3 ms·

This aligns with at least one person's predictions about the use of weak encryption and high margin for error of setting up and maintaining DNSSEC. He occasion

This aligns with at least one person's predictions about the use of weak encryption and high margin for error of setting up and maintaining DNSSEC. He occasionally presents on the "DNS Security Mess" and has long highlighted this among DNSSEC's various flaws, with examples of the screw ups so far and their consequences.

DrPhish 9y ago
Can you provide a name or a link? I just set up DNSSEC on my personal domains yesterday (got the DS records published), and would like to know what kind of pain I am potentially in for. Personal experience and insight would also be appreciated
- feelin_googley 9y ago
  "Can you provide a name or a link?" https://ianix.com/pub/dnssec-outages.html https://ianix.com/pub/dnssec-outages.html http://web.archive.org/web/20000824181520/http://cr.yp.to/djbdns/forgery.html http://web.archive.org/web/20000824181520/http://cr.yp.to/dj... https://media.ccc.de/v/27c3-4295-en-high_speed_high_security_cryptography https://media.ccc.de/v/27c3-4295-en-high_speed_high_security... http://cr.yp.to/talks/2017.09.18/slides-djb-20170918-dnssec-a4.pdf http://cr.yp.to/talks/2017.09.18/slides-djb-20170918-dnssec-... http://cr.yp.to/talks/2016.12.08/slides-djb-20161208-dnssec-a4.pdf http://cr.yp.to/talks/2016.12.08/slides-djb-20161208-dnssec-... http://cr.yp.to/talks/2016.06.10/slides-djb-20160610-a4.pdf http://cr.yp.to/talks/2016.06.10/slides-djb-20160610-a4.pdf http://cr.yp.to/talks/2015.12.17/slides-djb-20151217-a4.pdf http://cr.yp.to/talks/2015.12.17/slides-djb-20151217-a4.pdf http://cr.yp.to/talks/2013.12.27/slides-djb-20131227-a4.pdf http://cr.yp.to/talks/2013.12.27/slides-djb-20131227-a4.pdf http://cr.yp.to/talks/2013.02.07/slides.pdf http://cr.yp.to/talks/2013.02.07/slides.pdf http://cr.yp.to/talks/2012.11.16/slides.pdf http://cr.yp.to/talks/2012.11.16/slides.pdf http://cr.yp.to/talks/2012.06.04/slides.pdf http://cr.yp.to/talks/2012.06.04/slides.pdf http://cr.yp.to/talks/2009.10.30/slides.pdf http://cr.yp.to/talks/2009.10.30/slides.pdf http://cr.yp.to/talks/2009.08.11/slides.pdf http://cr.yp.to/talks/2009.08.11/slides.pdf http://cr.yp.to/talks/2009.08.10/slides.pdf http://cr.yp.to/talks/2009.08.10/slides.pdf http://cr.yp.to/talks/2009.06.27/slides.pdf http://cr.yp.to/talks/2009.06.27/slides.pdf http://cr.yp.to/talks/2009.06.24/slides.pdf http://cr.yp.to/talks/2009.06.24/slides.pdf http://cr.yp.to/talks/2009.03.21/slides.pdf http://cr.yp.to/talks/2009.03.21/slides.pdf http://cr.yp.to/talks/2009.03.20/slides.pdf http://cr.yp.to/talks/2009.03.20/slides.pdf http://cr.yp.to/talks/2009.03.17/slides.pdf http://cr.yp.to/talks/2009.03.17/slides.pdf http://cr.yp.to/talks/2009.03.04/slides.pdf http://cr.yp.to/talks/2009.03.04/slides.pdf http://cr.yp.to/talks/2009.03.03/slides.pdf http://cr.yp.to/talks/2009.03.03/slides.pdf http://cr.yp.to/talks/2009.03.02/slides.pdf http://cr.yp.to/talks/2009.03.02/slides.pdf http://cr.yp.to/talks/2008.09.22/slides.pdf http://cr.yp.to/talks/2008.09.22/slides.pdf http://cr.yp.to/talks/2008.08.22/slides.pdf http://cr.yp.to/talks/2008.08.22/slides.pdf http://cr.yp.to/talks/2007.03.20/slides.pdf http://cr.yp.to/talks/2007.03.20/slides.pdf http://cr.yp.to/talks/2007.02.02/slides.pdf http://cr.yp.to/talks/2007.02.02/slides.pdf http://cr.yp.to/talks/2006.10.17/slides.pdf http://cr.yp.to/talks/2006.10.17/slides.pdf http://cr.yp.to/talks/2006.08.28/slides.pdf http://cr.yp.to/talks/2006.08.28/slides.pdf http://cr.yp.to/talks/2004.04.28/slides.pdf http://cr.yp.to/talks/2004.04.28/slides.pdf http://cr.yp.to/talks/2003.03.18/slides.pdf http://cr.yp.to/talks/2003.03.18/slides.pdf http://cr.yp.to/talks/2003.02.11/slides.pdf http://cr.yp.to/talks/2003.02.11/slides.pdf "Personal experience and insight would also be appreciated" Personal experience: I never learned how to set up DNSSEC. It was a moving target at the time I became interested in DNS and as we know it has never been easy to set up. I did learn how to set up DNSCurve though. Insight: I have no great insight. Around 2008 when the BIND "experts" acknowledged the problems with forgery and started pushing DNSSEC again, I stopped using shared caches. I switched to local dnscache only. Hence I see never had any need for DNSSEC. Today I do not even use a local cache. I only use /etc/hosts and local authoritative servers, tinydns and nsd. This is mainly for speed and availability. To gather DNS data, I created a "nonrecursive resolver". It beats the speed of a cold cache.

DrPhish 9y ago

Can you provide a name or a link? I just set up DNSSEC on my personal domains yesterday (got the DS records published), and would like to know what kind of pain I am potentially in for. Personal experience and insight would also be appreciated

feelin_googley 9y ago
"Can you provide a name or a link?" https://ianix.com/pub/dnssec-outages.html https://ianix.com/pub/dnssec-outages.html http://web.archive.org/web/20000824181520/http://cr.yp.to/djbdns/forgery.html http://web.archive.org/web/20000824181520/http://cr.yp.to/dj... https://media.ccc.de/v/27c3-4295-en-high_speed_high_security_cryptography https://media.ccc.de/v/27c3-4295-en-high_speed_high_security... http://cr.yp.to/talks/2017.09.18/slides-djb-20170918-dnssec-a4.pdf http://cr.yp.to/talks/2017.09.18/slides-djb-20170918-dnssec-... http://cr.yp.to/talks/2016.12.08/slides-djb-20161208-dnssec-a4.pdf http://cr.yp.to/talks/2016.12.08/slides-djb-20161208-dnssec-... http://cr.yp.to/talks/2016.06.10/slides-djb-20160610-a4.pdf http://cr.yp.to/talks/2016.06.10/slides-djb-20160610-a4.pdf http://cr.yp.to/talks/2015.12.17/slides-djb-20151217-a4.pdf http://cr.yp.to/talks/2015.12.17/slides-djb-20151217-a4.pdf http://cr.yp.to/talks/2013.12.27/slides-djb-20131227-a4.pdf http://cr.yp.to/talks/2013.12.27/slides-djb-20131227-a4.pdf http://cr.yp.to/talks/2013.02.07/slides.pdf http://cr.yp.to/talks/2013.02.07/slides.pdf http://cr.yp.to/talks/2012.11.16/slides.pdf http://cr.yp.to/talks/2012.11.16/slides.pdf http://cr.yp.to/talks/2012.06.04/slides.pdf http://cr.yp.to/talks/2012.06.04/slides.pdf http://cr.yp.to/talks/2009.10.30/slides.pdf http://cr.yp.to/talks/2009.10.30/slides.pdf http://cr.yp.to/talks/2009.08.11/slides.pdf http://cr.yp.to/talks/2009.08.11/slides.pdf http://cr.yp.to/talks/2009.08.10/slides.pdf http://cr.yp.to/talks/2009.08.10/slides.pdf http://cr.yp.to/talks/2009.06.27/slides.pdf http://cr.yp.to/talks/2009.06.27/slides.pdf http://cr.yp.to/talks/2009.06.24/slides.pdf http://cr.yp.to/talks/2009.06.24/slides.pdf http://cr.yp.to/talks/2009.03.21/slides.pdf http://cr.yp.to/talks/2009.03.21/slides.pdf http://cr.yp.to/talks/2009.03.20/slides.pdf http://cr.yp.to/talks/2009.03.20/slides.pdf http://cr.yp.to/talks/2009.03.17/slides.pdf http://cr.yp.to/talks/2009.03.17/slides.pdf http://cr.yp.to/talks/2009.03.04/slides.pdf http://cr.yp.to/talks/2009.03.04/slides.pdf http://cr.yp.to/talks/2009.03.03/slides.pdf http://cr.yp.to/talks/2009.03.03/slides.pdf http://cr.yp.to/talks/2009.03.02/slides.pdf http://cr.yp.to/talks/2009.03.02/slides.pdf http://cr.yp.to/talks/2008.09.22/slides.pdf http://cr.yp.to/talks/2008.09.22/slides.pdf http://cr.yp.to/talks/2008.08.22/slides.pdf http://cr.yp.to/talks/2008.08.22/slides.pdf http://cr.yp.to/talks/2007.03.20/slides.pdf http://cr.yp.to/talks/2007.03.20/slides.pdf http://cr.yp.to/talks/2007.02.02/slides.pdf http://cr.yp.to/talks/2007.02.02/slides.pdf http://cr.yp.to/talks/2006.10.17/slides.pdf http://cr.yp.to/talks/2006.10.17/slides.pdf http://cr.yp.to/talks/2006.08.28/slides.pdf http://cr.yp.to/talks/2006.08.28/slides.pdf http://cr.yp.to/talks/2004.04.28/slides.pdf http://cr.yp.to/talks/2004.04.28/slides.pdf http://cr.yp.to/talks/2003.03.18/slides.pdf http://cr.yp.to/talks/2003.03.18/slides.pdf http://cr.yp.to/talks/2003.02.11/slides.pdf http://cr.yp.to/talks/2003.02.11/slides.pdf "Personal experience and insight would also be appreciated" Personal experience: I never learned how to set up DNSSEC. It was a moving target at the time I became interested in DNS and as we know it has never been easy to set up. I did learn how to set up DNSCurve though. Insight: I have no great insight. Around 2008 when the BIND "experts" acknowledged the problems with forgery and started pushing DNSSEC again, I stopped using shared caches. I switched to local dnscache only. Hence I see never had any need for DNSSEC. Today I do not even use a local cache. I only use /etc/hosts and local authoritative servers, tinydns and nsd. This is mainly for speed and availability. To gather DNS data, I created a "nonrecursive resolver". It beats the speed of a cold cache.