'quite tired' eh :) jocluteseh is the OP arguing for DNSSEC. That's his quote. tptacek already explained this in some detail in the original article that this

'quite tired' eh :) jocluteseh is the OP arguing for DNSSEC. That's his quote. tptacek already explained this in some detail in the original article that this article is a rebuttal to. DNSSEC doesn't secure browser lookups: http://marc.info/?l=namedroppers&m=99635022704707&w=2 http://marc.info/?l=namedroppers&m=99635022704707&w=2 DNSSEC only guards against the relatively small problem of cache poisoning for individual records, but it can't even do that properly. It all falls apart w/ MITM and the browser wouldn't even be able to detect MITM since it's relying on a flawed source of truth. http://www.cse.wustl.edu/~jain/cse571-07/ftp/cafecrack/#Section3.4 http://www.cse.wustl.edu/~jain/cse571-07/ftp/cafecrack/#Sect... See tptacek's original post for more info. http://sockpuppet.org/blog/2015/01/15/against-dnssec/ http://sockpuppet.org/blog/2015/01/15/against-dnssec/