3 ms·
> Browsers and operating systems aren't going to add full DNSSEC resolving caches. You phrase it like a fact. In practice we're seeing quite the opposite. Fire
by xorcist 12y ago
> Browsers and operating systems aren't going to add full DNSSEC resolving caches.
You phrase it like a fact. In practice we're seeing quite the opposite. Firefox clearly sees a fully validating client as the only reliable way to implement TLSA.
- tptacek 12y agoNo. Firefox has no current plans to implement DANE. The plans on the wiki date from 2011, at roughly the same time Chrome played with DANE. The Chromium team subsequently removed the code for DNSSEC validation, and has since then declared that they're not moving forward with DNSSEC. The Bugzilla ticket for DANE support in Firefox features a member of the Mozilla team declaring that DANE support is no longer an active project there.
- xorcist 12y agoThat's not what I said. If you look at said ticket, you will see that in fact plans were to make it fully validating.
- tptacek 12y agoWhat's your point? One dude on the Mozilla team played with the idea of implementing DANE. Then they gave up on it. Now that idea is a rebuttal to my point that browsers won't benefit from DNSSEC? Is the point that it's possible to implement DNSSEC on end systems? Of course it's possible; everything is possible. But that's not what's going to happen, in large part because the DNSSEC operational community doesn't believe it should happen, and designed the protocol to make it easier not to.
- xorcist 12y agoNo. That is not what I responded to. You wrote that browsers, if they implemented DNSSEC, would choose to implement stub resolvers without full validation. In fact, both browsers who looked at implementing it clearly did so with the intention of doing full validation. I did not say that they implemented it, or even that they will. I did say that the claim that there were plans to only implement a non-validating stub resolver in common browsers is not true.
- tptacek 12y agoYou write as if what I said about browsers and DNSSEC wasn't right there in the thread above your comment. An odd rhetorical strategy.