5 ms·
Route53 private DNS is resolved over link-local addresses, so whether the responses are encrypted is irrelevant. They're specifically designed for private resol
by ericpauley 4y ago
Route53 private DNS is resolved over link-local addresses, so whether the responses are encrypted is irrelevant. They're specifically designed for private resolution within a VPC.
- teddyh 4y ago6. The network is secure. — https://en.wikipedia.org/wiki/Fallacies_of_distributed_computing https://en.wikipedia.org/wiki/Fallacies_of_distributed_compu...
- fiddlerwoaroof 4y agoThat’s assuming a generic network
- ericpauley 4y agoLink-local networking in VPC is specifically designed to secure data that is plaintext at the application layer (DNS). It’s effectively communication with the hypervisor, not over some untrusted link. If you don’t buy this, I guess you should start encrypting all your syscalls too?
- capableweb 4y ago> If you don’t buy this, I guess you should start encrypting all your syscalls too? Don't forget to encrypt all .socket's, and maybe encrypt everything over at /dev as well.
- waych 4y agoIf you believe a piece of link local infrastructure is a good carrier to trust your data, I have some great broken switches you may be interested in buying. Or if you insist on it being a virtual stack, how about some DMA engines with transient errors that mix up your packet headers from their payloads? The network is secure is a fallacy.
- ericpauley 4y agoThe “network” between the CPU and memory is also insecure. It’s turtles all the way down.