3 ms·
> Any bad move will be caught immediately by the community and routed around And go where ? We don't even have an alternative when we have the time to build it
by rakoo 12y ago
> Any bad move will be caught immediately by the community and routed around
And go where ? We don't even have an alternative when we have the time to build it, do you think we will be able to build one when everything goes down ?
I agree with you that there are no viable alternative for the moment, and we should at least put those TLSA records. You will notice that I was complaining specifically about DNSSEC, not about DANE; as long as we have a secure way to transmit those TLSA records, everything is fine.
A slightly better thing than what we have today would be:
- Deploy those TLSA records, both in DNS servers and applications
- Have everyone use its own resolver, or at the very least a resolver they really trust (if we want to benefit from the cacheability of DNS)
- Transmit DNS records through a secure channel such as DNSCurve
The advantage being that these are all available today with little modifications.
- xorcist 12y agoI don't think we need to go somewhere else if ICANN misbehaves. That's why I wrote route around. It all depends on what the particular bad move is. Suppose they transferred control over a top domain to a US state actor. That's one of the few scenarios I can imagine that are at least within the realm of the possible. In that particular case I believe we should pressure root server operators to temporarily hold the change and get ICANN to backpedal. DNScurve is unnecesary when DNSSEC is implemented. It also has the unfortunate design to give operators of authoritative name servers the possibility to manipulate the zone. In that situation all domain name owners would be expected to run their own DNS servers. I don't think that's realistic.