NLnet Labs with Arya Khanna and Martin Hoffmann

Every time you load a website, send an email, or update an app, you're quietly relying on a handful of unglamorous services that route your packets to the right place: DNS to translate names into addresses, and BGP to figure out how to actually get there. When these systems break, or get attacked, the Internet doesn't just slow down but stops working. For more than 25 years, NLnet Labs has been one of the small, non-profit teams keeping that core infrastructure running. Their software, including the DNS servers NSD and Unbound, the RPKI tools Krill and Routinator, and the new DNSSEC signer Cascade, is deployed everywhere from hobbyist Pi-Hole setups to Let's Encrypt and major Internet operators. And increasingly, it's written in Rust! In this episode, I talk to Arya Khanna and Martin Hoffmann from NLnet Labs about what it takes to maintain critical Internet infrastructure as a small team, why they bet on Rust for new projects like the domain crate and Cascade and what the rest of us can learn from a codebase whose users include the people who keep your routes flowing. About NLnet Labs NLnet Labs is a non-profit foundation based in Amsterdam that develops open source software and open standards for the core infrastructure of the Internet. Since 1999, the small but dedicated team has built some of the most widely deployed building blocks of the modern web, including the authoritative DNS nameserver NSD, the recursive DNS resolver Unbound, and the RPKI tools Krill and Routinator, which secure global Internet routing. Their work is trusted by operators ranging from hobbyist Pi-Hole users to Let's Encrypt and major Internet service providers. In recent years, NLnet Labs has been steadily moving its new development to Rust, with projects like the domain crate and the Cascade DNSSEC signer leading the way. Links From The Episode NSD - NLNet Labs' first projectlychee - A link-checker that receives funding from NLNet (not NLNet labs!)unbound - A DNS server like BIND, but only for recursive queriesCascade - The new DNSSEC signing solution from NLNet LabsPi-Hole - A small usecase for unboundLet's Encrypt - A big user of unbound with scale and security requirementsAsahi Linux - Linux on Apple Silicon, mostly with RustBinder CVE - A CVE in RustLDNS - A collection of DNS functions, written in C, now in maintenance modedomain - The new collection of DNS functions, written in Rusttokio - The biggest shared dependency across the Rust ecosystem, first announced in 2017Rust in Production: Helsing with Jon Gjengset - You can take generics too farbytes - Tokio's Arc of bytesArc Welding - The other type of "fixing"Alejandra González' crate dependency analysis - 46% of published crates depend directly on tokioRPKI - Signing and validating IPs and routing informationRoutinator - A RPKI validator, one of the first Rust applications in productionhyper - The ubiquitous HTTP crateKrill - The RPKI Certificate Authority tool with "fun" shutdown codeRoto - Tert's scripting language, used by another NLNet Labs project, Rotonda Official Links NLnet Labs WebsiteArya Khanna's WebsiteArya Khanna on GitHubArya Khanna on MastodonMartin Hoffmann on GitHubMartin Hoffmann on Mastodon