5 ms·
Just gonna leave this absolute gem from Thomas Ptacek on DNSSEC here: https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/0
by SEJeff 4mo ago
Just gonna leave this absolute gem from Thomas Ptacek on DNSSEC here:
https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/
- betaby 4mo agoAged like a milk.
- tptacek 4mo agoOh, yeah, I'm sure feeling chastened right now. You got me.
- SAI_Peregrinus 4mo agoParmigianino-Reggiano is aged milk, so I'm not sure what people have against aged milk. Aged milk can be great
- sgc 4mo agoMy poor fellow. You wrote about how something is a bad tool for a long list of serious reasons. Then it failed spectacularly because everybody decided to depend on it anyway - exactly what you were cautioning against. But somehow you have to respond to people who think you are the one who got it wrong! As a third party the whole affair gave me a good chuckle at least ;)
- tptacek 4mo agoGermany appears to depend on it. Virtually none of North America does. I'm pretty satisfied with how this whole thing shook out!
- cyberax 4mo agoYou're wrong. Both .com and .net are signed (`dig RRSIG com.`), and if they screw up, then all the com/net zones will become inaccessible.
- tptacek 4mo agoVirtually no zones under .com/.net are signed, which was the only point I was making. It has no adoption here.
- cyberax 4mo agoSure. But that was not the issue with .de, it has about the same level of DNSSEC adoption as .com DENIC screwed up the TLD itself, and .com/.net are just as susceptible.
- profmonocle 4mo agoEven if example.com is unsigned, the delegation from .com to example.com will still be signed (including an attestation that example.com is unsigned). So lack of DNSSEC adoption by users of the TLD wouldn't save them here.
- theMMaI 4mo agoSssshh, don't give Verisign any bad ideas!