2 ms·
> And as the parent comment said, it's complicated and brittle, while offering little benefit. Back in the day, lots of things were complicated and brittle reg
by alwillis 4y ago
> And as the parent comment said, it's complicated and brittle, while offering little benefit.
Back in the day, lots of things were complicated and brittle regarding having an internet presence.
If that were the standard for IT in general and networking in particular, we wouldn’t deploy a great many things.
That being said, it’s pretty easy these days to deploy DNSSEC; so is cryptographically verifying the chain of trust between your domain and the root.
- tptacek 4y agoThe pattern has recurred for over a decade: someone says DNSSEC is, at last, easy to deploy, and then some huge company tries to turn it on and falls off the entire Internet for a day. Last time, I think, it was Slack. I wonder who it'll be this time.
- alwillis 4y ago> someone says DNSSEC is, at last, easy to deploy Almost not a week goes by on HN where there's a headline about some well-known company or government organization that did something (or didn't do something) to either get themselves knocked off the internet or were compromised. While companies screwing up DNSSEC has gotten some companies knocked of the net, it pales in comparison to other reasons for companies getting knocked off the net. But whatever. A more nuanced take on the ease of deploying DNSSEC: it's easy to do for the weekend hobbyist working on a side project or a homelab. Or a small organization whose registrar and internet host both support DNSSEC. Deploying DNSSEC is definitely not easy if you're running at Facebook, Twitter, Apple, etc. scale. There are other reasons too, but there's no need to rehash once again.