2 ms·
Argument that "At the time, some 4–5% of users couldn't lookup that record; we assume because the network wasn't transparent to non-standard DNS resource types.
by garaetjjte 10y ago
Argument that "At the time, some 4–5% of users couldn't lookup that record; we assume because the network wasn't transparent to non-standard DNS resource types." doesn't make sense for DNSSEC, because it requires signed explicit information that record not exist. If server won't return it, then it is broken and needs to be changed.
Yes, there is HPKP, but it is "Trust on First Use" and adds entropy for browser fingerprinting.
- tptacek 10y agoEverything adds entropy for user fingerprinting. That argument is about as valid as "DNSSEC is an enormous vector for DDOS" (it is, but so is everything else). Meanwhile: it's "trust on first use" for individual connections, but if you break a pin, your browser vendor will find out. It doesn't matter if a pin is broken for a minor reason or because some CA in Uzbekistan falsified the entire chain: either way, shenanigans get CAs penalized. It's happened repeatedly and will happen more and more.