TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

It is always the DNS

67 pointsby conductorover 3 years ago

6 comments

tptacekover 3 years ago
I propose we stop attributing to DNS reliability problems caused by DNSSEC. It&#x27;s not fair to DNS, which gets a bad rap already.<p>The bug here as I understand it: this hosting provider has a client whose DNS authority server DNSSEC-signs their records. That server is misconfigured.<p>When you look up a nonexistent record in DNS, you get a simple response back that says there aren&#x27;t any matching records. Easy enough!<p>But you can&#x27;t do that in DNSSEC, because denial &quot;needs&quot; to be signed. What DNSSEC does instead is essentially return a descriptor of a lexicographically ordered span of records that <i>does</i> exist, and doesn&#x27;t include the record you were looking for. You notice that, and interpret as denial. See, simple! Oh, also, the names in those records are password-hashed, because otherwise DNSSEC would be publishing raw zone dumps to serve errors. Except those password hashes are very straightforwardly cracked. But I digress. The records carrying these spans in modern servers are called NSEC3s. Think of a tuple (start-name, stop-name, record-types).<p>If you asked this client&#x27;s server for a nonexistent A record, you&#x27;d get an NSEC3 back that properly established the covering span of names in which A was nonexistent --- but it erroneously signaled that other record types for that span (most notably MX) were also nonexistent.†<p>The fun part of this bug is that it&#x27;s effectively a vulnerability: an attacker can query random recursive caches for nonexistent record types to generate a cached denial records for records that <i>do</i> exist. Which is not something that can&#x27;t go wrong in ordinary unsigned DNS! It&#x27;s a vulnerability that DNSSEC <i>adds</i> to the DNS.<p>This is your periodic reminder that virtually none of the industry&#x27;s largest tech companies (and concomitantly well-resourced security teams) use DNSSEC, which you can confirm quickly for yourself by running `host -t ds &lt;domain&gt;` and noting that they don&#x27;t have DS records.<p>Previous (recent) thread, in which DNSSEC blew up (checks notes) all of Slack: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29378633" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=29378633</a><p>† <i>(If I&#x27;ve got the particulars of this wrong, that makes it even funnier, since it&#x27;s suggesting that it&#x27;s difficult even to describe what can go wrong with DNSSEC).</i>
评论 #29426296 未加载
评论 #29427184 未加载
评论 #29425803 未加载
wruzaover 3 years ago
DNS issues rumors&#x2F;news always puzzled me (not that I ever made my honest research). Domains name system is to me basically a half-replicated&#x2F;half-redirected database of {domain-name : categorized-ip-list}. Can someone please ELI5 why can’t we just GET <a href="https:&#x2F;&#x2F;&lt;dns-ip-and-its-cert-from-dhcp&gt;&#x2F;get-ips?d=&lt;domain&gt;" rel="nofollow">https:&#x2F;&#x2F;&lt;dns-ip-and-its-cert-from-dhcp&gt;&#x2F;get-ips?d=&lt;domain&gt;</a>, follow 3xx, get json and that’d be it?<p>This question lies in the same category of questions which I’ve never managed to get answers to. Why <i>fetching</i> email over https is instant, but over imap it may take minutes to “sync” (or what it does there)? Why browsing is instant, but ftp was dead slow? Why all the formats (mailbox, uue, etc), when you could have a proper database with column encodings? I’m not asking anyone to answer these, cause it would be too offtopic, but these arcane issues have never left me alone.<p>I understand that most of it is historical, but what the heck, internet.
评论 #29427095 未加载
评论 #29427025 未加载
评论 #29426827 未加载
throwaway984393over 3 years ago
It seems like the world today operates mostly on technology that is replaced every 3 years, so nothing new ever becomes a standard. It&#x27;s so wonderful when I need to interface with a standard internet protocol and it works the same way it used to.<p>Last year my company decided to move one of its public services to a new hosted vendor and change their domains entirely. This would involve (among other things) changing the domain that customers were using and changing live traffic to point from one vendor to another. Of course nobody budgeted for any downtime, and the system was so little-known that it would have taken forever to figure out what all would be affected by a maintenance window. A less experienced engineer might consider this trivial; just change the DNS records and flip from one live system to another. Easy, right?<p>Luckily, something like 15 years before, I had managed (among other things) DNS records for a large internet site. Because we were essentially hand-crafting Bind zone files and making all sorts of weird changes to tons of records, I learned all about the DNS ecosystem. I learned about all the different layers of the stack, all the different forms of caching, the common problems (UDP vs TCP, EDNS0, firewalls, Apex record limitations, negative cache, ignored TTL), spam features, service identifiers, XFERs, and the fact that there&#x27;s a dozen different RFCs all laid on top of each other to form &quot;the DNS protocol&quot;.<p>Keeping in mind all the potential problems, I was able to plan our migration steps thoroughly enough for the 144-hour-long change window. I knew to prepare my SOA, NS, A &amp; CNAME changes, verify the records on the nameservers (and from client devices) pre-change, wait 2 days after changing the TTL limit, verify with resolvers around the world to confirm everything was picked up, and validate on each device that the change worked correctly. The process worked beautifully and the customers never noticed a thing. And if there had been a problem, my changes would have resulted in no more than about 60 seconds downtime.<p>What struck me at the end wasn&#x27;t how much bizarrely complex and deep knowledge was required just to make the switch-over successful. It was that I had learned everything I needed to know 15 years before, and all that technical knowledge remained the same. I think that&#x27;s only happened one or two other times in my career (one related to TCP weirdness, another related to C programming)
ate53over 3 years ago
What was the implementation that produced the bad NSEC3 proofs?
geocrasherover 3 years ago
Obligatory DNS Song reference: <a href="https:&#x2F;&#x2F;soundcloud.com&#x2F;ryan-flowers-916961339&#x2F;dns-to-the-tune-of-let-it-be" rel="nofollow">https:&#x2F;&#x2F;soundcloud.com&#x2F;ryan-flowers-916961339&#x2F;dns-to-the-tun...</a>
abagheri43over 3 years ago
oh yes . a good nese