Jan-Piet Mens

I'm going to refer to Philosophy of Computer Science ( https://news.ycombinator.com/item?id=20912718 https://news.ycombinator.com/item?id=10388603 ) and say "its not an easy or decided problem".

Section 3 has about 100 pages (in the pdf - I'd have to dig around to find the hard copy) that tries to look into what computer science is. Section 3.10 starts comparing it with engineering... and noting that it's looking at computer science rather than programing aspect of it. Part of the questions being asked is "is computer science a science?"

I'm going to highly recommend the book for those interested in these questions. I'll also point out that across its thousand(!) pages, this book is in large part a survey of the literature of tens of thousands of more pages on the subjects.

I don't believe that most people are approaching software development (be it called computer science or software engineering) with either the mindset of a scientist or an engineer (there are times when one of those mindsets is necessary) Rather, I agree with a later section in it...

3.14.7 Is CS Magic? The great science-fiction author Arthur C. Clarke famously said that “Any sufficiently advanced technology is indistinguishable from magic” (http://en.wikipedia.org/wiki/Clarke’s_three_laws). Could it be that the advanced technology of CS is not only indistinguishable from magic, but really is magic? Not magic as in tricks, but magic as in Merlin or Harry Potter? As one CS student put it, …

Another option is to stand up a DNS server that knows how to do something like BIND 9's Response Policy Zone [0][1].

Although figuring out how to propagate RPZ changes to them isn't exactly straightforward (more on this below), if you're using BIND, you can set up views that match certain clients and provide one mix of RPZs to one set, and another to another set.

On updating RPZs in a view (warning: BIND 9-specific instructions follow) :

So, BIND has this nifty option for a zone called "in-view". This lets you say "The data for this particular zone lives in this other view, so when requests come in for this zone, in this view, use the data in this other view.". It might sound complicated, but it's really just a pointer to a pre-existing zone definition. This lets you define your master zones in one big "zone definition" view, and have client-specific views refer back to those definitions.

However, you can't use in-view with RPZs. Why? Who knows? [2] But, what you can do is this:

* Create one unique RNDC key per view

* Add an allow-notify and match-clients entry in each view with that view's key

* In the appropriate views, add a slave zone definition for each relevant RPZ, with localhost as the master, and whatever is your usual domain xfer key as the key [3]

* Back up in your "zone definition" view, add to your also-notify list for each master RPZ definition an entry for localhost and each view key. [4] Having an ACL just for these RPZ slaves cleans up the RPZ…

This is really nice information. Thank you!

FWIW we have recently acquired funding to demonstrate that GNS can handle large size zones by migrating TLD zones (available through AXFR for now, the number of zones supporting hat is, eh, marginal [1]) to GNS which delegate back into DNS (using [2]).

This allows GNS users to (partially) circumvent the root and manually manage their local root namespace as envisioned for GNS [3].

We think that shipping default configurations and allowing users to modify/enhance that locally is how governance should look like from the user's perspective.
If you want ICANN as default -> use the ICANN default configuration... if you need to override a censored/censoring registry, you can do that too... etc

[1] https://jpmens.net/2021/05/18/dns-open-zone-data/
[2] https://www.ietf.org/archive/id/draft-schanzen-gns-21.html#name-gns2dns
[3] https://www.ietf.org/archive/id/draft-schanzen-gns-21.html#name-start-zones

Well, ansible by default runs with paramiko which is a python implementation of SSH protocol. It will also keep connections open for multiple commands. It also has a pull mode and it also has a fireball mode which uses 0mq:

http://jpmens.net/2012/10/01/dramatically-speeding-up-ansible-runs/

However, you're not forced to use this. In the beginning, you can just seed your CentOS or debian with a Kickstarter or seed file and then run your inital thing with ansible simply over ssh (using all the goodies, ssh-agent, password less ssh etc..).

One huge plus for ansible is also that it used yaml which is rather simple. I've been following both project for >1 year and it seems that recently ansible has picked up a lot and will probably make the "race" (IMO).

I am just stopping by to say that this is actually a thing. It is called hesiod and works great in small, maybe air-gapped networks.

As a side note, anything security related exists in the reality of uncertainty. It is expected that sharing properly secured secrets is reasonably safe, but day after day we discover "we didn't know". Sometimes simplicity for a particular application is worth certain amount of risk.

Sometimes, you need to take the server out of its box, out of the bunker, and plug it to both the power distribution network, and of course... a LAN...

For quick reference:
- https://en.m.wikipedia.org/wiki/Hesiod_(name_service)
- https://jpmens.net/2012/06/28/hesiod-a-lightweight-directory-service-on-dns/

If it is for executing some script on successful connection of any device to wifi (and thus an IP is assigned), with dhcpd, it can be achieved with the following config:

subnet 192.168.1.0 netmask 255.255.255.0 {
on commit {
set ip = binary-to-ascii (10, 8, ".", leased-address);
execute ("/usr/local/bin/on-device-connect", "commit", ip);
}
}

I have setup exactly this to automate stuff unlocking the door in my office (in the morning, whenever some one arrives and phone connects to wifi).

My original source: http://jpmens.net/2011/07/06/execute-a-script-when-isc-dhcp-hands-out-a-new-lease/

Edit: Fix code formatting.