Hacker News Reader

Comment by dim13 | Hacker News Reader

Why do people find DNS so difficult? It's just cache invalidation and naming things.

I wrote a long thought out reply about the absurdity of this statement, only to realize its purpose and facepalm myself. Good one!

I think you forgot one more thing

off-by-one errors?

He said two more things.

Exactly the point.

I have noticed it's mostly FAANG developers which leads me to believe that it's not "public DNS" that is giving them headache but DNS based service naming and discovery in the large-scale distributed systems at FAANG companies.

I guess it's also distributed systems, but that's about it.

and three different kinds of daemon control interfaces.

There are only three hard things in Computer Science: (0) cache invalidation (3) asynchronous callbacks (2) off by one errors.

(Adapted from here: https://news.ycombinator.com/item?id=21380936 and from the original https://www.karlton.org/2017/12/naming-things-hard/ )

Holy hell you're right

And… a little async for good measure!

What cache invalidation? There's just cache expiration, that's occasionally not respecting the specs.

Psss. They are not really talking about DNS, but referencing one of the many descendants of this quote,

> There are only two hard things in Computer Science: cache invalidation and naming things. --Phil Karlton

Random reference, https://martinfowler.com/bliki/TwoHardThings.html

But it is unusually apt in the case of DNS, given it is about naming things and caching is one of the major things that keeps biting people with DNS.

From what I've noticed 99% of "things biting people in DNS" is the way windows domain does it, at least the sentiment for "it's always DNS" tend to be far stronger on windows side of things

I've never had to deal with the windows side of things, thankfully. All of my experience with DNS caching issues is with other systems.

That must be why DNS is hard, it's completely made up of the difficult stuff.

Yeah there's no need for invalidation, just observe the ttl to the letter.

Oh hang on let me take this call.. yes I wrote the dns sever, ah so it runs out of memory, uh huh, wait how many unique domai-, mm, a 2000 second TTL is pretty low actu-, wait years?!, no you're right stability is important, no I can't fix the whole world, ok, so like an LRU, yeah that would be a start at least, ok bye.

Wait a second.. THERE YOU ARE! You little rascal, you were trying to hide from me weren't you. You're a good little problem, yes you are, you're going to torture me later aren't you?, yes of course you will, it's a good thing you're so cute huh. Good now run along and go play with the other nightmares. Look at em go, wow they grow up in complexity so fast.

Anyways what we were talking about? Oh yeah "just" expiring the cache.

Oh there is definitely a need for invalidation sometimes, but the system doesn't support it, due to its openness: authoritative servers don't track their consumers.

But the protocol does support it. So, if you really need invalidation, go talk to the world's resolvers and ask them to process dns NOTIFYs from your authoritative DNS servers.

All of expiry, eviction, and flushing counts as "invalidation" in the context of "the hard problems of computer science".

The spec is clear, you can expire the cache whenever you want/need before the TTL, and you must expire it immediately after the TTL. The only problem occurs when broken caches fail to expire.

Cache expiration is just time based cache invalidation, one of the many ways you can implement invalidation.

It is not uncommon for resolvers to cache negative answers as well.

There are things like delegation, glue records and the like that do go a bit beyond those two things :-)

Nice sarcastic comment. Remind me of the "Duning-Kruger" effect. [^1]

[^1] https://www.wikiwand.com/en/Dunning%E2%80%93Kruger_effect

Reply on news.ycombinator.com