Skip to content

Conversation

@luke-jr
Copy link
Member

@luke-jr luke-jr commented Dec 27, 2023

To avoid issues with DNS blacklisting, I've setup a separate domain for my DNS seed.

Like #28936

I've chosen a domain name that is explicitly verbose about its purpose and the possibility of malware on resolved IPs, to go an extra mile in helping avoid any attempts to abuse it.

To avoid issues with DNS blacklisting, I've setup a separate domain for my DNS seed.
@DrahtBot
Copy link
Contributor

DrahtBot commented Dec 27, 2023

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage

For detailed information about the code coverage, see the test coverage report.

Reviews

See the guideline for information on the review process.

Type Reviewers
Concept NACK petertodd, 1440000bytes

If your review is incorrectly listed, please react with 👎 to this comment and the bot will ignore it on the next update.

Conflicts

No conflicts as of last run.

@luke-jr
Copy link
Member Author

luke-jr commented Dec 27, 2023

Note that the current domain name continues to resolve for now; I'm just preemptively doing this in case it becomes a bigger issue in the future.

Copy link
Contributor

@mzumsande mzumsande left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@luke-jr : Slightly unrelated to this PR, but looking at the results from all seeders, it seems that yours returns only nodes running old versions 0.21.x and 22.x. I didn't get a single result with a newer subversion.
Given the current composition of nodes on the network and that none of the other DNS seeds show a similar pattern, this seems unlikely to just be an unlucky result of a random selection. Could this be a bug in your seeder?

@Emzy
Copy link
Contributor

Emzy commented Dec 28, 2023

DNS points to the same host.

dnsseed.bitcoin.dashjr.org. 40000 IN	NS	ipv4.jun.dashjr.org.
dnsseed.bitcoin.dashjr-list-of-p2p-nodes-maybe-malware.us. 39994 IN NS ipv4.jun.dashjr.org.

So should be no difference is answers.

@fanquake
Copy link
Member

The main outcome I can see from this change is confusion from (maybe less-technical) users, when they see this unusual domain / maybe-malware printed to their console/logs:

2023-12-28T11:54:27.034530Z [dnsseed] Loading addresses from DNS seed dnsseed.bitcoin.dashjr-list-of-p2p-nodes-maybe-malware.us.

I don't think we should ship software that will do that.

@petertodd
Copy link
Contributor

I agree with @fanquake, so NACK the choice of domain name.

Anyone who actually sees the domain name used and uses it for some purpose will very likely be able to understand that these IP addresses may be anything, so there is no need for this disclaimer. Meanwhile, putting malware in the name just invites confusion and unnecessary support requests from curious people who don't understand what they are seeing.

@luke-jr
Copy link
Member Author

luke-jr commented Dec 28, 2023

Seems like if debug log is the concern, we could just mask it there... Doesn't seem like a good reason to make it easier for scammers by removing the warning?

@1440000bytes

This comment was marked as abuse.

@glozow
Copy link
Member

glozow commented Jan 2, 2024

I've chosen a domain name that is explicitly verbose about its purpose

Er, how is "maybe malware" the purpose of the seeder? It seems like this would just confuse/alarm users, maybe choose something else instead. I don't think adding a log filter makes sense either.

@luke-jr
Copy link
Member Author

luke-jr commented Jan 3, 2024

The DNS seeds resolve to IPs of random peers. It's entirely possible (and apparently reality) that some of those host malware. Putting maybe-malware in the name cautions users who might put the domain in a browser, that whatever loads could be malicious.

It seems like a low-cost improvement to avoid abuse IMO, but if there's a hard objection to it, I can come up with another domain for it.

@ajtowns
Copy link
Contributor

ajtowns commented Jan 5, 2024

The DNS seeds resolve to IPs of random peers. It's entirely possible (and apparently reality) that some of those host malware.

It's entirely possible that one could be hosting a nascent superintelligence that's just escaped from a AI lab, but you're not adding "maybe-superintelligence" to the name. Even more likely for some of them to be chainanalysis spy nodes, or any number of other potentially worrying things.

FWIW, knots hasn't yet been updated to be malware adjacent: https://github.com/bitcoinknots/bitcoin/blob/aed49ce8989334c364a219a6eb016a3897d4e3d7/src/kernel/chainparams.cpp#L135

@fanquake fanquake marked this pull request as draft January 15, 2024 16:24
@fanquake
Copy link
Member

but if there's a hard objection to it, I can come up with another domain for it.

I'd say objections to your current choice of domain name have been made clear from various contributors. Along with objection to changing any logging to accomodate it. Moved this to draft for now. Feel-free to undraft with a different domain etc.

@fanquake
Copy link
Member

Given it's been more than a month, and there's no more followup here, I'm going to close this for now. Feel free to ping for a re-open, if/when you've picked a more suitable domain name.

@fanquake fanquake closed this Feb 20, 2024
@bitcoin bitcoin locked and limited conversation to collaborators Feb 19, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants