3 ms·

It’s difficult to have a discussion when in both your comments here, you’ve proposed that people who disagree with you aren’t discussing in good faith (in the f

by akerl_ 7y ago

It’s difficult to have a discussion when in both your comments here, you’ve proposed that people who disagree with you aren’t discussing in good faith (in the first case by attempting to cast it as the politically correct opinion, and in the latter case by suggesting I’m not interested in facts). The status quo today is that DNS interference is being mitigated by the CA system, which is no hero but does have the benefit that rogue CAs (or CAs which have been forced to behave badly by other actors) can be delisted. The push to increase TLS deployment, detect TLS cert shenanigans, and move additional technologies behind TLS (DNS-over-HTTPS, for example) all work to move the needle on the risks in the current threat model for the vast majority of internet-based workflows. These changes are what’s actually making things better for your example of your sister’s website. Regarding fail-closed, I didn’t say that security controls should fail open. I said that unlike other security controls, DNSSEC fails by dropping the site off the internet. As an end user, you don’t even know it’s a DNSSEC problem, you just know the site has disappeared.

tialaramex 7y ago
> DNS interference is being mitigated by the CA system Such mitigations (e.g. 0x20 or multi-perspective) are not enough to outrun the metaphorical bear. So they only work until you are slowest again. Putting such mitigations in place for those who can't or more often won't deploy DNSSEC makes sense, but somebody will get eaten by the bear this way. > unlike other security controls, DNSSEC fails by dropping the site off the internet You could do some small UX work here to have an explicit error like the ones for TLS version interference, but it's of dubious value. Also you're probably thinking this is valuable feedback to site owners but unfortunately it'll be choked with noise. TLS version interference, for example, mostly means your crappy anti-virus or other middlebox garbage is causing problems. But it might be an attack, or a dodgy cable... who knows. As with certificate expiry the right thing for a site owner to do is have their own alerting in place.
deleted 7y ago
[deleted]

by akerl_ 7y ago

tialaramex 7y ago

> DNS interference is being mitigated by the CA system Such mitigations (e.g. 0x20 or multi-perspective) are not enough to outrun the metaphorical bear. So they only work until you are slowest again. Putting such mitigations in place for those who can't or more often won't deploy DNSSEC makes sense, but somebody will get eaten by the bear this way. > unlike other security controls, DNSSEC fails by dropping the site off the internet You could do some small UX work here to have an explicit error like the ones for TLS version interference, but it's of dubious value. Also you're probably thinking this is valuable feedback to site owners but unfortunately it'll be choked with noise. TLS version interference, for example, mostly means your crappy anti-virus or other middlebox garbage is causing problems. But it might be an attack, or a dodgy cable... who knows. As with certificate expiry the right thing for a site owner to do is have their own alerting in place.

deleted 7y ago

[deleted]