
800.
by m3047 6y ago
A lot of DNS infrastructure is anycast.
801.
by m3047 6y ago
Perfect example. :-) There's not enough information to make a considered response, unless you've got a history of opening TCP connections to them to base a decision on. Don't get me wrong, I think stub resolver logic is stuck
802.
by m3047 6y ago
> [...] I wish DNS had some way to define a load balancing algorithm for clients to use, so browsers could make load balancing decisions. There's actually the germ of an interesting idea in that statement. If I'm going to go to
803.
by m3047 6y ago
DNS has its own load balancing at several levels (and several different kinds): Nameserver records (NS records) used to locate a resource are served by other nameservers. NS records are chosen from among those offered in response to a query
804.
by m3047 6y ago
I posted this as an "Ask HN" and it sank like a lead zeppelin. Here's working TCP-only forwarder code.
805.
Show HN: DNS over Plain Old TCP (DoPT)(github.com)
2 points by m3047 6y ago|1 comments
806.
Ask HN: If DNS over TLS/HTTP(S) work better is it becase TCP?
1 points by m3047 6y ago|0 comments
807.
by m3047 6y ago
Apropos past issues with Zoom installing a local server, this is important to consider.
808.
by m3047 6y ago
Audit logging for DNS is generally poorly done. When Vixie's hair was on fire about DoH last summer I wrote this: https://github.com/m3047/shodohflo/ Look in app/ for a screenshot. Needs access to a recu
809.
by m3047 6y ago
> As someone who works in academia I wouldn't blame or ride on academia. If you have no data worth exfiltration, experiments worth sabotaging or industry affiliations you might be right.
810.
by m3047 6y ago
> DNS over HTTPS (DoH), on the other hand, rides on HTTPS/port 443, which cannot be blocked in networks without causing major disruptions... And your point is what, exactly? TLS allows for traffic redirection and for a time people w

More ›