danyork

36 ms·

331.
by danyork 12y ago
How? Please explain how an attack can be carried out surgically against small targets from the root?
332.
by danyork 12y ago
How can the DNS root alter my records? Say my domain is "example.com" and I serve the zone out of my own authoritative DNS server running on my own host. I create a "www" record that I serve out pointing to my site&#
333.
by danyork 12y ago
>"Actual" interest in cryptography? I was replying to your reply and quoted part of your message and just snipped it off without really indicating that I had just ended it. The way it came out on the HN page it is hard to see
334.
by danyork 12y ago
Thomas, DNSSEC has nothing to do with last-mile security, nor does it have anything to do with confidentiality. You know that. Neither of those is the problem DNSSEC solves. > 2014 advocacy for DNSSEC seems to me like distilled sunk-cos
335.
by danyork 12y ago
That doesn't answer the question I asked. If you issue a DNS query to your resolver and DNSSEC validation fails , then the resolver can't trust the result it received as that info could be bogus. I can't see how there is a
336.
by danyork 12y ago
> "The CA system is worse" isn't a rebuttal to "DNSSEC/DANE gives the USG direct control of certificates". Again, please stop the overly broad statements and explain precisely HOW "DNSSEC/DANE give
337.
by danyork 12y ago
> You can in some sense sum up the cryptographic competence of DNSSEC by observing, as you have, that many of its largest deployers still use RSA-1024. If you have any actual interest in cryptography ... you could also help improve the D
338.
by danyork 12y ago
> DANE is even worse than plain-old DNSSEC. For those of you who don't know what it is: DANE allows the DNS to vouch for your certificates. In other words: whoever controls the DNS roots effectively controls your certificates. Pleas
339.
by danyork 12y ago
> How does your lookup code change to accommodate the fact that a query can, under DNSSEC, (a) fail (b) despite the fact that there was a response to the query with a usable record? Hmm... I'm not clear how a failed query could have
340.
by danyork 12y ago
I'm sorry, but no, it's not the same thing. (I'm in Toronto, right now, so all messages should start off being polite!) Enterprises DO buy all sorts of crazy stuff but this is not one of them. I know it annoys the critics, bu
341.
by danyork 12y ago
Thomas, responding to some of your points: > * It's complicated to deploy and misconfigurations cause outages, and those outages get more severe the more people deploy DNSSEC. I would dispute that. Pretty much all of the authoritat
342.
by danyork 12y ago
> This is a common tactic among DNSSEC advocates. Hmm... as a "DNSSEC advocate", I can say that I've never dismissed the lack of last-mile security as a "straw man". It's a real issue - but NOT one that DN
343.
Watch Live: Edward Snowden at HOPE-X Today at 2:00pm EDT (18:00 UTC)(circleid.com)
1 points by danyork 12y ago|0 comments
344.
Now Available – A Trend Chart Tracking DNSSEC Validation Globally(circleid.com)
4 points by danyork 12y ago|0 comments
345.
by danyork 12y ago
So to your point you would see the attack being that the .LY registry would change the NS records for my (fictitious) .LY domain to point to a different set of name servers? i.e. removing my servers as the authoritative ones? And then bei
346.
by danyork 12y ago
> In a DNSSEC/DANE world, if you have a .LY name, the government of Libya would have a say in what your TLS certs were. Please explain to me how this would be possible? - I sign my .LY domain with DNSSEC and create the appropriate D
347.
by danyork 12y ago
I'm a bit confused by the text you quote. DNSSEC does protect against MITM attacks. That is specifically what it is designed to do. Unless I am missing something (which could be), the article you reference as "[2]" does no
348.
by danyork 12y ago
But is that a good thing? Being "unable to take down malicious domains"? I don't know. There is a part of me that wants to protect against this ability to take down domains - and another part of me that says if there were
349.
by danyork 12y ago
On the site where I wrote this article the scope is to talk about DNSSEC deployment (and deployment of other technologies such as IPv6). Given those parameters, I have limits on what I can talk about in terms of other technical solutions
350.
DNSSEC Would Not Help Prevent Microsoft’s Seizure Of Domains(internetsociety.org)
38 points by danyork 12y ago|26 comments
351.
by danyork 12y ago
Exactly. It's the fact that many sites rely on GeoIP databases to try to offer the best localized services to people coming from various regions. GeoIP databases can also be used by firewalls, of course, to block all connections comin
352.
IPv4 Exhaustion Gets Real – Microsoft Runs Out Of U.S. Addresses For Azure Cloud(internetsociety.org)
1 points by danyork 12y ago|0 comments
353.
by danyork 12y ago
No, Stanford gave that block back in 2000. See: http://arstechnica.com/information-technology/2014/06/with-t... Microsoft has been purchasing blocks of IPv4 space (they bought some off of Nortel a few years
354.
LACNIC Enters Phase 2 Of Final IPv4 Address Countdown(internetsociety.org)
2 points by danyork 12y ago|0 comments
355.
by danyork 12y ago
-Anyone else having issues reaching the site? I'm getting an SSL connection error to blog.4chan.org.- Never mind... I'm in now.
356.
by danyork 12y ago
Or perhaps more likely, THAT will be the time that some organizations finally realize that they need to make the move to IPv6. Nothing like an added expense to drive behavior. :-)
357.
The killer gigabit app? It’s not what you think(gigaom.com)
19 points by danyork 12y ago|9 comments
358.
by danyork 12y ago
As another example, when I am using LTE on Verizon Wireless, I am connecting over IPv6 to sites running IPv6 (ex. Google, Facebook, Wikipedia, etc.). I can go to sites like http://www.test-ipv6.com/ and see that I have ful
359.
by danyork 12y ago
Perhaps you can point them to sites like http://www.worldipv6launch.org/measurements/ and show them some of the stats on networks that are using it. You can also point them to the fact that Facebook, Netflix, Wikipe
360.
by danyork 12y ago
Yes, that's pretty much been my assumption. Perhaps you might also be watching longer videos on YouTube from home or using more Google services from home - but I think it does have more to do with residential adoption.

More ›