Lookups for things like 'www.facebook.com' were returning false answers. Youtube.com and others were affected too.

So if you got the bad answer from DNS (because you happend to query the Beijing root server), some of your favourite websites would be unreachable.

This doesn't compute for me. DNShas different record types to deal with the issue you are suggesting.

Animportant resource record type is the INA. (IN is the 'internet' class). This is probably the most heavily used record type.

So here's an example:
www.kame.net. 86365 IN A 203.178.141.194

If you have a web browser, it will often query the system resolver for a an A record. This is an IPv4 address. But if the browser wants, it will query for an AAAA record, like this:
www.kame.net. 86400 IN AAAA 2001:200:0:8002:203:47ff:fea5:3085

So, my point is, the version of BIND has no relevance on IPv4 addresses, and IPv6 addresses. It's the query type that determines that. That is part of DNS, and universal to all DNSsoftware.

P.S. a web-browser could query for both A and AAAA records, and have a preference of one or the other set

FlyingGuy's post is such a rambling, nonsensical rant i fear i may be being trolled.

To the grandparent: Yes, writing a DNSserver is that hard. The subtle complexities of the internet's directory service actual operations in the Real World is not trivial. The DNS system actually does more than you might think, and contains more record types than commonly understood.

Just upgrading DNS to support IPv6 was no trivial matter, and they actually got it wrong, first, with A6 records--it was decided that AAAA records were better.

I want to also point out that DNSSEC--cryptographic assurances applied to DNS--is a major step forward on fundamental DNS infrastructure, and implementing that is far from trivial. DNS is being tested at the root and major top-levels-domains even as i write this, and testing is planned to continue throughout 2010.

Finally, the data in the DNS is not at all consistent. The DNShas--realistically--over a million administrators. This is made possible by the delegation-hierarchy model of DNS, which works very well for a globally-scaled system. But it also means that strange-rule bending setups are out there... and dealing with all of them in some kind of consistent, reliable way is a major difficulty.

So again, writing a robust DNSserver is hard.

Oh, but FlyingGuy, back to your senseless musings: if DNSis such a bad system, can you name a superior alternative?

To all: DNSis a fine system, in constant, massive use on the internet with remarkable reliability, despite well-know targets of attack. It is incrementally being updated and advanced, with thoughtful and non-disruptive upgrades happening especially in the last 10 years. You can rely on DNS being around for another 30 years.

Excellent post. I agree, and worry about these problems too much, probably as you do too. I worry about our future, us short-sighted, greedy humans.

When you say that Japanese cities have massive sprawl, i think what you are trying to say is that their cities are very large, which is true. But that's not the same thing as sprawl. Sprawl is single-story retail business, detached, single-family residences, and more roads, parking lots and unused land than buildings. I have seen Japan, and they DOÂNOTÂWASTEÂSPACE. In North america, only the dense cores of the biggest cities compare to Japan, and even then, we use double the space for the same store, or gas station, or whatever.

So Tokyo is a massive city, but it has 30 million people. That's why it's big, it's not cause of sprawl.

Other than that though, i heartily agree with your post.

The main thing that I'm not understanding is why the US Secretary of Commerce is responsible for specific technology decisions on the DNS.

Surely the political appointee to that post will not be qualified in any capacity to dictate the specifics about DNSSEC deployment.

Additionally, does the US Government still exert so much direct control over the DNS? I thought they divested their control to ICANN, so they could at least appear to not be thugs running the internet for their own benefit. However the ICANN employee specifically states:

'"The ideal scenario is that the root zone is signed," said Kim Davies, manager of root zone services for ICANN."Currently, we have a situation where the root isn't signed, which is largely a political discussion. And in the immediate future, it is not likely that we'll have a signed zone. So we're looking at what's the next best thing."'

Signing the root is a political discussion, needing the secretary of commerce' approval?

Can anyone enlighten me?

You're right, it's impossible. Let's look at some examples.

Could a 15 year old geeks make a good operating system? They did, and it's one of the best in the world? Huh.

What about an encyclopedia, that's way too complex for a bunch of teenage volunteers to handle. What's that? It's better than anything else, and free as well?

But--but--my knee-jerk, dismissive attitude towards new ideas has always served me well, and I'm only 20!