Fedimint's reliance on DNS is recently causing 2 federations freezing issues

[Accardo]

Two federations on fedimint; federation one and Bitcoin principal federation is facing a DNS issue, and users under the federation are not able to move their money, despite being assured of the safety of their funds.

According to sources, a guardian using an xyz extension had the domain placed on automated server hold as a blacklist service flagged them. And this always occur with .xyz domain extensions.

Developers made calls on ways to swap the DNS, but it's quite impossible and would require a hotfix upgrade for the transaction process to continue. This means that, aside the hotfix upgrade, the federation won't work until the guardian is back online.

Looking at the current reliance of fediment on DNS it's quite unsafe, because it's something the community cannot control, and members who have their funds in the above mentioned federation should move their money whenever a quorum of guardians comeback online.

Fedimint guardians are basically the technically trusted members in control of the set up and running of the federation's Chaumian eCash system. Read more https://fedimint.org/docs/GettingStarted/What-is-a-Fedimint

What do you think of Fedimint and its dependence on DNS? Would it be complex to set up a federation mint that wouldn't need DNS for a federation to process payment swiftly?

https://github.com/fedimint/fedimint/issues/5482  going through this link some developers are looking at changing it from DNS to IP, though some responses object to this as not being completely meaningful in solving the DNS problem.

Source: https://twitter.com/MutinyWallet/status/1805346636660429021?t=qbGpyZgN7cPUP9yNKK8ZIg&s=19

[DaveF]

Unless you have your own AS number https://www.arin.net/resources/guide/asn/ and your own IP space relying on IPs instead of DNS just moves the problem.
Your static IPs are only as static as your ISP is good.

What they should be doing is having multiple domains all pointing back to the same place.

davef.com
davef.net
davef.me
davef.org
davef.xyz
davef.win
davef.biz

and so on.

They should mandate that the names are at least at 3 separate accredited registrars AND the DNS are at at least 3 separate hosts.

Done & solved.

-Dave

[ABCbits]

One weird thing is they can afford server to run the guardian, but they decide to save money by buying xyz domain. I don't see how the root of the problem can be solved without letting guardian have ability notify the network that their address (whether it's IP, domain or onion address) has been changed.

[DaveF]

One weird thing is they can afford server to run the guardian, but they decide to save money by buying xyz domain. I don't see how the root of the problem can be solved without letting guardian have ability notify the network that their address (whether it's IP, domain or onion address) has been changed.

I can see why they would not want to do it that way. Same reason the seed nodes in core are hard coded. You need some trusted things.

But, as I said they need more then a single point of failure. Having multiple TLDs all with the same name point to something allows for better control.

Actually makes it more secure if they want. You must query all names, and x of y must match. This way if someone gets control of davef.com but all the others I listed are different then it really does not matter. If instead of being blocked imagine the extra chaos if someone got the domain and was hosting their own malicious guardian on the xyz domain that was blacklisted.

-Dave