4 ms·
For DNSSEC: it depends, I don’t think many clients hardfail yet. For HTTPS: if you can BGP attack, theoretically you could get a TLS certificate issued. There
by Operyl 8y ago
For DNSSEC: it depends, I don’t think many clients hardfail yet.
For HTTPS: if you can BGP attack, theoretically you could get a TLS certificate issued.
There’s a lot of ifs on both those roads, though.
- snuxoll 8y agoProbably a good use case to pin the certificates for your upstream DNS resolvers if you're using DNS over TLS/HTTPS.
- Operyl 8y agoYeah. As of right now there’s no absolutely fool proof way to ensure all clients aren’t possibly going to slip through some crack, and I’m not sure if we’ll ever get there.