3 ms·

DNSSEC. It's the solution to walled garden brands. The problem is that it needs the support of the big brands to be successful, and the big brands don't want co

by jart 7y ago

DNSSEC. It's the solution to walled garden brands. The problem is that it needs the support of the big brands to be successful, and the big brands don't want competition.

tptacek 7y ago
The solution to walled garden brands is to have registrars and world governments take over identity? If DNSSEC had been widely deployed a few years ago, Muammar Gaddafi would have owned BIT.LY's CA. If a CA misbehaves, Google and Mozilla can nuke them from orbit --- as they just did with several of the industry's largest CAs. If .COM misbehaves --- a thing that has happened repeatedly in the last 10 years, because the DoJ owns it --- Google does, what? Move to .IO? Oh, wait, that's a Five Eyes TLD as well! You've got one thing right, though: virtually no major Internet tech companies, save Cloud Flare (which sells DNSSEC services) and Paypal (but not their subsidiaries like Braintree or Venmo) use DNSSEC. Not Microsoft, Google, or Apple; not Mozilla, Stripe, or Square; not Facebook, not Cisco, not Oracle; not Salesforce, not Twitter; not Netflix. If there's a conspiracy against DNSSEC, it is deep. Firefox, Chromium, and Apple piloted DNSSEC years ago, and then withdrew support. It's been 25 years with DNSSEC. He's dead, Jim. Let him go.
- jart 7y ago
  No conspiracy theories please. DNSSEC is operated by a non-profit called ICANN which manages its key-signing-keys in publicly recorded ceremonies comprised of community representatives from each continent. If you believe Google and Mozilla have legitimacy to govern cryptography affairs in the third-world, then by all means continue supporting the status quo. Also anyone registering novelty names should be aware of the risks.
  - tptacek 7y ago
    I don't know what DNSSEC you could possibly be referring to, because it's not the one that exists in reality. The reality-based DNSSEC does in fact have a silly security-theater ritual managed by ICANN to set the keys for the root, but --- and, this gets a little arcane and involves knowing some intricate details of DNS --- hanging off the root are the TLDs, like "com" and "uk", and there is no publicly recorded key signing ceremony for the TLDs. Nor could there be, because the owners of the most popular TLDs publicly assert their right to control the contents of those zones for public policy; see, for instance, every DOJ domain takedown ever. I do however enjoy pointing out that, all this aside, you could post the root keys, the product of these elaborate key signing rituals, on Pastebin tomorrow and no real-world security engineers would have to come in on the weekend; they could pick the Jira ticket up to "figure out whether we care that all security in DNSSEC has been revoked" sometime during the next work week and be perfectly OK. Because, of course, nothing in the reality-based reality actually depends on DNSSEC.

by jart 7y ago

DNSSEC. It's the solution to walled garden brands. The problem is that it needs the support of the big brands to be successful, and the big brands don't want competition.

tptacek 7y ago

The solution to walled garden brands is to have registrars and world governments take over identity? If DNSSEC had been widely deployed a few years ago, Muammar Gaddafi would have owned BIT.LY's CA. If a CA misbehaves, Google and Mozilla can nuke them from orbit --- as they just did with several of the industry's largest CAs. If .COM misbehaves --- a thing that has happened repeatedly in the last 10 years, because the DoJ owns it --- Google does, what? Move to .IO? Oh, wait, that's a Five Eyes TLD as well! You've got one thing right, though: virtually no major Internet tech companies, save Cloud Flare (which sells DNSSEC services) and Paypal (but not their subsidiaries like Braintree or Venmo) use DNSSEC. Not Microsoft, Google, or Apple; not Mozilla, Stripe, or Square; not Facebook, not Cisco, not Oracle; not Salesforce, not Twitter; not Netflix. If there's a conspiracy against DNSSEC, it is deep. Firefox, Chromium, and Apple piloted DNSSEC years ago, and then withdrew support. It's been 25 years with DNSSEC. He's dead, Jim. Let him go.

jart 7y ago
No conspiracy theories please. DNSSEC is operated by a non-profit called ICANN which manages its key-signing-keys in publicly recorded ceremonies comprised of community representatives from each continent. If you believe Google and Mozilla have legitimacy to govern cryptography affairs in the third-world, then by all means continue supporting the status quo. Also anyone registering novelty names should be aware of the risks.
- tptacek 7y ago
  I don't know what DNSSEC you could possibly be referring to, because it's not the one that exists in reality. The reality-based DNSSEC does in fact have a silly security-theater ritual managed by ICANN to set the keys for the root, but --- and, this gets a little arcane and involves knowing some intricate details of DNS --- hanging off the root are the TLDs, like "com" and "uk", and there is no publicly recorded key signing ceremony for the TLDs. Nor could there be, because the owners of the most popular TLDs publicly assert their right to control the contents of those zones for public policy; see, for instance, every DOJ domain takedown ever. I do however enjoy pointing out that, all this aside, you could post the root keys, the product of these elaborate key signing rituals, on Pastebin tomorrow and no real-world security engineers would have to come in on the weekend; they could pick the Jira ticket up to "figure out whether we care that all security in DNSSEC has been revoked" sometime during the next work week and be perfectly OK. Because, of course, nothing in the reality-based reality actually depends on DNSSEC.