danyork

30 ms·

271.
by danyork 12y ago
Several people have confirmed to me that they were unable to see the site from Google's Public DNS Servers (8.8.8.8, 8.8.4.4 and the IPv6 addresses). This makes sense given that Google has been performing DNSSEC validation since early
272.
by danyork 12y ago
Right.... which is where I disagree with Thomas. I believe we should secure the integrity of answers from DNS. I want a DNS we can trust. I see DNSSEC as one of the many layers in any defense-in-depth security plan. Yes, I acknowledge th
273.
by danyork 12y ago
> Plus with NSA mass surveillance, DNS makes seeing what domains you're visiting and building a "picture" of you as an individual absolutely trivial. The IP addresses still may help them do that to some extent, but it cer
274.
by danyork 12y ago
> In a sane design, a transient policy failure should produce a warning light or a browser popup; something that applications can use to sensibly convey what happened, in some form, to users. Thomas, I agree that having the DNS resolve
275.
by danyork 12y ago
tptacek - I was waiting for your reply... almost thought about setting a timer! Glad to see you didn't disappoint. Toward the end of the article you'll note I point out that this is a great example of a hole in the operational pr
276.
by danyork 12y ago
If it's currently unavailable on Android, you should be able to start seeing the site again whenever the TTL of the DNS records ages out... this just happened for me on my own home network where I have a DNSSEC-validating DNS resolver
277.
by danyork 12y ago
Which would make sense because they may be set to use Google's Public DNS Servers (8.8.8.8 and 8.8.4.4 and the IPv6 equivalents). Google Public DNS has been performing full DNSSEC validation since May 2013: http://www.inter
278.
HBO Now DNSSEC Misconfiguration Makes Site Unavailable from Comcast Networks(internetsociety.org)
81 points by danyork 12y ago|76 comments
279.
by danyork 12y ago
Yes, this is a huge issue. We in the technical community will take the extra steps. We will reformat a system and install a new o/s. We will go through the steps to remove malware/adware. We will install our own web browsers a
280.
The data-driven world doesn’t run on data: it runs on trust(internetsociety.org)
3 points by danyork 12y ago|0 comments
281.
by danyork 12y ago
Hmm... I'm not sure where you are seeing that claim that 10% of DNS requests are signed with DNSSEC. I've certainly promoted the statistic that 10-12% of DNS requests are performing DNSSEC validation - and that is based on Ge
282.
by danyork 12y ago
> Why all do we get so many articles with missleading text arguing agains DNSSEC recently? I don't know, but perhaps because DNSSEC deployment IS happening... and the critics want to stamp that down. :-(
283.
by danyork 12y ago
Thomas - I'm still looking for the walk-through of how you see the attacks by a government against DNSSEC. I don't see them! And to your repeated refrain both in your post and here on HN that "DNSSEC has virtually no real-wo
284.
by danyork 12y ago
But Thomas ... I still don't understand the attack that you say can be made against DNSSEC-signed domains. Here's what I see, if I have a .COM domain: 1. I sign my domains and generate a DS record. 2. I upload the DS record to my
285.
by danyork 12y ago
I agree with you AlyssaRowan. I also moved some domains away from NameCheap/eNom when they didn't provide DNSSEC support. I did move a couple of domains to Google Domains. While they do not provide DNSSEC in their DNS hosting, t
286.
by danyork 12y ago
No... DANE doesn't cede control to world governments. <insert-standard-many-hundred-line-exchange-between-you-and-I-that-has-happened-in-other-HN-threads-here> DANE can work perfectly fine with the existing CA system to provide a
287.
IPv6 Security Myth #1 – I’m Not Running IPv6 So I Don’t Have to Worry(internetsociety.org)
2 points by danyork 12y ago|0 comments
288.
Statement from Gogo regarding blocking video on planes(concourse.gogoair.com)
1 points by danyork 12y ago|0 comments
289.
by danyork 12y ago
And curiously, Microsoft is replacing "Lync" with "Skype for Business".... although I'm not sure if that is a simple renaming of the existing client.
290.
Google’s IPv6 Traffic Hits 5% Globally, 28% in Belgium, 12% in USA and Germany(internetsociety.org)
1 points by danyork 12y ago|0 comments
291.
by danyork 12y ago
Some of the carriers who have gone IPv6-only like T-Mobile USA use technologies like 464XLAT to access IPv4 sites. Here's some info: http://www.internetsociety.org/deploy360/resources/case-stud... And RFC 687
292.
by danyork 12y ago
No idea... a number of us who watch IPv6 traffic stats have been wondering about that spike ever since it first appeared. The spike does not appear in other data sets like that from APNIC: http://stats.labs.apnic.net/ipv6&#x
293.
by danyork 12y ago
Did you contact Comcast about this issue? I know some of the folks involved with the IPv6 rollout there and they are VERY focused on making the IPv6 experience as painless as possible.
294.
IAB Statement on Internet Confidentiality(iab.org)
6 points by danyork 12y ago|0 comments
295.
Make Encryption the Norm for All Internet Traffic – Internet Architecture Board(internetsociety.org)
3 points by danyork 12y ago|0 comments
296.
Network Operators Join MANRS Initiative to Increase Routing Security, Resiliency(routingmanifesto.org)
1 points by danyork 12y ago|0 comments
297.
Case Study: The Experience of Signing Go6.SI with DNSSEC(internetsociety.org)
1 points by danyork 12y ago|0 comments
298.
by danyork 12y ago
It seems that http://uidh.crud.net/ is not working right now (gives a 502). However the UIDH header can be seen here: http://lessonslearned.org/sniff Also http://verizon-uidh.tk/ gives a y
299.
by danyork 12y ago
Very cool! Congrats on the quick work! (As I find myself pondering the idea of standing something up like this on an dual-stacked server purely so that I could access HN from my IPv6-only test network... hmmm...)
300.
DNSSEC: An Introduction (from CloudFlare)(blog.cloudflare.com)
3 points by danyork 12y ago|0 comments

More ›