3 ms·
On most desktop Linuces I've dealt with, the "stub resolver" is dnsmasq, which is quite full-featured and DNSSEC-capable... except that distributions don't enab
by azernik 11y ago
On most desktop Linuces I've dealt with, the "stub resolver" is dnsmasq, which is quite full-featured and DNSSEC-capable... except that distributions don't enable the feature or distribute a trust anchor. But there aren't any deep structural problems preventing them from flipping the switch [1] - not like, say, the deep coupling between layer 3 and layer 4 that killed SCTP and other TCP/UDP alternatives in practice.
[1] For example, this configuration change is all that's required to enable DNSSEC on Gentoo, and would probably also work on Ubuntu and Fedora: https://wiki.gentoo.org/wiki/Dnsmasq#DNSSEC https://wiki.gentoo.org/wiki/Dnsmasq#DNSSEC
- tptacek 11y agoI'm happy to concede that the desktop Linux people don't have this issue. We should look into DNSSEC once Linux wins the desktop.
- azernik 11y agoLinux is a test case. If you can get Linux to use DNSSEC without cooperation from intermediate routers and caches, then it's just single-organization engineering work - Apple and Microsoft would need to write DNSSEC-capable client implementations (which Microsoft already has for Windows Server) and deploy them. This is an OS feature like any other OS feature. The obstacles to changing to IPv6, or to making any changes whatsoever to TCP, just aren't there.
- tptacek 11y agoAnd so it took 21 years to get to this point with DNSSEC because...
- azernik 11y agoBecause it takes non-zero work, and doesn't add much value on top of SSL/TLS, which got wide deployment first. As far as I understand, IPSec + DNSSEC gets similar security guarantees to SSL/TLS without identity certification, so once you have one there isn't any real economic incentive to put massive effort into developing the other.