2 ms·
I seriously don't understand why you are so much against DNSSEC. Just about every HN article that involves DNS had one of your anti-DNSSEC rants in them. Yes,
by LeonM 8y ago
I seriously don't understand why you are so much against DNSSEC. Just about every HN article that involves DNS had one of your anti-DNSSEC rants in them.
Yes, we know DNSSEC has some flaws, but how is DNSSEC worse than the alternative, which is no zone signing at al?
> if you screw the deployment of DNSSEC up, sites vanish off the Internet.
If you screw up your TLS certificate, your site also vanishes off the internet, should we also give up on HTTPS then?
- tptacek 8y agoDNSSEC is much worse than the alternative, which is no zone signing at all. If you screw up your TLS certificate, your site does not vanish off the Internet. DNSSEC is something I've studied and worked on (I'm one of [I assume] the few people on this site that has built a working implementation of it) for going on two decades right now. Sorry, I have opinions and a position on it, they're informed opinions, and you're going to have to suffer them.