Yet again working on my network stack implementation, and just..

I do not enjoy that Layer 2 has to care about stuff from Layer 3

Or that Layer 3 and 4 are/can be entangled with each other,

instead of all of them being able to just work independent of every other layer

 WEH

@k4m1 wdym with l2 caring about l3? packet snooping for building ARP/switching tables?

hugs

@domi

That's whole another can of worms,

this complaint was just provoked by remembering that EtherType field in Ethernet frame is used to indicate type of protocol that'll follow x-x

So 0800 for ipv4, 0806 for arp, and so forth

@k4m1 @domi oh god
@alina @k4m1 you kinda don’t have any other way around this problem tho, it needs to be self-descriptive because as far as Ethernet is concerned, the frame can contain anything. if not for this ID field, you’d need to snoop and try to detect what each packet is x.x
@domi @k4m1 @alina it's a pattern that repeats at every layer tbh. You need a dispatch point to select which of the next layer protocols will process the rest of the packet.

Now if you want to talk about ugly layering violations, meet my dishonourable friend IGMP/MLD snooping

@erincandescent @k4m1 @alina the funny thing is that we designed systems to support a multitude of protocols. then we proceeded to only ever (commonly) use three of them (ARP, IPv4, IPv6)

but fear not! we designed IP to support a multitude of protocols too! and then we proceeded to only really use TCP and UDP. For an unwritten reason everything else has to match one of those now :))))

but fear not! we designed TCP/UDP to support a multitude of protocols too!!! and then we proceeded to block every port other than 80, 443 and 53, because everything is HTTP(S) or DNS now

but fear not! we designed^W slapped websockets on top of HTTP because THERE IS NO GOD

@domi @erincandescent @k4m1 @alina we defined many different DNS record types and then put every new application in TXT records

@a51c @erincandescent @k4m1 @alina while you’re not wrong, the root cause of this one is entirely different:

normal protocols become bespoke due to layers of compatibility hacks. DNS is like that to a point, but much more of it was sheer convenience. TXT is a dumping ground for everything, therefore so much software flocks to it for storing metadata. This didn’t obsolete any records, and there’s a vast diversity of Stuff that DNS is actually used for ^^

if you want a real kicker, check out the List of DNS record types on wikipedia. Half of those read like they were designed by a lunatic and would never ever work well in the real world.

List of DNS record types - Wikipedia

@a51c @alina @erincandescent @k4m1 my favorites are as follows:

  • LOC, because it’s incredibly ambitious
  • SSHFP, HTTPS, IPSECKEY, OPENPGPKEY… - because it feels like a great idea, but actually provides little to no extra security (and gods, so many variants! you have to love it)
  • EUI48, EUI64 - before I die, I want to learn why the fuck would someone put a MAC address in a DNS record
@domi @k4m1 @alina @a51c the EUIs and DHCID record types are for DHCP servers doing DNS updates to track ownership
@erincandescent @k4m1 @alina @a51c i am not convinced this is a good solution to anything
we made a globally distributed DNS network for shits and giggles

DNS infrastructure is a bespoke pile of interconnected "standards", and its management is often treated as an afterthought. With Project ...

media.ccc.de

@a51c @erincandescent @k4m1 @alina I’m hacking on more cursed DNS-adjacent things right now, which will be published in a future blogpost. equal magnitude of this hack or better ;3

not sure how fast i’ll finish the work, but it’s not unwise to expect it to be out sometime next week

@domi @erincandescent @k4m1 @alina @a51c I kinda like RP because sometimes you just need to get a hold of someone to fix something, but I understand why this might not be safe to be generally queryable. Accountability is easier at small scale and gets complicated in larger and federated systems

If there wasn't DNS, the fastest distributed nosql database in existence, there is an alternate reality where everything is a forest of LDAP service instead with per record and attribute access control.

@domi @erincandescent @k4m1 @alina @a51c hm they don't seem too bad (albeit it feels like all the fingerprint-in-DNS things should be one RR type with quite flexible subtypes)

and the fingerprint-in-DNS stuff only makes sense with DNSSEC, and if one can trust the TLD NIC and all the other intermediate ones, of course.