Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

And DNSSEC all the way to the user!


I'd be pretty pissed if my network connection opted me into a DNSSEC-verifying resolver, since that is pretty much pure downside for users.


As someone not very knowledgable about DNSSEC, can you expand on this point? To the uninformed that sounds very counterintuitive.


Apart from the blog post, if you don't know anything about DNSSEC, I think the things you want to know are:

1. Almost nobody --- major tech companies, banks, privacy and security organizations --- uses it. It's decades old, and its adoption, at least in North America and in industry, is zero. There are lots of reasons, but you don't have to care right now.

2. Since almost nothing uses it, there's no real upside to enabling it. But there is a downside! If DNSSEC is misconfigured --- which is easy to do, and it won't get noticed quickly (see: point 1) --- then sites in the DNSSEC-signed zone silently drop off the Internet, as if they never existed. That happened, for instance, to HBO when they launched HBO NOW: nobody on Comcast could see it, because it turned out they'd screwed up DNSSEC, and Comcast had DNSSEC-verifying resolvers.





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: