9 ms·

Obviously some resolvers are misconfigured and a depressingly large number of production DNS servers around the internet will be running remarkably outdated sof

by ifni 9y ago

Obviously some resolvers are misconfigured and a depressingly large number of production DNS servers around the internet will be running remarkably outdated software that couldn't handle the KSK rollover via the RFC 5011 method properly (though how many of these actually have DNSSEC enabled is an open question). For example, I've heard of resolvers breaking because they mishandled the transition and replaced KSK-2010 with KSK-2017 as soon as they got it. I saw the postponement late last night, and my immediate but completely untested pet theory is that the reason they're getting so many 'broken' resolvers running such new software (RFC 8145 was published in April 2017, unbound 1.6.4 was released June 27, 2017) is short-lived container instances that only have the old root trust anchor reporting in before they've had a chance to obtain the new KSK - if they even stay up long enough to get it. From the root-dnssec-announce mailing list, it sounds like more information is due Friday: "Duane Wessels started the research on this and has done a great job. He's presenting it at DNS-OARC in San Jose on Friday."

dogecoinbase 9y ago
I'm looking forward to the talk on Friday (and the easy conversation starter at NANOG... we can't keep talking about dying clock silicon forever)... but I absolutely agree with tptacek on this one, DNSSEC is worse than useless (solves no actual security problems; introduces many new problems; absurdly complex and poorly implemented across the board), and this doesn't help the optics one bit. I've gotten myself down to one DNSSEC zone I have to run (a .gov, lord help us all) and have been trying to get the resign going since the new key became available with literally zero forward movement. Lots of fun. (Aside: this was submitted previously but got no traction: https://news.ycombinator.com/item?id=15362516 https://news.ycombinator.com/item?id=15362516 Is this the dupe-detector-avoider in action?)
- kuschku 9y ago
  So, how do you suggest to replace DNSSEC then, assuming that your enemy is a nation state intercepting your DNS queries and responding with NSA QUANTUM before the legitimate server does?
  - wglb 9y ago
    Replace it with nothing.
    - kuschku 9y ago
      Great, then my entire TLS setup is useless, and I can just use plaintext HTTP. The whole point is that at least CAs enforce DNSSEC, so no one can get a certificate for my site except for me.

by ifni 9y ago

dogecoinbase 9y ago

I'm looking forward to the talk on Friday (and the easy conversation starter at NANOG... we can't keep talking about dying clock silicon forever)... but I absolutely agree with tptacek on this one, DNSSEC is worse than useless (solves no actual security problems; introduces many new problems; absurdly complex and poorly implemented across the board), and this doesn't help the optics one bit. I've gotten myself down to one DNSSEC zone I have to run (a .gov, lord help us all) and have been trying to get the resign going since the new key became available with literally zero forward movement. Lots of fun. (Aside: this was submitted previously but got no traction: https://news.ycombinator.com/item?id=15362516 https://news.ycombinator.com/item?id=15362516 Is this the dupe-detector-avoider in action?)

kuschku 9y ago
So, how do you suggest to replace DNSSEC then, assuming that your enemy is a nation state intercepting your DNS queries and responding with NSA QUANTUM before the legitimate server does?
- wglb 9y ago
  Replace it with nothing.
  - kuschku 9y ago
    Great, then my entire TLS setup is useless, and I can just use plaintext HTTP. The whole point is that at least CAs enforce DNSSEC, so no one can get a certificate for my site except for me.