2 ms·
What Fedora plans to do is to use a local resolver with a fallback in case DNSSEC doesn't work. By this trick they try to prevent the inevitable deployment prob
by hannob 10y ago
What Fedora plans to do is to use a local resolver with a fallback in case DNSSEC doesn't work.
By this trick they try to prevent the inevitable deployment problems of DNSSEC. Of course they also make it completely insecure and it doesn't make any sense.
- snuxoll 10y agoThe fallback is to be configurable, but breaking the entire UX is not desirable when a full recursive resolver is unable to function. Personally, I would like to see some indication as part of the GNOME Network icon whether the resolver is secure or not, but I have a hard time determining what that would look like and how to implement it without giving users false assurances or worrying them if they don't care. It's a tricky problem to solve, but Rome wasn't built in a day either. I'll probably disable the insecure fallback myself and only turn it on when I connect to my work VPN, I already don't trust public hotspots so unless I can connect to my OpenVPN server at home I don't use them.