7 ms·

One thing I like about Thomas’ history on this issue has been the focus on UX. I think that “can probably be used safely by an expert who understands the domain

by acdha 1y ago

One thing I like about Thomas’ history on this issue has been the focus on UX. I think that “can probably be used safely by an expert who understands the domain” as a failure mode is something we should spend more time thinking about as an architecture failure rather than a minor frictional cost.

tialaramex 1y ago
Sure, although in this space Thomas was already entirely happy with the early Web PKI which is completely terrible for this - similar conditions apply. At work this week I was hand-holding a DB engineer who was installing some (corporate, not Web PKI) certs and it reminded me of those bad old days. He's got a "certificate" and because this isn't my first rodeo, I ask him to describe it in more details before he just sends me it to look at. Of course it's actually a PKCS#12 file, and so if he'd sent that the key which is inside it is compromised - but he doesn't know that, the whole system was introduced to him as a black box which renders him unable to make good decisions. Out of that conversation we got more secure systems (fixing some issues that pre-existed the fault I was there to help with) and an ally who understands what the technology is actually for and is now trying to help us deliver its benefits rather than just following rote instructions they don't understand. Anyway, just as we went from "I dunno, I clicked a button and typed in the company credit card details, then I got emailed this PFX file to put on the server" to "Click yes when it asks if you want Let's Encrypt" with both an invisible improvement to delivered security and a simpler workflow, that's very much possible for DNSSEC if people who want to solve the problem put some work in, rather than contentedly announcing that it can't be fixed and we shouldn't worry about it.
- tux1968 1y ago
  > possible for DNSSEC if people who want to solve the problem But for several decades, DNSSEC proponents have been complaining about the vocal detractors, rather than actually addressing the problems that have been identified. That's a pretty significant track record on which to make a fair judgment about who is making the strongest case. Someone above offered a link [1] that gives some pretty good reasons why nobody is stepping up to fix the problems. [1] https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/ https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/
  - tptacek 1y ago
    (This is Geoff Huston, for what it's worth, who is an Internet operations luminary of the old breed, and a very long-time very enthusiastic DNSSEC proponent. He doesn't really "call time on" DNSSEC, though; the APNIC Ping podcast he did on this is worth listening to.)
- acdha 1y ago
  I don’t know that I’ve read much support for “entirely happy” but the key difference is that DNSSEC is much harder to upgrade. You didn’t need to wait for my ISP to upgrade their DNS server before you could stop using PKCS12, and you definitely didn’t need me to upgrade my operating system. The most important work to put in isn’t tweaking DNSSEC but changing it from the pre-PC Internet model where everyone completely trusted their network operators – pushing signature validation out to the client and changing the operating system APIs to make better user interfaces possible.

by acdha 1y ago

tialaramex 1y ago

Sure, although in this space Thomas was already entirely happy with the early Web PKI which is completely terrible for this - similar conditions apply. At work this week I was hand-holding a DB engineer who was installing some (corporate, not Web PKI) certs and it reminded me of those bad old days. He's got a "certificate" and because this isn't my first rodeo, I ask him to describe it in more details before he just sends me it to look at. Of course it's actually a PKCS#12 file, and so if he'd sent that the key which is inside it is compromised - but he doesn't know that, the whole system was introduced to him as a black box which renders him unable to make good decisions. Out of that conversation we got more secure systems (fixing some issues that pre-existed the fault I was there to help with) and an ally who understands what the technology is actually for and is now trying to help us deliver its benefits rather than just following rote instructions they don't understand. Anyway, just as we went from "I dunno, I clicked a button and typed in the company credit card details, then I got emailed this PFX file to put on the server" to "Click yes when it asks if you want Let's Encrypt" with both an invisible improvement to delivered security and a simpler workflow, that's very much possible for DNSSEC if people who want to solve the problem put some work in, rather than contentedly announcing that it can't be fixed and we shouldn't worry about it.

tux1968 1y ago
> possible for DNSSEC if people who want to solve the problem But for several decades, DNSSEC proponents have been complaining about the vocal detractors, rather than actually addressing the problems that have been identified. That's a pretty significant track record on which to make a fair judgment about who is making the strongest case. Someone above offered a link [1] that gives some pretty good reasons why nobody is stepping up to fix the problems. [1] https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/ https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/
- tptacek 1y ago
  (This is Geoff Huston, for what it's worth, who is an Internet operations luminary of the old breed, and a very long-time very enthusiastic DNSSEC proponent. He doesn't really "call time on" DNSSEC, though; the APNIC Ping podcast he did on this is worth listening to.)
acdha 1y ago
I don’t know that I’ve read much support for “entirely happy” but the key difference is that DNSSEC is much harder to upgrade. You didn’t need to wait for my ISP to upgrade their DNS server before you could stop using PKCS12, and you definitely didn’t need me to upgrade my operating system. The most important work to put in isn’t tweaking DNSSEC but changing it from the pre-PC Internet model where everyone completely trusted their network operators – pushing signature validation out to the client and changing the operating system APIs to make better user interfaces possible.