Heroku encourages use of www. prefix for domains after DDoS

http://status.heroku.com/incident/156

by erikpukinskis • 15 years ago

131 42 15 years ago

status.heroku.com

yuvadam• 15 years ago

This is an interesting point. The www. prefix seems to be slowly fading away from the landscape, but URLs without the prefix never felt like first-class citizens on the web.

The inability to use CNAMEs in root level domains also affects other aspects, such as load balancing [1].

[1] http://blog.y3xz.com/post/3920967238/the-anomaly-of-amazon-e...

delinka2• 15 years ago

My reading of the heroku post seemed to indicate that the recommendation is for heroku customers only. Of course, if your own systems are using reverse proxy to serve up content, then the advice may also apply to you.

hassy• 15 years ago

I think "www" will make a comeback with increasing popularity of non .com/.net/.org TLDs. "whatever.io" looks like a web address to most of us here, but not to many others, even computer-savvy "normals".

temptemptemp13• 15 years ago

But the webadmin of "whatever.io" is probably too cool to consider "www.whatever.io" as a viable web address for a startup company.

tybris• 15 years ago

Seems like Amazon is addressing this

https://forums.aws.amazon.com/thread.jspa?threadID=67849&...

biot• 15 years ago

Might this be an argument for a new DNS record which acts like CNAME but doesn't have the restriction there be no other records for the same host? Something that functions like an A record but tells the querying software that it should use the IP address from the A record of the returned hostname. An "ALOOKUP" record if you will.

btilly• 15 years ago

It has frustrated me for years that DNS recognized that mail might like to have multiple hosts that can respond to a domain, but failed to recognize that there might someday be other protocols that would like the same.

lmz• 15 years ago

Isn't that what SRV is for? It even has priorities. Not that web browsers use it to locate web servers, of course...

athst2• 15 years ago

They should update their dev center docs with this! I just followed their own instructions to set up DNS, which are to put in the IP addresses rather than the proxy. Kinda funny this came up right after I did it.

athst2• 15 years ago

nvm, I misread - they're only talking about subdomains and not the primary domain

Joakal• 15 years ago

What's the point in a random DDoS against Heroku?

delinka2• 15 years ago

I often get questions like this from non-tech folk. "Why would someone hack my computer? Why would they attack my little web site?"

And often it's simply "because they can."

JakeSc• 15 years ago

Increasingly, however, the answer has had more to do with economics, rather than bragging rights.

nikcub• 15 years ago

more than likely a DDoS against a site they are hosting. The attackers probably don't know and don't care who Heroku are

jacques_chester• 15 years ago

It might be the prelude to an extortion attempt.

erikpukinskis• 15 years ago

My first reaction was that this is a crock... after all, don't all the big hot internet companies use root domains? But I looked into it, and Facebook, Google, Apple (and Heroku) .coms all redirect to www. Only Twitter rocks the bare root domain.

I rely heavily on root domains in my printed materials (sending people to sproutrobot.com/water and such), but I'm starting to think redirecting users to www--so bookmarks, social media and the like point there and the majority of my users hit www first--is a good idea.

ryantownsend• 15 years ago

If you were worried about non-www links working during downtime/issues, you could setup multiple cheap hosts around the world with nothing more than a rewrite to the www. subdomain (where your main app is hosted). Then add the multiple IPs to your root domain's A records - that way you have no configuration to worry about (the non-www hosts literally just redirect to the same path on a different domain), and you don't have to worry about those redirects going down due to DNS round robin on multiple hosts.

billpg• 15 years ago

I'd be surprised if there isn't someone offering this as a service already.

pimeys• 15 years ago

Amazon's Elastic Load Balancer supports only CNAMEs, so a redirect to www subdomain is the only option for us to use the load balancer, and I think the situation won't get any better...

ab9• 15 years ago

NearlyFreeSpeech.NET, a popular web host, has recommended this for years.

http://faq.nearlyfreespeech.net/section/domainnameservice/ba...

franze• 15 years ago

i want to bring up another - unrelated - point for "why a www subdomain is a good idea". the answer is: stupid CMS. forums, comment sections, press release distribution services, ... sometimes have issues to correctly transform non-www domain names into clickable links.

danneu• 15 years ago

aren't most cases triggered by "http:// rather than "www"?

rlpb• 15 years ago

SRV would fix this, but support is still lacking in Firefox in an eleven year old bug: https://bugzilla.mozilla.org/show_bug.cgi?id=14328

As far as I am aware, no other browser supports it either.

jwr2• 15 years ago

What is the difference between an A record for a domain with a short TTL and a www CNAME with a short TTL?

In other words, doesn't a short TTL get you essentially the same thing?

mjs• 15 years ago

Good question. Is there an AWS limitation in there somewhere?

SpikeGronim• 15 years ago

No, it is a DNS RFC standard behavior: http://stackoverflow.com/questions/3829966/cname-for-top-lev...

mseebach• 15 years ago

A records are name-to-IP, CNAME are name-to-name. When you control everything, you're right, no big deal. But in this case, customers control the DNS and Heroku the servers. Using CNAME to point to an A record at Heroku allows them to decide what IP the traffic goes to. If you use an A record, Heroku is SOL if they need the traffic to go to a new IP.

Posterous has a similar problem last august. They urgently needed to change to a new IP, but all their clients were setup with A-records. Painful.

ez77• 15 years ago

...Heroku is SOL if they need...

Off topic, what's the meaning of SOL in this context?

jwr2• 15 years ago

Ok. So I'm correct in thinking that for my own domains that I manage it boils down to the same thing, e.g. there is no reason to prefer www CNAMEs over domain A records.

Just wanted to check if I'm missing something.

cagenut• 15 years ago

Seriously a SYN flood? How 90's.

Side affect of running on AWS, you can't use a "real" firewall.

Even then don't they use ha-proxy up front? I'm surprised this was an issue.

jemfinch• 15 years ago

HA Proxy isn't going to protect their pipe from congestion. Null routing the ip that's getting flooded will.

kordless• 15 years ago

Until someone builds an attack suite that re-resolves the names in the middle of the attack.

smountcastle• 15 years ago

I wonder if Heroku could benefit from some DDoS protection such as this: http://verisigninc.com/en_US/products-and-services/network-i...

norova• 15 years ago

For what it's worth, CloudFlare (http://www.cloudflare.com) allows the use of CNAMES for the root domain.

SwellJoe• 15 years ago

That would be a violation of the DNS specification, and won't work with DNS servers that are compliant to the specification (i.e. BIND). Section 2.4 of 1912:

2.4 CNAME records

   A CNAME record is not allowed to coexist with any other data.  In
   other words, if suzy.podunk.xx is an alias for sue.podunk.xx, you
   can't also have an MX record for suzy.podunk.edu, or an A record, or
   even a TXT record.  Especially do not try to combine CNAMEs and NS
   records like this!:


           podunk.xx.      IN      NS      ns1
                           IN      NS      ns2
                           IN      CNAME   mary
           mary            IN      A       1.2.3.4


   This is often attempted by inexperienced administrators as an obvious
   way to allow your domain name to also be a host.  However, DNS
   servers like BIND will see the CNAME and refuse to add any other
   resources for that name.  Since no other records are allowed to
   coexist with a CNAME, the NS entries are ignored.  Therefore all the
   hosts in the podunk.xx domain are ignored as well!

WALoeIII• 15 years ago

The limitation of the root can (and will, I predict) be overcome by combining host and dns provider APIs. If Heroku had a way to push A record changes up to applications using their infrastructure they would be able to deal with this sort of issue.

This is also the promise of Amazon's Route 53 combined with their Elastic Load Balancing service which I hope will be released soon. Your DNS could dynamically serve A record IPs for the ELB, and you save the client the 2nd DNS resolution for the CNAME, faster and more dynamic.

For more: https://forums.aws.amazon.com/thread.jspa?threadID=63893&...

mikey_p2• 15 years ago

This is pretty much par for the course with 90% of the 'cloud' offerings out there. This is also true with various hosted application platforms where you can add a custom domain for your blog or whatever.

There's just no way to ever rely on a single IP and guarantee that it will be stable for consumers, without failover. Even your ISP gives you two nameservers for that reason.

Heroku encourages use of www. prefix for domains after DDoS

Related Stories