Hacker News Reader

Comment by bluejekyll | Hacker News Reader

I’ve been working on https://github.com/bluejekyll/trust-dns for a bit over two years now. About a year ago a new contributor added Windows build support and testing with AppVeyor, which was awesome.

Originally I started this project more for server side stuff, but recently have been very focused on a full resolver which could be used as a replacement for the OS system resolver.

A question for HN, what would you like to see in this context that would make a replacement resolver on Windows something you’d use? To be clear, it’s not something you could use dropin right now, it can only be used as an internal library to Rust at-the-moment, but I’ve been planning to start working on a daemon that could act as a caching system resolver in the next little bit.

View on HN

I don't know about Windows, but on Linux, I would love to have a replacement for the entirety of NSS (and PAM, and other similar parts of the system) that ran in separate daemons rather than by loading shared objects into my process which could arbitrarily corrupt my process if they were buggy (which I have encountered before before).

To achieve that compatibly with existing systems, it would probably need to be able to act as an NSS module itself in order to be compatible with existing clients, and also be able to load NSS modules (hopefully in sandboxed, lower privileged processes) so it could support existing setups transparently, though it would be great to also have a better asynchronous interface so that you don't have to spawn thread or process pools for things like hostname resolution or fetching groups from LDAP.

That's a really neat idea. I like the idea of potentially building something that could be plugged directly into Linux as a PAM module, etc. I've never written something like that, so it would be fun learning how to do it.

> it would be great to also have a better asynchronous interface so that you don't have to spawn thread or process pools for things like hostname resolution

The library is built atop of Tokio, so is already async capable.

On Linux, I'd really love a caching resolver that saves its cache persistently. I don't understand why the machine's power-on state has anything to do with the validity of the DNS cache; if the entries were good at shutdown time they ought to be good enough in a few seconds when I boot again.

That's very feasible, as I already have the persistence layer from the server component. So that could be reused easily. It's also portable, so would work on all the currently supported platforms, Linux, macOS and Windows.

I'm surprised this isn't the norm.

Reply on news.ycombinator.com