DNS Firewalling with MISP and Technitium DNS Server (opens in new tab)

(zaferbalkan.com)

22 pointsfeldrim6mo ago22 comments

22 comments

mfro5mo ago

I love Technitium DNS and have run it for several years now. Thanks for the contributions.

I only made two plugins. I have two half baked ones in the making. Both Shreyas and me have day jobs and this is a side quest. Overall, my contributions are about 1% of all the code, so I accept the 1% of the thanks. Kudos to Shreyas.

avhception6mo ago

When I read "PDNS", I will probably always think "PowerDNS".

feldrimOP6mo ago

Yes. That's why I put the footnote there.

avhception6mo ago

Well, I read that footnote, but I'm not sure if overloading the acronym is the best idea, is what I'm trying to say.

feldrimOP6mo ago

I agree with you there. But the term does not belong to me buy yo CISA and other organisations. But it's not as bad as Cyber Security Awareness Month acronym at least

walletdrainer5mo ago

“PDNS” also often refers to “Passive DNS”, never heard of “protective dns” before.

Milpotel6mo ago

Don't get too exited - Technitium has a bus factor of one, a very small user base and no previous auditing.

johnea5mo ago

Yea, I often wonder when I see this type of article, why don't they just use bind9?

No other DNS resolver is going to come close to it's number of deployment*years in operation.

I didn't read the article though, since I'm not going to enable javasript and cookies just to read someone's blag post 8-/

HTML much?

ignoramous5mo ago

> I didn't read the article though, since I'm not going to enable javasript and cookies just to read someone's blag post 8-/

mirror: https://archive.vn/8BCBn

Milpotel5mo ago

> why don't they just use bind9?

Because bind9 is not a dns server but a collection of all available CVE types for further studying.

johnea5mo ago

I guess wikipedia doesn't agree with you:

"BIND is the de facto standard DNS server"

https://en.wikipedia.org/wiki/Comparison_of_DNS_server_softw...

9 just being the currently deployed version.

A non-wikipedia reference:

https://dn.org/a-comprehensive-comparison-of-popular-dns-ser...

Although this article does state that bind's "configuration files and options require careful attention to detail".

So, maybe it's not appropriate for the modern hype-cycle s/w development model?

In general, I don't think I'm disagreeing with you, so I'm not sure what message the reply is intended to convey.

Technitium seems like another one of those: "My weekend hobby project was to reinvent fire, and the wheel" sort of things, that seem popular on the HN feed.

My favorite feature of bind is "split views". This allows the same service to provide DNS on the local LAN, as well as authoritative DNS to the internet.

2 more replies

feldrimOP5mo ago

The only problem there is for GDPR consent thingy. You can disable and proceed. I don't use any telemetry except for the consent banners.

When it comes to Technitium, well, it's written in the blog.

johnea5mo ago

If my browser is blocking cookies, you don't need my consent, because you're not going to set any cookies.

GDPR preempted...

esseph6mo ago

And yet here I am deploying it in production

Milpotel5mo ago

You are a brave fellow!

esseph5mo ago

Not so much, just old enough to do proper risk analysis and have safeguards in place.

feldrimOP6mo ago

I've played with threat intelligence to build a simple, on premises PDNS out of a privacy-focused DNS server.

j / k navigate · click thread line to collapse

22 comments

mfro5mo ago

I love Technitium DNS and have run it for several years now. Thanks for the contributions.

feldrimOP5mo ago

avhception6mo ago

When I read "PDNS", I will probably always think "PowerDNS".

feldrimOP6mo ago

Yes. That's why I put the footnote there.

avhception6mo ago

Well, I read that footnote, but I'm not sure if overloading the acronym is the best idea, is what I'm trying to say.

feldrimOP6mo ago

I agree with you there. But the term does not belong to me buy yo CISA and other organisations. But it's not as bad as Cyber Security Awareness Month acronym at least

walletdrainer5mo ago

“PDNS” also often refers to “Passive DNS”, never heard of “protective dns” before.

Milpotel6mo ago

Don't get too exited - Technitium has a bus factor of one, a very small user base and no previous auditing.

johnea5mo ago

Yea, I often wonder when I see this type of article, why don't they just use bind9?

No other DNS resolver is going to come close to it's number of deployment*years in operation.

I didn't read the article though, since I'm not going to enable javasript and cookies just to read someone's blag post 8-/

HTML much?

ignoramous5mo ago

> I didn't read the article though, since I'm not going to enable javasript and cookies just to read someone's blag post 8-/

mirror: https://archive.vn/8BCBn

Milpotel5mo ago

> why don't they just use bind9?

Because bind9 is not a dns server but a collection of all available CVE types for further studying.

johnea5mo ago

I guess wikipedia doesn't agree with you:

"BIND is the de facto standard DNS server"

https://en.wikipedia.org/wiki/Comparison_of_DNS_server_softw...

9 just being the currently deployed version.

A non-wikipedia reference:

https://dn.org/a-comprehensive-comparison-of-popular-dns-ser...

Although this article does state that bind's "configuration files and options require careful attention to detail".

So, maybe it's not appropriate for the modern hype-cycle s/w development model?

In general, I don't think I'm disagreeing with you, so I'm not sure what message the reply is intended to convey.

Technitium seems like another one of those: "My weekend hobby project was to reinvent fire, and the wheel" sort of things, that seem popular on the HN feed.

My favorite feature of bind is "split views". This allows the same service to provide DNS on the local LAN, as well as authoritative DNS to the internet.

2 more replies

feldrimOP5mo ago

The only problem there is for GDPR consent thingy. You can disable and proceed. I don't use any telemetry except for the consent banners.

When it comes to Technitium, well, it's written in the blog.

johnea5mo ago

If my browser is blocking cookies, you don't need my consent, because you're not going to set any cookies.

GDPR preempted...

esseph6mo ago

And yet here I am deploying it in production

Milpotel5mo ago

You are a brave fellow!

esseph5mo ago

Not so much, just old enough to do proper risk analysis and have safeguards in place.

feldrimOP6mo ago

I've played with threat intelligence to build a simple, on premises PDNS out of a privacy-focused DNS server.

j / k navigate · click thread line to collapse