3 ms·

DANE is entirely dependent on DNSSEC, and DNSSEC is, by design, under the government control, with all the bureaucratic mess and mistakes this implies. This wo

by theamk 4mo ago

DANE is entirely dependent on DNSSEC, and DNSSEC is, by design, under the government control, with all the bureaucratic mess and mistakes this implies. This would be pretty terrible if anyone actually cared about DNSSEC, but luckily for us, no one cares.. So let's keep things this way.

Parodper 4mo ago
You obviously don't know how DNSSEC works. The DNS root of trust is ICANN, not a government.
- trumpdong 4mo ago
  That's worse, because ICANN is effectively the US government.
  - Parodper 4mo ago
    I'm the first to admit ICANN has issues, but US government control doesn't seem to be one of them.
trumpdong 4mo ago
Domain registries can already get a certificate for your domain by changing the address to their own server temporarily and then doing ACME with LE. So no new vector is introduced by directly putting the cert in DNS.