3 ms·
The buried lede here seems to be that this is yet another serious outage (indirectly) caused by using DNSSEC, though I understand why they don’t emphasize this
by jolux 3y ago
The buried lede here seems to be that this is yet another serious outage (indirectly) caused by using DNSSEC, though I understand why they don’t emphasize this part, given their strong advocacy for DNSSEC adoption.
- dc396 3y agoAs I read it, DNSSEC signature expiry was what triggered people noticing the root data was stale. That would seem to be a somewhat positive outcome.
- ipaddr 3y agoWould you rather an error or stale dns?
- mcesch 3y agoHaving had to troubleshoot a third-party service not so dissimilar to 1.1.1.1 and prove to them that their infrastructure was misbehaving in a similar manner, I'll take the error thank you.
- patmorgan23 3y agoWell it's a free public resolver service. There's plenty of other options and you can even run your own very easily.
- jolux 3y ago> DNSSEC signature expiry was what triggered people noticing the root data was stale If you noticed your brakes had failed because you ended up in a ditch I wouldn't really say that's a positive outcome. Frankly I can't believe they don't have better monitoring for a system as critical as that.
- mcesch 3y agoI don't know why Cloudflare, like Amazon, often get a free-pass on HN for their DNS implementation bugs. Regardless of DNSSEC's merits or otherwise, this bug isn't inherent to DNSSEC.