10 ms·
I think it means 'if you have a hacked DNS server that has all kinds of custom code to talk to databases, or other resources, then you will find that off the se
by phicoh 8y ago
I think it means 'if you have a hacked DNS server that has all kinds of custom code to talk to databases, or other resources, then you will find that off the self DNS servers with DNSSEC will not support your hacks'.
Note that DNSSEC implementations started out with offline signing, both for performance and security.
I guess you can do geo-routing with offline signing as well. But some people find it easier to complain about new technology then to spend some effort making it work.
There are now also DNS servers that do online DNSSEC signing.
- tptacek 8y agoEssentially all non-toy real-world deployments of DNSSEC (perhaps outside of the DNSSEC root and TLD infrastructure itself) requires online signers, not just for basic operational reasons but because online signing is how defense against zone dumping (NSEC+"whitelies") works. So, yes, there are definitely servers that do online signing. But then you're left wondering: why would we deploy a protocol that took profound tradeoffs to facilitate offline signing, when it turns out most of the real-world use cases were going to be online? If the protocol had been designed for online signers in the first place, it would be cleaner and more powerful in a bunch of different ways. Instead, DNSSEC advocates propose that --- despite the fact that the industry has essentially not meaningfully deployed the protocol yet, after 25 years of standardization effort --- we just say "fuck it" and deploy this 90s protocol anyways. Something must be done! This is something!