Hacker News Reader

Comment by pwg | Hacker News Reader

> It's time to decentralize the internet. There is no good reason why we can't have email, webpages, photos, even facebook-like social stuff housed on our own machines in our own homes (or some other place under our control).

This is how the internet is designed, and you can already do this today. In my case, I host my own dns, email, and my own webpages, locally on my home connection. You just have to be willing to learn, and willing to do. Once you've learned, the actual "do" is rather trivial.

[edit: forgot to list dns in the first version]

View on HN

>This is how the internet is designed, and you can already do this today. In my case, I host my own dns, email, and my own webpages, locally on my home connection. You just have to be willing to learn, and willing to do. Once you've learned, the actual "do" is rather trivial.

That's great that it works for you. But there are lots of people who are perfectly capable of doing this who don't want the hassle (let alone the huge numbers of people for whom this is completely impossible). I spent most of my youth screwing around with computers and learning a lot about how all this stuff works and it was great fun. Now that I'm getting older, it is frankly growing tiresome. The last thing I want to do on a Saturday-- when I should be playing with my kids and enjoying life-- is fuss with some file server that is acting up, preventing my wife from posting vacation photos. I've got enough work to do around the house so as it is. I don't need to be on call 24/7 for IT infrastructure support.

It's true... but I view this as a technology problem not a problem _in_principle_. After all we don't all need to be engineers and electricians to operate a refrigerator, or our automobiles, for example. Society has built up the infrastructure to support individuals owning cars. We aren't all forced to use buses.

Very true, but also not my point.

My point was: "there is no change to the internet at all necessary for this to happen".

The original comment to which I replied implied that the commenter believed the internet needed to change in some way in order to decentralize. My point was it was already, and still is, natively decentralized. What is preventing "decentralization" is convenience, and lack of knowledge, not the underlying architecture of the internet.

> and you can already do this today.

Well many can, but far from all in the context of hosting from home. If you are stuck behind NAT at home then you can't without paying for server resource externally and that is going to be more of a problem over the coming years as IPv4 increasingly becomes a problem and IPv6 (despite recent acceleration) taking a fair long time to become ubiquitous.

> In my case, I host my own dns, ..., locally on my home connection.

What do you do for secondary DNS? Some services respond differently to "address found from name, but server not responding" than they do to "couldn't lookup name".

One particular problem I've seen reported relatively recently is bounced mail when the senders ISP replaces "could not contact DNS server to lookup address" to "I know, I'll show them my own error/adverts web page": of course the user's MTA doesn't know anything about web pages and tries to connect to the host address provided to send mail and is told to go away (either no mail service found or there is one but it refuses mail for that recipient). If you had a secondary then the lookup would pass to there so the right (but currently non-functioning) address would be given to the MTA, it would fail to connect and drop the message back into the queue for a later retry.

It is rare it makes any difference these days (many agents that were sensitive to this, such as mail servers, no longer are because it is quite common for small arrangement not to have secondary DNS and for ISPs to break DNS in the name of making an extra penny here or there) but it is still worth having an externally hosted secondary DNS host even if everything else is a single point of failure for all (hosted on one box on one link). For a small home concern it needn't cost more than ten or fifteen $/year either to run your own bind instance in a inexpensive VPS or to use a specialist DNS service.

I run most things from home too, but have external resources (a backup location and a web service that occasionally needs more bandwidth then the outgoing link at home can comfortably provide) so my secondary services sit out there with them.

> If you are stuck behind NAT at home then you can't without paying for server resource externally

Actually, no. I run NAT on my firewall/router, and still host the services. It just takes tweaking the Linux iptables rules to run externally visible services, while still running NAT in general. Again, a "knowledge" and/or "convenience" issue, but not a technical issue.

> What do you do for secondary DNS?

I use Afraid.org for secondary DNS, but if my home link is down (hasn't happened yet...) then the service (email/web) is also down so I'm just "offline" until the link comes back up.

> I run NAT on my firewall/router, and still host the services.

By "stuck behind NAT" I was meaning a NAT or 6-to-4 arrangement that is not under your control (so you can't configure port forwarding). This isn't all that common in the US or EU aside from mobile and satellite based providers (and you aren't likely to run servers off them!) but elsewhere it is more of an issue and will eventually become so everywhere where IPv6 take-up doesn't pick up fast enough.

> so I'm just "offline" until the link comes back up

I'm not sure what effects are common now (if any) but historically some services responded differently to the two downtime situations "DNS lookup worked, but I can't connect to that address" and "DNS lookup failed" - some MTAs used to be more likely to bounce rather than requeue for instance - so I always recommend topologically distant secondary DNS even for a single server+link situation. If you branch out later (for instance I currently have most things at home but a few bits external which I don't want down if my home link blips) you already have it setup so don't have the extras work to do. Also secondary DNS is required by the relevant RFCs, so if nothing else do it for that reason (I know you already do, I've added this bit for other readers should they stumble here in future).

So I'm looking at moving my VPS into a box at home, but I have an IP that changes every so often. What's the best way to fix that? I've got no problems with DNS being hosted on Route53 or something else.

Just use one of the multitude of dynamic dns providers.

Yep. They give you a little program that runs on your computer that checks your external IP address at frequent intervals and updates the DNS records when it changes. Better yet, some home routers have a configuration page where you can select among popular Dynamic DNS providers and then you don't need to run the proprietary program. My ISP-provided router (FiOS) has ZoneEdit in the list which I've used for years even before I had FiOS, so it was a nice surprise when I found it there. Just for sake of example here's a link: http://www.zoneedit.com/dynamicDNS.html

Some registrars even provide such a service for free (well, included in the annual registration fee), though look for reviews to see how reliable your registrar's is before trying it in anger.

Simplest solution: buy a static IP for home

Or, as others have stated, use one of the dynamic dns mapping services.

Why would you need your own DNS?

Most people don't need it, but there are reasons it can be convenient. And some just like to do everything in-house either as a learning exercise or for control freakery reasons.

Control of TTL values is on example. Most registrars use 4 hours these days but it used to be that 24 hours was the value used by most (with not option of anything else). That can be a minor convenience if you expect to move things around much. I have all mine set to 5 minutes (not a great idea for anything high traffic, but nothing of mine is). If you know what you are doing running a small DNS service is no great hardship at all (though it is surprising how many people don't get it right). Custom dDNS is another reason you might want this (though I think some registrars and specialist DNS hosts offer this for little or no cost these days).

In my case it costs nothing as the three bind instances I run live on geographically separate machines that I already have for other reasons (home line, external web service, backup location) - if you have no external resources already then you'd need to pay for somewhere to host a secondary server of course (cheap, reliable enough, and fast enough VPS services are common so that needn't be much cost - though a specialist DNS services needn't any more expensive these days either and will likely be more scalable than anything we setup manually).

To avoid DNS censorship, my ISP filters pirate bay, plenty of other sites.

You could just use Google's 8.8.8.8 and 8.8.4.4 though.

Plenty of people don't want to send all of their DNS requests to Google.

Google's DNS resolvers are 100% truthful?

I've never heard of them changing or blocking entries. They're on Wikileaks' list of censorship-avoiding DNS servers http://www.wikileaks.org/wiki/Alternative_DNS And Google claims: Google Public DNS does not perform blocking or filtering of any kind. https://developers.google.com/speed/public-dns/docs/intro?cs...

Not what I had in mind. Ignoring the NXDOMAIN results, what makes you trust the VALUE of the NS/A/AAAA/MX/whatever records you get from Google (or any other resolver)?

Because I have frequently seen provably-wrong results from other resolvers, and some highly-suspicious results from 8.8.8.8 on occasion (though I haven't checked particularly often).

The point being, unless you're proving the results with DNSSEC (or similar), you can't trust any source.

Is that the sort of thing that could be fixed by running your own DNS resolver? I mean it all comes down to DNSSEC eventually.

You can limit some of the simple abuses by resolving DNS yourself, but DNSSEC (or other crypo-auth system) is best, of course.

I use and recommend doing both, as there's very little downside to running your own resolver.

In addition to the other replies, which are also good reasons, remember that dns poisoning is a real thing. While running unbound[1] to check DNSSEC signatures HAS discovered invalid results, and you can bypass some (but not all[2]) of those problems if you bypass the bad (ISP/whatever) resolver.

There really isn't much of a performance hit by recursively resolving DNS - it all gets cached anyway.

[1] http://unbound.net/ (other servers may also work for this purpose)

[2] It protects against a resolver that lies, but race conditions (e.g. NSA/QUANTUM) are not affected. Hopefully, DNSSEC itself protects against poisoned results, regardless of the method.

Originally as a learning exercise (but that was about 15 years ago now). Now just because it is not hard, and I don't have to put up with any arbitrary "rules" from a provider.

Reply on news.ycombinator.com