3 ms·
Has anything changed about the risks of running everything with the same key, on the apex domain? Why doesn't Google have DNSSEC.
by westurner 2y ago
Has anything changed about the risks of running everything with the same key, on the apex domain?
Why doesn't Google have DNSSEC.
- tptacek 2y agoTo a first approximation, nobody has DNSSEC. It's not very good.
- westurner 2y agoDNSSEC is necessary like GPG signatures are necessary; though also there are DoH/DoT/DoQ and HTTPS. Google doesn't have DNSSEC because they've chosen not to implement it, FWIU. /? DNSSEC deployment statistics: https://www.google.com/search?q=dnssec+deployment+statistics&client=ms-android-google https://www.google.com/search?q=dnssec+deployment+statistics... If not DNSSEC, then they should push another standard for signing DNS records (so that they are signed at rest (and encrypted in motion)). Do DS records or multiple TLDs and x.509 certs prevent load balancing? Were there multiple keys for a reason?
- tptacek 2y agoSo, not remotely necessary at all? Neither DNSSEC nor GPG have any meaningful penetration in any problem domain. GPG is used for package signing in some language ecosystems, and, notoriously, those signatures are all busted (Python is the best example). They're both examples of failed 1990s cryptosystems.
- dfc 2y agoDo you think the way Debian uses gpg signatures for package verification is also broken?
- westurner 2y agoRed Hat too. Containers, pip, and conda packages have TUF and now there's sigstore.dev and SLSA.dev. W3C Verifiable Credentials is the open web standard JSONLD RDF spec for signatures/attestations. IDK how many reinventions of GPG there are. Do all of these systems differ only in key distribution and key authorization, ceteris paribus?