Hacker News new | past | comments | ask | show | jobs | submit login

Most of the things that are "curious" about DNS I think comes from its lack of a version.

DNS has no version, so it has no obvious way to extend itself by allowing for graceful upgrades. So you can't just change behavior and have clients support a particular version. Everything has to be backwards compatible with something written in 1984.

The only serious attempt at extending DNS died because the specs and DNS admins allowed the extension mechanism to be optional. Now, most networks break the extension, and the DNS just limps along because nobody is willing to implement a sane upgrade path.




Query opcodes 3 and 6 through 15 are unassigned [1]. Middlebox brokenness aside [2], a completely new payload could be placed behind a header

  0000 7800 0000 0000 0000 0000
Public DNS installations already have to deal with getting unsolicited random crap, so the risk of fatal confusion is low.

[1] https://www.iana.org/assignments/dns-parameters/dns-paramete... [2] Middlebox brokenness is probably the biggest issue with extending or upgrading DNS, though, I suppose


And the middlebox brokenness is due to a lack of versioning. Virtually all middlebox brokenness is a result of a lack of versioning and poor upgrade paths - usually from people demanding backwards compatibility above all else.


I view it as more of a consequence of "fail closed" thinking than a lack of versioning. As we've seen recently with TLS [1], even protocols with explicit versioning suffer from middlebox brittleness.

[1] https://news.ycombinator.com/item?id=17298747




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: