3 ms·
Let's Encrypt, and pretty much any other CA, will issue me a TLS cert based on what they find in DNS. So how's that for circular reasoning :) But seriously, wo
by AndyMcConachie 10y ago
Let's Encrypt, and pretty much any other CA, will issue me a TLS cert based on what they find in DNS. So how's that for circular reasoning :)
But seriously, wouldn't it be better if DNS wasn't so insecure? Or do you think that DNS being insecure provides a net good?
- tptacek 10y agoNo, it wouldn't be better if DNS was less insecure: applying cryptography to address security problems adds cost (along several dimensions), and those costs outweigh the marginal benefit. It's like asking, "wouldn't the Internet be better if ARP were secure?"
- AndyMcConachie 10y agoI don't get the Internet ARP reference? That's just false equivalence. I think we're just going to continue to disagree. We've argued over DNSSEC on HN many times and it's clear to me we don't see eye-to-eye. That's fine, and I respect your opinion. I just think you're wrong, and I doubt anything you say will convince me otherwise.