Munin, Keeper of LoreApr 24, 2017

DNS is dangerous knowledge to have.

Yes, it's a wonderful, amazing way to solve many problems.

Unfortunately, once you know how it works, you begin to realize how fragile the underpinnings for a lot of other things are.

Worse, once -other- people realize you know it, you get their well-meaning plans to do things that, yes, -can- work, but really oughtn't to see the light of day.

Show threadMunin, Keeper of LoreApr 24, 2017

No offense to the fellow who wrote this, but this?

https://github.com/aniruddhas/DNSrouter

This is one of those ideas that, well meaning though it is, really oughtn't to be implemented.

Please do not rewrite your routing tables based on DNS responses.

Show threadMunin, Keeper of LoreApr 24, 2017

[ A solution for the apparent problem this is intended to solve - routing different priority traffic to different gateways - would be to use a pair of SOCKS proxies; whitelist the traffic for the one on an internal resolver & dump the rest to the other; then have your routes send one proxy to one gateway and the other to the other.

This will keep your ops staff from screaming about randomly changing routes. ]

Show threadGeorge Furbish❎Apr 24, 2017
@munin So my understanding is they're trying to route traffic differently depending on who you are and what domain you're trying to get to. Like they're trying to reroute certain people's traffic to certain websites to a different WAN gateway or a local mirror or something?
Show threadMunin, Keeper of LoreApr 24, 2017
@geofurb Not certain people's - certain destination traffic, across the whole org, near as I can tell.
Show threadGeorge Furbish❎Apr 24, 2017
@munin Ahhhgotcha. This would be a lot easier if this guy had commented his code. So they're taking certain websites and passing them to an alternate gateway. What's wrong with doing this by DNS? You're suggesting a SOCKS proxy, but wouldn't that have to be set up on each client?
Show threadMunin, Keeper of LoreApr 24, 2017

@geofurb Nah, you just have a single configuration, and pass the requests between the two proxies depending on whether it's in the good group or the other group.

One of the many reasons not to do this his way is that you can screw up your routes -hard- very quickly if you try to do clever dynamic routing like this.

[There are also security problems, but the basic usability one should suffice in most cases]

Show threadGeorge Furbish❎

@munin I don't understand the first part of your message, you're gonna have to use more words and be more specific.

What does it mean to screw up your routes? Hard?

Apr 24, 2017 at 7:38amWeb
Show threadMunin, Keeper of LoreApr 24, 2017

@geofurb What happens when you get a race condition on DNS-initiated routing changes?

I don't know, but it's not going to result in a usable network configuration.

Show threadMaiyannah BishopApr 24, 2017
@munin @geofurb Well, you know.  There's one way to find out...
Show threadMunin, Keeper of LoreApr 24, 2017

@maiyannah @geofurb

Yeah...this is one of those situations that I'd be much happier never knowing the answer ;-)

Show threadMunin, Keeper of LoreApr 24, 2017

@geofurb @maiyannah And, honestly, these "control work computer use" situations are usually just wrongheaded to begin with.

Either trust your employees to get their work done in a timely manner or get rid of them.

Intrusive web stuff? That's just going to be a lot of cost for no actual benefit - and encourages juvenile behavior.

Show threadMaiyannah BishopApr 24, 2017
@munin @geofurb Give a people a system that resists them and they will resist in turn.  Friction causes more friction.  Or to boil it down to the old law, every action has an equal and opposite reaction.
Show threadMunin, Keeper of LoreApr 24, 2017

@maiyannah @geofurb

Pretty much, yeah. Also - if you treat people like children, they will act like children; if you treat them as adults, they will act as adults.

Show threadMaiyannah BishopApr 24, 2017
@munin @geofurb It's basically punishing everyone for the few discipline cases, which just lowers morale and productivity.  It's better to target the people who are discipline cases individually and specifically.
Show threadMunin, Keeper of LoreApr 24, 2017

@maiyannah @geofurb

If you genuinely want to fix the problem, yes.

Unfortunately...

Show threadMaiyannah BishopApr 24, 2017
@munin @geofurb I lot of the discipline cases in some companies can also be policy writers/contributors .... and that's where the problems come in.
Show threadMunin, Keeper of LoreApr 24, 2017

@maiyannah @geofurb Oof, yes.

Not to mention management always seems to be exempt from any of these little disciplinary matters.

Or security ones :-/

Show threadMaiyannah BishopApr 24, 2017
@munin @geofurb This is not unfamiliar territory for me ... lets just, put it that way.
Show threadMunin, Keeper of LoreApr 24, 2017

@maiyannah @geofurb

Yeah, can definitely tell...

Show threadMaiyannah BishopApr 24, 2017
@munin @geofurb I had a lot of work in the salt mines before I escaped into independent contracting for a while.  Then I got really badly burned on a project and said fuck it entirely to CS/IT stuff and got back into video game writing.  And here I am back at it again with the fediverse.

Some people never learn.  At least this is a passion project.
Show threadMunin, Keeper of LoreApr 24, 2017
@maiyannah @geofurb Sometimes it's a calling, not a career...
Show threadMaiyannah BishopApr 24, 2017
@munin Yeah, definitely starting to think so.  These days the rest of the IT stuff is like, fix simple things/do simple tasks for family and friends for a burger kind of thing.  The rest of it has been passion project stuff in my spare time kind of thing.

Never really expected postActiv to get any traction tbh.
Show threadMaiyannah BishopApr 24, 2017
@munin (Dont get me wrong, I'm kind of GLAD it did, but it was really unexpected)
Show threadMunin, Keeper of LoreApr 24, 2017

@geofurb

Let's say I hit refresh on worksite.work and playsite.play at the same time. Both DNS requests go out, but the order they come back in is indeterminate - so the order in which the routing changes show up will differ. Now how long does it take for the ipconfig changes to propagate? How many TCP sessions are affected by this?

What happens when you try to apply multiple iptables configs at the same time? :-/