3 ms·

I have conflicting thoughts on this. I'm having a problem with the credibility of this whole thing. Very few people know about it. Twitter @dnsflagday has 94 fo

by tony_g 8y ago

I have conflicting thoughts on this. I'm having a problem with the credibility of this whole thing. Very few people know about it. Twitter @dnsflagday has 94 followers, telling me it's just an individual account with no public validation yet. The ISC.org site also doesn't seem to be authoritative. I understand the technical problem but I'm not convinced this is as big a deal as it seems. There are some big names associated with the flag day event, lending credibility. But there are also big names like Slack.com, Twitter.com, GitHub.com, BitBucket.com, and web hosting companies, that all fail the EDNS/dig test. So - the stated threat is that sites will go dark on 1 Feb, but do we really expect that to happen? Might these companies simply be threatening to reject invalid EDNS responses? Will people blame Them for rejecting queries rather than the services being resolved and their DNS? I can't decide if this is something to scream loudly about, or to just let it happen. I'm not asking for opinions on that. I'm asking for a credible source of information to confirm what is truly expected. Thanks.

roryokane 8y ago
The site doesn’t claim that slack.com, twitter.com, etc. will go down when the flag is flipped. Just try entering those domains into the testing widget within the “Domain owners” section, and you can see that their status is not so dire: > Minor problems detected! > This domain is going to work after the 2019 DNS flag day BUT it does not support the latest DNS standards. As a consequence this domain cannot support the latest security features and might be an easier target for network attackers than necessary, and might face other issues later on. We recommend your domain administrator to fix issues listed in the following technical report [link to report] As other comments have said, the new rule does not require that all domains support EDNS, merely that all domains respond with “EDNS not supported” when applicable instead of pretending that they support it. Those sites you linked follow that rule.

by tony_g 8y ago

roryokane 8y ago

The site doesn’t claim that slack.com, twitter.com, etc. will go down when the flag is flipped. Just try entering those domains into the testing widget within the “Domain owners” section, and you can see that their status is not so dire: > Minor problems detected! > This domain is going to work after the 2019 DNS flag day BUT it does not support the latest DNS standards. As a consequence this domain cannot support the latest security features and might be an easier target for network attackers than necessary, and might face other issues later on. We recommend your domain administrator to fix issues listed in the following technical report [link to report] As other comments have said, the new rule does not require that all domains support EDNS, merely that all domains respond with “EDNS not supported” when applicable instead of pretending that they support it. Those sites you linked follow that rule.