Slashdot Mirror

← Back to Stories (view on slashdot.org)

Dan Kaminsky Suggests Having Fun with DNS

Posted by timothy on from the bits-is dept.

boogahsmalls writes "A few weekends ago Dan Kaminsky of scanrand fame presented some pretty cool ideas involving DNS that made plenty of heads spin at the LayerOne Technology Conference. Some of his concepts included Voice over DNS and storing Knoppix in a DNS cache. He's also apparently got a couple new tools in the pipe including a scanrand based DNS scanner and a visualization suite. Could another version of Paketto Keiretsu be in the works?" (OpenOffice.org does a great job of opening the PowerPoint slideshow.)

3 of 212 comments (clear)

  1. Some of this stuff really makes alot of sense by mcrbids · · Score: 4, Interesting

    Forget the current legal nightmare of this proposal - just roll with me...

    This guy proposes putting content (eg Knoppix) into DNS.

    Why is DNS particularly not well suited for this kind of distribution mechanism?

    Seems to me that if the RIAA wanted to distribute their movies via broadband providers (an inevitability, I'm afraid) the biggest problem would be dealing with BANDWIDTH.

    I always figured that ISPs would have to have some way to cache content locally so their Internet pipes don't get absolutely HAMMERED by all the people viewing the latest flick...

    DNS already has a mature, stable, and lightweight caching mechanism in place. Why not use it?

    Honestly, caching content a la DNS might provide a MUCH more efficient content distribution mechanism than, say, BitTorrent.

    Where's the bad part of this idea?

    --
    I have no problem with your religion until you decide it's reason to deprive others of the truth.
    1. Re:Some of this stuff really makes alot of sense by Bagheera · · Score: 4, Interesting

      Forget the current legal nightmare of this proposal - just roll with me...

      Were that we could...

      Why is DNS particularly not well suited for this kind of distribution mechanism?

      Because DNS is designed to handle its hierarchical data, not massive amounts of content? The extra fields available in DNS are there fo, well, DNS related stuff.

      Seems to me that if the RIAA wanted to distribute their movies via broadband providers (an inevitability, I'm afraid) the biggest problem would be dealing with BANDWIDTH.

      I know you meant the MPAA, not the RIAA, but I think their biggest problem will be letting go of their deep seated need for control, rather than bandwidth. They can afford the pipe. And I, for one, would be incredibly pissed off to find the RIAA (or any other commercial service) caching their stuff on MY name server.

      I always figured that ISPs would have to have some way to cache content locally so their Internet pipes don't get absolutely HAMMERED by all the people viewing the latest flick...

      Like, say, USENET?

      DNS already has a mature, stable, and lightweight caching mechanism in place. Why not use it?

      We do. Millions of times a day. We use it every time we translate a name to an IP number. Looking up, say www.slashdot.org

      Honestly, caching content a la DNS might provide a MUCH more efficient content distribution mechanism than, say, BitTorrent.

      Highly unlikely. A highly effecient system dedicated to caching content will almost certainly be better than trying to do the same thing with DNS. It's simply not made for it.

      Where's the bad part of this idea?

      Inefficiency. Load on already stressed servers. Better existing solutions. Should I go on?

      Dan's come up with some brilliant ideas over time. Definately A Geek's Geek. But this one sounds a lot more like one of his thought experiments than an actual proposal. Like directly burning CD's over an SSH tunnel...

      --
      Never attribute to malice what can as easily be the result of incompetence...
  2. Re:Great Article by jovetoo · · Score: 5, Interesting

    His techniques allow someone to set up a cryptographically secure network that most likely completely ignores firewalls. It features high bandwidth-high latency connection, low bandwidth-low latency connections and is virtually untraceable, even to both parties involved in the connection. An initial hostname and time would act as the 'phonenumber'. (By keeping a certain request alive, one can even implement a dailing service with TTL delay.) A message service is freely included.

    It is virtually impossible to shut these networks down without replacing/patching dns. Not an easy task.
    The bandwidth available to this network most likely exceeds that of most irc-botnets. Especially since the root servers are defending themselves against DDoS attacks.

    The tools he's still developing might be able to trace these things but it will still require cooperation of dns server administrators (to get their logs). You will never get them all and you'll have a LOT data to process. Accorfing to this the ICS root server continuosly handles almost 8Mbps (and can handle upto 80Mbps) of traffic. I seriously doubt they can log that... (if so, transferring the logs would continually consume a healthy percent of the servers bandwidth.)

    Pretty smart man indeed and very idealistic or shortsighted. Both the right and the wrong sort of people would pay a lot of money for that...