3 ms·
Slack's house literally did burn down for 24 hours because of DNSSEC back into 2021. When you frame the risk as "marginal benefit against one specific threat"
by growse 1y ago
Slack's house literally did burn down for 24 hours because of DNSSEC back into 2021.
When you frame the risk as "marginal benefit against one specific threat" Vs "removes us from the internet for 24 hours", the big players pass and move on. This is the sort of event the phrase "sev 1" gets applied to.
Some fun companies have a reg requirement to provide service on a minimum SLA, otherwise their license to operate is withdrawn. Those guys run the other way screaming when they hear things like "DNSSEC" (ask me how I know).
What percentage of the fortune 500 is served over DNSSEC?
- iscoelho 1y agoand Slack.com still uses DNSSEC. They appear to not have come to the same conclusion.
- tptacek 1y agoThey added DNSSEC because of FedGov accounts that require it.
- iscoelho 1y agoHappy to see security audits doing good work.
- psanford 1y agoInternally at slack the general consensus was that dnssec was a giant waste of time and money from a security perspective. We did it for compliance to sell into the Federal govt and federal contractors.
- daneel_w 1y agoOh. I thought it burned down because of their engineers not having fully acquainted themselves with the tool before applying it. It's misguided to hold DNSSEC culpable for Slack's engineers' goof-up. Like advising people against ever going near scissors because they might run with one in their hands.
- tptacek 1y agoLOL. https://ianix.com/pub/dnssec-outages.html https://ianix.com/pub/dnssec-outages.html
- daneel_w 1y agoMiserable list. Now share a link that shows all the successful deployments that never had any hiccups.
- Avamander 1y agoIt's not like anyone is actually monitoring it or would notice. I know for a fact there are a lot of broken deployments out there, have been for a decade if not more, nobody really gives a rats ass. From a technical perspective, lack of DNSSEC transparency is also a major downside of DNSSEC compared to WebPKI.
- growse 1y agoApparently the way to do sane risk management is just "don't be an idiot"?
- marcusb 1y agoThat is an extremely uncharitable take for an outage that involved two of the most poorly defined and difficult to (correctly) implement DNS features (wildcards and NSEC records) that the three major DNS operators mentioned in the Slack post-mortem (AWS, Cloudflare, and Google) all implemented differently.
- teddyh 1y agoIIRC, Slack backed out of their DNSSEC deployment because of a bug with wildcards and NSEC records (in Route53, not Slack), but the problem Slack subsequently experienced was not caused by that bug, but was instead caused by the boneheaded way in which Slack tried to back out of DNSSEC. I.e. Slack’s problem was entirely their own doing, and completely avoidable if they had had any idea of what they were doing.