4 ms·

running a local resolver that validates DNSSEC is all well and good for the HN crowd, but for the 99.9% of people that do not know what DNS is, let alone what a

running a local resolver that validates DNSSEC is all well and good for the HN crowd, but for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help. also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay)

wizeman 4y ago
> for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help Sorry but I don't follow. The 99.9% of people that do not know what DNS is, don't need to know what DNSSEC is either. It works regardless of whether you know what it is. All you need is for microsoft/apple to start validating DNS, like you mention below. > also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay) No, because DNSSEC doesn't prevent DNS responses from being blocked, so the governments and ISPs can continue doing that. DNSSEC validation only prevents responses from being spoofed/forged. The ISP DNS server can still refuse to answer queries if it wants. DoH is what can prevent DNS queries from being blocked, and DoH has already been implemented in Firefox and Android as far as I know. Also, DNSSEC and DoH can (and should) be implemented together, they are not mutually exclusive, rather, they complement each other, as DoH by itself doesn't protect against forgeries by the upstream DNS server.

wizeman 4y ago

> for the 99.9% of people that do not know what DNS is, let alone what a "stub resolver" is, DNSSEC would be more of a hinderance than help Sorry but I don't follow. The 99.9% of people that do not know what DNS is, don't need to know what DNSSEC is either. It works regardless of whether you know what it is. All you need is for microsoft/apple to start validating DNS, like you mention below. > also, it'd receive enormous pushback from governments if microsoft/apple were to start validating DNS, as it would prevent them from blocking sites in the most common way, rewriting DNS queries for illegal sites (for example, in australia, we have blocks on various torrent sites like thepiratebay) No, because DNSSEC doesn't prevent DNS responses from being blocked, so the governments and ISPs can continue doing that. DNSSEC validation only prevents responses from being spoofed/forged. The ISP DNS server can still refuse to answer queries if it wants. DoH is what can prevent DNS queries from being blocked, and DoH has already been implemented in Firefox and Android as far as I know. Also, DNSSEC and DoH can (and should) be implemented together, they are not mutually exclusive, rather, they complement each other, as DoH by itself doesn't protect against forgeries by the upstream DNS server.