5 ms·
> Summary: it's not DNSSEC itself, it's DNS providers like Cloudflare returning incorrect data to make responses shorter and avoid switching to TCP. I feel lik
by growse 2mo ago
> Summary: it's not DNSSEC itself, it's DNS providers like Cloudflare returning incorrect data to make responses shorter and avoid switching to TCP.
I feel like we need the angry goose meme here.
"But why are those providers returning incorrect data?"
- jeroenhd 2mo ago> "But why are those providers returning incorrect data?" In this case, because they decided actually implementing the protocol they were supposed to be implementing didn't work for their hacky design, so they hacked together a series of Good Enough workarounds. These cloud companies are the Microsoft Internet Explorer of DNS service but unlike IE6 they're considered cool enough that they're tolerated.
- cdmckay 2mo agoSo you’re cool with letting anyone walk your DNS?
- phicoh 2mo agoThe problem here is that computing three 3 NSEC3 records as you might need to return an NXDOMAIN was considered too expensive. It's just a choice to reduce their costs while increasing complexity for everyone else.
- teddyh 2mo agoCloudflare is well known for breaking DNS standards whenever they feel like it; they’re too big to ignore, so they get away with murder.
- pocksuppet 2mo agoHow did they get this way, anyway? Let's say that I want half the world to sign up for me to MITM their traffic. How would I achieve that?
- teddyh 2mo agoSolve a DDoS problem by positioning yourself as the middleman (instead of designing new protocols without the vulnerability).