3 ms·

> For DNS, we're used to not worrying about private systems at all. You probably have or know somebody who has, a Pi-Hole, which deliberately trashes DNS in ord

> For DNS, we're used to not worrying about private systems at all. You probably have or know somebody who has, a Pi-Hole, which deliberately trashes DNS in order to reduce the amount of advertising you see. It can't trash my DNS this way, and it couldn't trash DNS for somebody using say, Google's DoH servers, so we don't fret about it. Just yesterday, I got banned by gatekeepers at privacyguides.org for pointing out the disconnect between their "must support DNSSEC" stance and the content-blocking scenarios made possible by services like Pi-Hole. I wish I was as eloquent and convincing as you are. [0] https://github.com/privacyguides/privacyguides.org/discussions/197#discussioncomment-1706112 https://github.com/privacyguides/privacyguides.org/discussio...

tptacek 5y ago
To be clear, I don't think Nick Lamb is an opponent of DNSSEC.
- tialaramex 5y ago
  Indeed. I did change my mind, but I changed my mind to being much less sceptical of the Web PKI partly as a result of the changes Ryan talked about on Thomas' podcast and partly after taking more active part in m.d.s.policy and seeing that it was possible to make a difference. I remain of the opinion (as do many other people who can't just wish away the problem) that we need DNSSEC, or at least, that we need to do what DNSSEC does and we have DNSSEC so we should just use that. Thomas disagrees fervently, as you have seen.
  - tptacek 5y ago
    I think you're wrong about that even in the general sense --- that I don't believe we even need what DNSSEC is trying to accomplish, even if we had a sane design to do it. And I strenuously disagree that the DNSSEC design we have today --- DNSSEC-ter? DNSSEC-quater? --- has a positive risk/benefit. I think we will all be worse off in the unlikely event that it's adopted; we'll be worse off even in the best case of universal adoption where nothing goes wrong except that we're all locked into RSA and ECDSA P-Curve signatures, and I think there are much worse things that are likely to happen. But I'll do my best to disagree more respectfully! I missed the mark badly downthread, and I'm sorry for that.

tptacek 5y ago

To be clear, I don't think Nick Lamb is an opponent of DNSSEC.

tialaramex 5y ago
Indeed. I did change my mind, but I changed my mind to being much less sceptical of the Web PKI partly as a result of the changes Ryan talked about on Thomas' podcast and partly after taking more active part in m.d.s.policy and seeing that it was possible to make a difference. I remain of the opinion (as do many other people who can't just wish away the problem) that we need DNSSEC, or at least, that we need to do what DNSSEC does and we have DNSSEC so we should just use that. Thomas disagrees fervently, as you have seen.
- tptacek 5y ago
  I think you're wrong about that even in the general sense --- that I don't believe we even need what DNSSEC is trying to accomplish, even if we had a sane design to do it. And I strenuously disagree that the DNSSEC design we have today --- DNSSEC-ter? DNSSEC-quater? --- has a positive risk/benefit. I think we will all be worse off in the unlikely event that it's adopted; we'll be worse off even in the best case of universal adoption where nothing goes wrong except that we're all locked into RSA and ECDSA P-Curve signatures, and I think there are much worse things that are likely to happen. But I'll do my best to disagree more respectfully! I missed the mark badly downthread, and I'm sorry for that.