Dns is so broken in many different ways. It’s crazy it’s still the back bone of the internet when it’s insecure awful nonsense. It’s just ingrained.

Modern UDP-based protocols handle this in two ways. First, prefer to make responses no larger than the request, so there is no amplification.

Second, if the response has to be larger than the request, send the requestor an address-specific value in a small initial response, e.g. HMAC of a secret and the sender IP. Then any request that incurs a large response has to contain that value. If the sender is spoofing the IP address and can't receive the small response sent to that address, they can't cause a large response to be sent there.

This can't be done with DNS because of "security" middleboxes. They ossify the protocol because they reject anything they don't understand, and they don't understand new versions of the protocol even if both of the endpoints do. So the protocol gets frozen in time and no security improvements can be made because of the things that claim to be there to improve security.

That sounds like its time to push standards forward, announce deprecations in advance, and have as many end services as possible adopt erroring if what they are receiving isn't standards compliant.

There is little actual reason for security middleware to not keep up.

Everything is working as intended though: we're talking about security middleware, not security middleware.

This stuff is built on the foundation of puffing out EnTeRpRiSe ScAlE egos with "look at all this vast complexity that I made, I am a god". It's not built on a technical foundation of always moving the needle forward just because you can and because it's cool and the right thing to do.

Sooo, all the $$$ get spent on dashboards and analytics screens and front panel designs and logos and stuff. The actual DNS bits? Probably /r/programminghorror material.

Except that in practice, deprecations don't work, no matter how much warning you give.

The point of deprecations is to eventually force a bad experience for those who are not keeping up. They definitely do work, but the time periods to affect change can be long. In the tech sphere many seem to interpret a long transition period as not working granted the usual pace of change.

Is IPv4 deprecated already?

That's different. There are ways in which ipv4 is subjectively better than ipv6, and "the catastrophe of needing more addresses" has not really panned out yet.

> There are ways in which ipv4 is subjectively better than ipv6

Apart from human readability, how so?

Some people like that addresses must be masqueraded behind NAT. We've solved how to do p2p through that system.

More "solved" than solved IMO. You still need some 3rd party to make the initial connection, for example.

The only way in which IPv4 is better than IPv6 is that many people understand one and not the other.

Three years ago Comcast told me they would be rolling out IPv6 to my business account... I'm still waiting.

is Frash depreciated? Tried browsing without ECDSA support lately? It can be done.

Resolver software is massively distributed, you don't force anything. The only place that can force anything from the top may be root servers, but even then, many resolver operators are probably just downloading root zone in bulk via https from somewhere to precache it and don't contact root servers at all.

It is not the back bone of the Internet. It is the back bone of most naming services.

The internet is IP. It is very robust. DNS is an application over the top of the Internet.

The public won’t be able to use the internet without it.

This is an interesting proposal. After some thought I must say I'm also in favour of it.

The public would still use internet applications, like Facebook. They just wouldn't be able to use the web any more.

I don't think Facebook's apps work when there's no access to DNS. At least it didn't seem like it when I was working to keep that capability for WhatsApp as it moved into FB datacenters.

I don't think very many other applications will work without DNS either, although I never did much competitive testing.

Facebook could (relatively) easily modify their system to do its own IP handling; they probably have enough money to rebuild the entire stack.

Sure, they could, but at least while I was there, there was no interest in doing it, and amazement than anyone else would want to (and push back on declaring at least a handful of IPs as stably allocated enough to be included in app downloads).

Telegram does AFAIK.

Apps use hostsnames 99% of the time.

When was the last time you read a URL aloud or typed it in?

The last 100 times were in the past few hours, roughly. Are you assuming nobody uses FQDNs or URLs anymore? Better yet, are you assuming only humans use those?

You were both savage and self-deprecating, well done!

I dictated the domain for our home automation system to our early-20s cleaner ("dictionaryword dot dictionaryword"), and after a few minutes she asked me "what do you usually Google to get there?".

a minute ago? what an outrageous question

I think many people Google “gmail” and click the link instead of memorizing URLs

Even then you're going to be hitting up DNS to turn "www.gmail.com" into an IP address.

Then an HTTP redirect to mail.google.com

And maybe to accounts.google.com too , if you’re not signed in

Today