4 ms·

I'm looking forward to the talk on Friday (and the easy conversation starter at NANOG... we can't keep talking about dying clock silicon forever)... but I absol

I'm looking forward to the talk on Friday (and the easy conversation starter at NANOG... we can't keep talking about dying clock silicon forever)... but I absolutely agree with tptacek on this one, DNSSEC is worse than useless (solves no actual security problems; introduces many new problems; absurdly complex and poorly implemented across the board), and this doesn't help the optics one bit. I've gotten myself down to one DNSSEC zone I have to run (a .gov, lord help us all) and have been trying to get the resign going since the new key became available with literally zero forward movement. Lots of fun. (Aside: this was submitted previously but got no traction: https://news.ycombinator.com/item?id=15362516 https://news.ycombinator.com/item?id=15362516 Is this the dupe-detector-avoider in action?)

kuschku 9y ago
So, how do you suggest to replace DNSSEC then, assuming that your enemy is a nation state intercepting your DNS queries and responding with NSA QUANTUM before the legitimate server does?
- wglb 9y ago
  Replace it with nothing.
  - kuschku 9y ago
    Great, then my entire TLS setup is useless, and I can just use plaintext HTTP. The whole point is that at least CAs enforce DNSSEC, so no one can get a certificate for my site except for me.