Why is DNS often joked about in the I.T. Industry?

Submitted ⁨⁨3⁩ ⁨months⁩ ago⁩ by ⁨Tekkip20@lemmy.world⁩ to ⁨[deleted]⁩

I should clarify I wasn’t a upper level sys admin managing those servers, I just used them or maintained accounts being a rank and file technician

While I get the fundamental concept of DNS as a phonebook for your IPs. I am not sure why it is joked around if something goes haywire or someone breaks something.

Is it because if you get no DNS, people can’t log in through their AD accounts, browse the Internet?

Afaik DNS is a bit of a rabbit hole topic, maybe that’s why people joke about it due to DNS being this “No one really knows how this magic name matching box works”?

Please correct me, I’d genuinely like to know why this is prevalent from you guys.

source

Comments

Sort:hotnew top

kobra@lemm.ee ⁨3⁩ ⁨months⁩ ago
There’s even a haiku:

It’s not DNS There’s no way it’s DNS It was DNS

source
- philpo@feddit.org ⁨3⁩ ⁨months⁩ ago
  (And if it’s not DNS it’s NTP oh yeeh) (But that kills the Haiku)
  
  source
  - SkaveRat@discuss.tchncs.de ⁨3⁩ ⁨months⁩ ago
    It bgp
    
    But bgp is just sparkling dns
    
    source
Shadow@lemmy.ca ⁨3⁩ ⁨months⁩ ago
100% of the internet depends on it, and 90% of technical people can’t be bothered to learn how it works and understand it. Partly because they only touch it once every 5 years. They get what they need done but don’t understand why it worked, so it ends up feeling like black magic to them.

source
- skullgiver@popplesburger.hilciferous.nl ⁨3⁩ ⁨months⁩ ago
  [deleted]
  source
  - Big_Boss_77@lemmynsfw.com ⁨3⁩ ⁨months⁩ ago
    Image
    
    source
  - AndrewZabar@lemmy.world ⁨3⁩ ⁨months⁩ ago
    If anyone you know claims to have expertise in the computer field and doesn’t know everything about DNS (there’s not much to know) then those people are clueless and by no means are they experts.
    
    source
    -> View More Comments
  - thermal_shock@lemmy.world ⁨3⁩ ⁨months⁩ ago
    what’s wrong with .local?
    
    source
    -> View More Comments
- thermal_shock@lemmy.world ⁨3⁩ ⁨months⁩ ago
  used to feel this way about dns until I setup my profile. I love how dns controls so much behind the scenes.
  
  source
  - stupidcasey@lemmy.world ⁨3⁩ ⁨months⁩ ago
    DNS isn’t supposed to control that much PIhole is a hack, it would be more accurate to say PIhole controls so much behind the scenes. DNS is supposed to do exactly this domain.com->1.2.3.4 nothing more and nothing less anything else is a hack when cloud flair runs all your traffic traffic through a proxy that is them hacking the system domain.com->change-1.2.3.4
    
    source
    -> View More Comments
- AndrewZabar@lemmy.world ⁨3⁩ ⁨months⁩ ago
  
  90% of technical people can’t be bothered to learn how it works and understand it
  
  Playing real fast and loose with the term “technical people.” If you mean just in general people familiar with and comfortable with tech, yeah that’s fine. If you mean those who work or hobby in the IT industry, well then they’re not very good at their jobs and probably should not have those jobs.
  
  source
shalafi@lemmy.world ⁨3⁩ ⁨months⁩ ago
I got a story that perfectly illustrates the meme.

Had done a solid job of setting up my first domain, from scratch. Everything was tooling along nicely for months until my administrator account kept locking itself, every few minutes.

Logged in with another admin account and hunted for the issue for a month. Since it was affecting only my account, none of the users had issues. Finally found a single sentence in an obscure forum that pointed me. My DNS issue was buried deep in the DHCP settings.

Despite knowing better, I had used my personal account to authorize interactions between the DNS and DHCP services. When I changed my password, DNS was still trying to use the old credentials, over and over again, locking my account.

HOLY SHIT! If you google “dns haiku” my image is in the front page twice! Love it!

source
- bfg9k@lemmy.world ⁨3⁩ ⁨months⁩ ago
  This is hanging on our wall at work lol
  
  source
- JackbyDev@programming.dev ⁨3⁩ ⁨months⁩ ago
  For me it was Square Space marking my domain as being owned by me but it actually being for sale. RIP Google Domains.
  
  source
tiny@midwest.social [bot] ⁨3⁩ ⁨months⁩ ago
When it is the cause of a problem it’s not always obvious at first so you spend hours troubleshooting the broken app until you look at DNS and a simple DNS issue

source
- qaz@lemmy.world ⁨3⁩ ⁨months⁩ ago
  I’ve had a problem like this yesterday. I couldn’t access my paperless instance. I eventually figured out I could access it with an IP + port combination and the DNS lookup failed.
  
  source
- Landless2029@lemmy.world ⁨3⁩ ⁨months⁩ ago
  Often because we know how badly things can go wrong with so many components we start at the end of the app instead of the beginning.
  
  Similar to how tech support always asks of you rebooted. We often don’t confirm basic connectivity issues.
  
  source
bfg9k@lemmy.world ⁨3⁩ ⁨months⁩ ago
DNS failure can manifest in strange ways and have a sysadmin scratching their head as to why some devices are working fine (statically configured/running from DNS cache), but others cannot access the internet or any of their work services.

It’s usually the last thing you suspect, because DNS always just works, right?

source
- PlexSheep@infosec.pub ⁨3⁩ ⁨months⁩ ago
  You’d think so until you have dealt with a few DNS problems. At some point, the mantra of “It’s always DNS” stays in your head when troubleshooting. It’s often the first thing I try nowadays.
  
  source
IphtashuFitz@lemmy.world ⁨3⁩ ⁨months⁩ ago
I never would have thought of it but I recently saw a novel use of DNS to exfiltrate data from a compromised server.

My employer takes security very seriously. Our public facing web servers are very thoroughly locked down, or so we thought. We contract with companies like HackerOne to perform penetration testing etc. One of their white hat hackers managed a remote command attack, and copied data off of the server via a string of DNS queries.

Suppose the hacker owned the domain example.com, and he had his own authoritative nameserver for it. He just ran a series of commands that took, for example, a password file, and ran DNS queries for line1.example.com, line2.example.com, line3.example.com and so on for each line in the file. As a result the log file on his DNS server collected each line of the password file as it responded to each query.

source
- archomrade@midwest.social ⁨3⁩ ⁨months⁩ ago
  I’m trying to digest this
  
  You’re saying he was stealing data from the target server by appending it line-by-line to dns requests sent to his nameserver? Wouldn’t he have needed to both be on the target server and already have access to the data?
  
  source
  - IphtashuFitz@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Our web servers are locked down in such a way that you can’t copy data off of them using standard protocols like scp, ftp, and even http, etc. Our firewall blocks all such outbound traffic.
    
    This hacker found a bug in a framework used on our web servers that let him execute commands remotely. When commands to copy data off the server failed using those more typical methods he switched to a more novel (and difficult) method of leveraging DNS instead. He discovered we weren’t locking DNS down the same way we were locking other protocols down and used that as a way to extract data from our server.
    
    source
    -> View More Comments
  - JackbyDev@programming.dev ⁨3⁩ ⁨months⁩ ago
    Yes, but it’s not necessarily as simple as having full ssh access or something like that. Plus getting data out by DNS queries is probably much harder to detect than something like sftp or http posts.
    
    source
  - PlexSheep@infosec.pub ⁨3⁩ ⁨months⁩ ago
    Could be used to exfiltrate data when you only can make commands, but not see their output. There might be other and easier exfiltration possibilities then, but this is a creative solution that uses a very common protocol and will probably be available on any machine.
    
    source
some_guy@lemmy.sdf.org ⁨3⁩ ⁨months⁩ ago
Sorry this doesn’t explain anything, cause I think others have already put in the work. At my old job, there was a slack icon for “Is it DNS?” because it’s often DNS. You already know and that’s why you asked, but I’m just reinforcing that this is how common it is.

source
brygphilomena@lemmy.world ⁨3⁩ ⁨months⁩ ago
Because so few understand it and so many things use it.

If you read a guide on setting up a website. They might have you change a DNS record and you might not realize it’s doing something else. Web developers frequently want to make changes to DNS and will change the name servers away to theirs but not migrate any of the records for anything besides the website. They’ll break EVERYTHING but hey, the website will load.

If you read a guide on connecting some service like hubspot. They will have you add spf records. But those need to be included with the existing ones and not just replacing what’s already there. Mess it up and every single email you send will get sent to spam folders.

source
- dreugeworst@lemmy.ml ⁨3⁩ ⁨months⁩ ago
  clueless dev who very rarely touches web apps here, what things would break if you dont touch other records besides those for tour website?
  
  source
  - brygphilomena@lemmy.world ⁨3⁩ ⁨months⁩ ago
    A records are usually fine for web dev, and some cname records. But if you move DNS to different name servers it doesn’t take the MX, srv, or txt with you.
    
    Name servers are where all the DNS records are hosted. It tells every computer who is the authority on the information. If you change those without moving all the DNS records to the new location. All the old ones are no longer used at all. Even if they still exist on the old system.
    
    Also spf records might also reference the websites a record to allow the website to send email without getting flagged as spam. If the site moves, but emails are still sent from the old IP address for a myriad of reasons it would break email. Like if they used some provider that hosted the site and emails on the same system, which used to be more common than it is today.
    
    source
    -> View More Comments
JustARegularNerd@lemmy.world ⁨3⁩ ⁨months⁩ ago
Only a support tech chiming in, so far I’ve found when it goes wrong, it causes errors or behaviours that are unusual and could be hard to trace back. Clients might be confused as to why their laptop isn’t connecting to some services but their co-worker still can.

I’ve currently got an infuriating issue where the DNS on my modem just dies at seemingly random intervals. I set up a monitor using Uptime Kuma to let me know when it goes down, and ever since it just hasn’t been a problem yet so I have no idea why it’s going down. I might just set up a pihole and just work around the problem.

source
dbx12@programming.dev ⁨3⁩ ⁨months⁩ ago
Might be related to long TTL on DNS entries making it hard to connect one failure to a thing you changed days ago.

source
tomkatt@lemmy.world ⁨3⁩ ⁨months⁩ ago
DNS is often misconfigured.

On the linux side of things, people like to manually edit /etc/resolv.conf when it’s actually a symlink and changes to it don’t persist on boot (the real file location varies, but it’s usually in something like /etc/system/resolve).

On the Windows side, people love to ignore that reverse DNS exists, even though so many things use it. They also freaking love CNAME aliases and break stuff in interesting ways (for example, a “load balanced” configuration that’s all just the first node acting as all three nodes of a cluster or pool).

Many people only know enough DNS to be dangerous and come up with really jank workarounds to get things running because they don’t understand the proper solutions.

source
scsi@lemm.ee ⁨3⁩ ⁨months⁩ ago
In addition to the other comments which more directly address your question, DNS has been / can be used to exfiltrate data from “secure” networks. Search “dns data exfiltration” in your favourite search engine and you’ll get several high quality articles. Typical mitigations might be to limit which DNS servers your network can contact, restrict packet sizes to the bare minimum which valid use would have and so forth.

source
AndrewZabar@lemmy.world ⁨3⁩ ⁨months⁩ ago

maybe that’s why people joke about it due to DNS being this “No one really knows how this magic name matching box works”?

You know people who work in IT who actually say things like that? Wow do I feel sorry for their clueless bosses who are employing complete failures. You really want your doctor to know how X-rays work and you want your IT team to understand one of the most fundamental elements of network technology.

Jesus. In my day you had to be an expert and know your shit. I guess nowadays it’s just free for all?

source
- Glitterbomb@lemmy.world ⁨3⁩ ⁨months⁩ ago
  Weird. You have two top level comments, and two replies in this thread where you’re offended that someone might find humor in an aspect of their job. Are you ok, dude? Is DNS your girlfriend? Should we stop talking about her? Youve been in IT for 30 years - maybe its time to retire.
  
  source
  - AndrewZabar@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Yeah please don’t worry yourself, I think you’re paying me a little too much attention.
    
    source
- CTDummy@lemm.ee ⁨3⁩ ⁨months⁩ ago
  Your quote to me sounds like someone who’s making a joke out a subject they don’t want to have to explain to a lay person.
  
  Interesting you went to branding them complete failures over it though. Right after comparing IT workers to fucking doctors lmao.
  
  Jesus. In my day you had to be an expert and know your shit. I guess nowadays it’s just free for all?
  
  Truth is society as a whole started coasting about a decade after you joined the work force. We figured, fuck it Andy’ll take care of it.
  
  source
  - AndrewZabar@lemmy.world ⁨3⁩ ⁨months⁩ ago
    lol yeah I think you actually understand me pretty well. I have something called standards and when I started working, you had to actually work and work damn well, to keep your job. And I’m not talking about any job but certainly being in charge of maintaining and supporting information technology. And yes, I can say someone who works in IT who doesn’t know what DNS is, is a failure. Sorry if it hurts their feelings but maybe they’re not yet familiar with a concept called qualifications, credentials, experience, expertise, knowledge, skills… you know, silly old fashioned stuff like that.
    
    I also am pretty aware lately that most of the time online I seem to be talking to younger and younger people. So there’s a sort of I equity there because I’m coming from the experience and point of view of a middle aged man and I’m talking to children - of course they won’t be able to relate.
    
    But it’s the way of the internet. Believe me I’d love to interact more with only my intellectual peers but there are not nearly as many of us as there are kids who are just starting out. Shrug. What can you do. I still like to carry on conversation with exchange of ideas.
    
    source
    -> View More Comments
AndrewZabar@lemmy.world ⁨3⁩ ⁨months⁩ ago
I’ve been an IT professional for decades and I’ve literally never heard a single person anywhere ever find DNS funny or joke about it. It would be like joking about bicycle tires or salt. It’s such a mundane thing that has nothing interesting or funny in it.

source
- thermal_shock@lemmy.world ⁨3⁩ ⁨months⁩ ago
  it’s akin to lupus in House MD. relax a little guy.
  
  source
  - AndrewZabar@lemmy.world ⁨3⁩ ⁨months⁩ ago
    Yeah I never found that amusing. But, humor is subjective. I was merely stating my personal perspective. In no way is my opinion to be taken as some authoritative proclamation.
    
    source
- morriscox@lemmy.world ⁨3⁩ ⁨months⁩ ago
  What do you think about github.com/morriscox/Rules-of-Tech-Support
  
  source
hendrik@palaver.p3x.de ⁨3⁩ ⁨months⁩ ago
What's an example of a joke? Because that's not what I experienced... In my world people make similar jokes if you mess up any aspect of networking. Same if you break the routing. Or mess up the servers, replication or vitualization.

source
- domi@lemmy.secnd.me ⁨3⁩ ⁨months⁩ ago
  There’s the famous DNS haiku: i.imgur.com/eAwdKEC.png
  
  source
xmunk@sh.itjust.works ⁨3⁩ ⁨months⁩ ago
Because it’s a fucking unauthoritative clown show that is necessarily decentralized which leads to all sorts of difficult to diagnose (and sometimes impossible to quickly fix) issues.

It’s like 100% footguns.

source
argarath@lemmy.world ⁨3⁩ ⁨months⁩ ago
I don’t know much about much, I’ll admit that, but what I have experienced with DNS is that it keeps shitting the bed when I’m trying to connect to my bfs server in the USA while I live in Brazil. Some spectrum node in Miami or something keeps sending my ping to the moon and my packages go from 0% dropped to 100% when I use a program to trace the path (sadly can’t recall the name RN, hopefully when someone replies I’ll be by my PC again and check it)

I just wish I could tell my DNS “hey, don’t use that node specifically” because every other step is going just fine, but as I said before, I don’t know much at all so I don’t know if that’s possible or even if it’s a good idea

source
- aStonedSanta@lemm.ee ⁨3⁩ ⁨months⁩ ago
  If you use a VPN there is a chance your connection will route differently.
  
  source
  - argarath@lemmy.world ⁨3⁩ ⁨months⁩ ago
    I could try, but the only game this is causing issues is minecraft, and the server is mostly dead by now, so I don’t want to spend the money for just trying to see if it would help, but I’ll def look into it for the next time we play minecraft again
    
    source
LordCrom@lemmy.world ⁨3⁩ ⁨months⁩ ago
Dont forget about resolve.d. Did they ever fix a static DNA entry with DHCP allocated ip? I submitted the bug like 5 years ago

source