4 ms·
I hope the situation gets resolved swiftly, and lessons learned from this incident can contribute to stronger and more reliable DNSSEC practices in the future.
by lucgagan 3y ago
I hope the situation gets resolved swiftly, and lessons learned from this incident can contribute to stronger and more reliable DNSSEC practices in the future.
- tptacek 3y agoThe root KSK rollover had to be postponed twice, for several years, because of operational problems pulling this off in the US. It's difficult to do because the nature of the DNS makes it difficult. The utility of DNSSEC is so marginal that it's kind of sad that you're right, and that engineers are gradually getting better doing this hard, stupid thing.
- tedunangst 3y agoYou're not learning if you're not failing, so failing is good actually.
- CognitiveLens 3y agoI think the pithy saying is that we learn best from failure, not that there is no other way to learn.
- theamk 3y agoYep: "don't deploy DNSSEC, rely on TLS"
- matthew9219 3y agoTLS security is rooted in DNS. It's ACME DNS-01. If your threat model includes nation states, this is a non-solution
- Avamander 3y agoIf your threat model includes nation-states then DNSSEC won't help you either. WebPKI at least has a method for keeping track of and detecting misissuance, DNSSEC doesn't.
- rakoo 3y agoWrong, TLS security is independent from DNS. If my threat model includes nation states I'll trust my own certificates or my very own CA.
- teddyh 3y agoBy trusting certificates, you implicitly trust all CAs, not just your own.
- rakoo 3y agoNo, again in that threat model I can decide exactly which certificates and which CA I trust, one by one.
- tptacek 3y agoYou trust your browser's root program, not "all CAs".
- teddyh 3y agoThat’s what a “CA” is. If someone is not in a browser’s CA list, they’re not a CA. So yes, you do trust all CAs.
- tptacek 3y agoNo, obviously, different TLS programs have different root programs.
- acdha 3y agoThat’s not all what CA means in standard usage. Terms like WebPKI exist specifically to make that distinction since, for example, the U.S. government runs its own certificate authorities which are trusted by millions of clients and even some mainstream software (Adobe) but not browsers. This is far from unique as far as governments go, and in some cases may even be required within a country.
- 3y ago
- shp0ngle 3y agoIf your threat includes nation states then DNSSEC is double-useless?