DNS Firewalling with MISP and Technitium DNS Server

mfro 171 days ago |

I love Technitium DNS and have run it for several years now. Thanks for the contributions.

feldrim 168 days ago | |

I only made two plugins. I have two half baked ones in the making. Both Shreyas and me have day jobs and this is a side quest. Overall, my contributions are about 1% of all the code, so I accept the 1% of the thanks. Kudos to Shreyas.

avhception 172 days ago |

When I read "PDNS", I will probably always think "PowerDNS".

feldrim 172 days ago | |

Yes. That's why I put the footnote there.

avhception 172 days ago | | |

Well, I read that footnote, but I'm not sure if overloading the acronym is the best idea, is what I'm trying to say.

feldrim 172 days ago | | |

I agree with you there. But the term does not belong to me buy yo CISA and other organisations. But it's not as bad as Cyber Security Awareness Month acronym at least

walletdrainer 171 days ago | |

“PDNS” also often refers to “Passive DNS”, never heard of “protective dns” before.

Milpotel 172 days ago |

Don't get too exited - Technitium has a bus factor of one, a very small user base and no previous auditing.

johnea 171 days ago | |

Yea, I often wonder when I see this type of article, why don't they just use bind9?

No other DNS resolver is going to come close to it's number of deployment*years in operation.

I didn't read the article though, since I'm not going to enable javasript and cookies just to read someone's blag post 8-/

HTML much?

ignoramous 167 days ago | | |

> I didn't read the article though, since I'm not going to enable javasript and cookies just to read someone's blag post 8-/

mirror: https://archive.vn/8BCBn

Milpotel 171 days ago | | |

> why don't they just use bind9?

Because bind9 is not a dns server but a collection of all available CVE types for further studying.

johnea 169 days ago | | |

I guess wikipedia doesn't agree with you:

"BIND is the de facto standard DNS server"

https://en.wikipedia.org/wiki/Comparison_of_DNS_server_softw...

9 just being the currently deployed version.

A non-wikipedia reference:

https://dn.org/a-comprehensive-comparison-of-popular-dns-ser...

Although this article does state that bind's "configuration files and options require careful attention to detail".

So, maybe it's not appropriate for the modern hype-cycle s/w development model?

In general, I don't think I'm disagreeing with you, so I'm not sure what message the reply is intended to convey.

Technitium seems like another one of those: "My weekend hobby project was to reinvent fire, and the wheel" sort of things, that seem popular on the HN feed.

My favorite feature of bind is "split views". This allows the same service to provide DNS on the local LAN, as well as authoritative DNS to the internet.

feldrim 168 days ago | | |

I am fan of Technitium, because I like to build and I built two plugins for it to fit my use case. But at work, we use Windows DNS and Bind in parallel. So, this is also a hobby of mine. The hook for me is that it is built with dotnet, and I have experience in that stack. Other features are secondary actually.

I am curious though, what would TDNS do so that you can replace BIND with TDNS in your homelab/workplace or wherever it is used? I genuinely ask for it so that I can help the original developer with some PRs.

Milpotel 167 days ago | | |

> I guess wikipedia doesn't agree with you:

Are you kidding? Bind has been the de facto standard for DNS servers for ages but it's just a badly engineered piece of software and had braindead vulnerabilities for decades:

https://www.cvedetails.com/vulnerability-list/vendor_id-64/p...

Already 20 years ago it was common knowledge to never use software that Paul Vixie had touched (bind, vixie-cron, sendmail ...) and we used alternatives such as djbdns. Good old times...

johnea 166 days ago | | |

After just a short search to try to come up with some numbers, I find that between 60% and 90% of internet DNS servers are running bind.

And yet somehow, the internet has much bigger problems...

feldrim 171 days ago | | |

The only problem there is for GDPR consent thingy. You can disable and proceed. I don't use any telemetry except for the consent banners.

When it comes to Technitium, well, it's written in the blog.

johnea 169 days ago | | |

If my browser is blocking cookies, you don't need my consent, because you're not going to set any cookies.

GDPR preempted...

esseph 172 days ago | |

And yet here I am deploying it in production

Milpotel 172 days ago | | |

You are a brave fellow!

esseph 171 days ago | | |

Not so much, just old enough to do proper risk analysis and have safeguards in place.

feldrim 172 days ago |

I've played with threat intelligence to build a simple, on premises PDNS out of a privacy-focused DNS server.