4 ms·
> it vanished for Comcast users whose DNS servers at the time enforced DNSSEC Interestingly, Comcast had their own DNSSEC outage earlier today: https://ianix.
by Panino 9y ago
> it vanished for Comcast users whose DNS servers at the time enforced DNSSEC
Interestingly, Comcast had their own DNSSEC outage earlier today:
https://ianix.com/pub/dnssec-outages/20170928-comcast.com/ https://ianix.com/pub/dnssec-outages/20170928-comcast.com/
> Enough is enough! Kill DNSSEC and go back to the drawing board.
Yeah, at this point it boggles the mind at how people can continue to support this foot cannon -- even the main backers can't get it right. I don't blame them for outages because DNSSEC is absurdly overly complicated, to the point it almost seems designed to fail. Part of me wonders if elements of the consensus design process made it that way, trying to prevent secure DNS from coming about. So far they've succeeded.
- tptacek 9y agoIt seems patently obvious to me that if they had the luxury of a clean slate design (which they do, but have denied themselves in as clear an instance of what Sartre would call "bad faith" as I've seen since I was forced to read Sartre in high school), the IETF would come up with a very different system than DNSSEC. They'd eliminate the "offline signer" requirement and come up with a massively simpler system. Instead, they took a dented-up whiffle ball of a protocol that some rando at TIS Labs hucked over to them in 1995 and have spent the last 20 years trying to play Major League Baseball with it by wrapping more and more duct tape around it. I don't think a lot of DNSSEC advocates really appreciate how clear the lineage of this protocol is back to a DoD contract project from the 90's. That really is what they're trying to deploy.