4 ms·
> DNSSEC, which tptacek has repeatedly criticized FWIW, tptacek's argument in that thread seems to be premised on certificate pinning being widely deployed[1],
by Ajedi32 8y ago
> DNSSEC, which tptacek has repeatedly criticized
FWIW, tptacek's argument in that thread seems to be premised on certificate pinning being widely deployed[1], which it's not, and it seems at this point like it never will be[2].
[1]: https://news.ycombinator.com/item?id=10553608 https://news.ycombinator.com/item?id=10553608
[2]: https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/he9tr7p3rZ8/eNMwKPmUBAAJ https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...
- tptacek 8y agoNo. I like pinning (which is widespread outside of browser applications) and certainly it's better than DNSSEC, but my argument holds together just fine without it. It hardly matters at this point, though. DNSSEC is a dead letter. It's over. Stick a fork in it. It'll be around indefinitely for performative nerds to performatively noodle with --- lots of dead IETF protocols are! --- but Cloud Flare is likely to be the largest company ever to use it (and they're the exception that proves the rule, since they sell DNSSEC services).