4 ms·

You should read my initial comment. I wrote that I use my own cache bound to the loopback, and not shared with anyone. I asked what benefit I would get from D

by gwu78 11y ago

You should read my initial comment. I wrote that I use my own cache bound to the loopback, and not shared with anyone. I asked what benefit I would get from DNSSEC. Also, registrars, in general, are not known for their trustworthiness. This is a system for disseminating public data (i.e., it should be very boring), yet it has been turned into a "business". This is a recipe for deceit and that's why it is such a headache for ICANN or anyone else trying to police registrars. Now, please do not misunderstand, I am not suggesting your employer is not trustworthy. The sad truth, as revealed in com.zone and other large zone files, is that most of the domains registrars sell (rent) are garbage and only used for "domain parking" and serving ads. Indeed, the people selling DNS hardware, not to mention consulting, are benefitting financially from pushing DNSSEC. To me, that "gold-plated pipe" that I have full control over is far more important than any third party purporting to "sell" me an entry in a public zone file or to "authenticate" some public data on my behalf. I can create, retrieve and manage my own data. What I cannot control is the hostile network over which it is transferred. I like software that is aimed at that problem.

talideon 11y ago
No, no, I read it. The question is, where did you get that data in the first place, and how can you trust that it hasn't been tampered with between the authoritative nameservers and your local cache? That's where the benefit of DNSSEC is: it allows you to detect tampering, and you don't have to trust any intermediaries to do so. With DNSSEC, you don't have to trust the registrar, you don't have to trust the registry, you don't have to trust the recursive caches. In fact, you barely have to trust the root nameservers. The only individual you have to trust is the domain's owner. If any party along the way tries to play silly buggers, then you get a red flag. > This is a system for disseminating public data (i.e., it should be very boring), yet it has been turned into a "business". It's been turned into a business because somebody needs to run those nameservers and, like it or not, that costs money. > The sad truth, as revealed in com.zone and other large zone files, is that most of the domains registrars sell (rent) are garbage and only used for "domain parking" and serving ads. If a registrar has parked a domain, it's because the owner has done nothing with them, or the owner themselves has parked them for revenue. > Indeed, the people selling DNS hardware, not to mention consulting, are benefitting financially from pushing DNSSEC. Not that much: one of the strengths of DNSSEC is offline signing. The only benefit is that DNSSEC requires more traffic, but not dramatically much once a zone is cached. > To me, that "gold-plated pipe" that I have full control over is far more important than any third party purporting to "sell" me an entry in a public zone file or to "authenticate" some public data on my behalf. A gold-plated pipe full of slurry isn't much good. Again, all the encryption in the world isn't much good if you can't trust the data itself.
- gwu78 11y ago
  You seem to be assuming that registrars are exempted from this imaginary problem of "tampering". Why should I trust the registrar's data? (Your data.) Why should you trust the registry's data? Why should we trust ftp.internic.net? But I guess we can't be sure if ICANN's servers have been compromised, right? The truth is I am not too worried about the zone files I download. Thousands of people download com.zone every day. Millions download root.zone. And I do not care to play the "chain of trust" game that DNSSEC requires. Every DNS admin nowadays disables AXFR. They have their reasons. But to me the principle of downloading zones still makes perfect sense. I would not use axfr when ssh and rsync are available, but the point is the same. Why get IP addresses piecemeal when I can get them in bulk? Far more efficient. Not to mention reducing the number of opportunities for tampering.

by gwu78 11y ago

talideon 11y ago

No, no, I read it. The question is, where did you get that data in the first place, and how can you trust that it hasn't been tampered with between the authoritative nameservers and your local cache? That's where the benefit of DNSSEC is: it allows you to detect tampering, and you don't have to trust any intermediaries to do so. With DNSSEC, you don't have to trust the registrar, you don't have to trust the registry, you don't have to trust the recursive caches. In fact, you barely have to trust the root nameservers. The only individual you have to trust is the domain's owner. If any party along the way tries to play silly buggers, then you get a red flag. > This is a system for disseminating public data (i.e., it should be very boring), yet it has been turned into a "business". It's been turned into a business because somebody needs to run those nameservers and, like it or not, that costs money. > The sad truth, as revealed in com.zone and other large zone files, is that most of the domains registrars sell (rent) are garbage and only used for "domain parking" and serving ads. If a registrar has parked a domain, it's because the owner has done nothing with them, or the owner themselves has parked them for revenue. > Indeed, the people selling DNS hardware, not to mention consulting, are benefitting financially from pushing DNSSEC. Not that much: one of the strengths of DNSSEC is offline signing. The only benefit is that DNSSEC requires more traffic, but not dramatically much once a zone is cached. > To me, that "gold-plated pipe" that I have full control over is far more important than any third party purporting to "sell" me an entry in a public zone file or to "authenticate" some public data on my behalf. A gold-plated pipe full of slurry isn't much good. Again, all the encryption in the world isn't much good if you can't trust the data itself.

gwu78 11y ago
You seem to be assuming that registrars are exempted from this imaginary problem of "tampering". Why should I trust the registrar's data? (Your data.) Why should you trust the registry's data? Why should we trust ftp.internic.net? But I guess we can't be sure if ICANN's servers have been compromised, right? The truth is I am not too worried about the zone files I download. Thousands of people download com.zone every day. Millions download root.zone. And I do not care to play the "chain of trust" game that DNSSEC requires. Every DNS admin nowadays disables AXFR. They have their reasons. But to me the principle of downloading zones still makes perfect sense. I would not use axfr when ssh and rsync are available, but the point is the same. Why get IP addresses piecemeal when I can get them in bulk? Far more efficient. Not to mention reducing the number of opportunities for tampering.