Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 123 posts

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#101

Post by _wldu »

ceejayoz wrote: post #82
paulnpace wrote: post #68

Earlier quoted context omitted.

> DNSSEC is notorious for breaking things My understanding is that people break things.

https://en.wikipedia.org/wiki/Just_culture > Just culture is a concept related to systems thinking which emphasizes that mistakes are generally a product of faulty organizational cultures, rather than solely brought about by the person or persons directly involved. In a just culture, after an incident, the question asked is, "What went wrong?" rather than "Who caused the problem?". Prominent (and very effective) exam…

So when organizations hire people that do not understand the DNS or PKC to maintain their DNS then it is the organization's fault (rather than the person who made the change). I accept that and agree.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#103

Post by toast0 »

antihero wrote: post #41
the8472 wrote: post #14

Earlier quoted context omitted.

From a site reliability perspective HTTPS is still broken. Some 15yo OS can't access any site because it doesn't have the certificates or cipher suites. And as you mentioned we need to update certs, webservers and DNS all the time to keep up to date. We only put up with it because it protects users from from snoopers. But that means we live in an inadequate equilibrium. If we abolished mass surveillance rather than i…

It really isn’t hard now there’s letsencrypt. We’ll never live in a world where a connection between the client and server can be completely trusted. HTTPS is wonderful because it offers a guarantee that the data isn’t tampered with (except with corporate root CAs, but that is fuckery).

LetsEncrypt removes the cost of certificates, and ACME removes the work of getting certificate issues, and decent integrations remove the work of loading new certificates and that's all great.

But LE doesn't remove the compatability challenges. If you needed to ship a device today that would sit in a box for 10 years and then get online and get an update via https, that's really hard to do. TLS protocols sometimes get discouraged, and CA changes happen, etc.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#104

Post by shkkmo »

the8472 wrote: post #22
shkkmo wrote: post #18

Earlier quoted context omitted.

> If we abolished mass surveillance then we wouldn't need encryption for read-only sites, we could have our cake and eat it too. Mass surveillance is not the only reason to have HTTPS everywhere. It protects not just from snoopers, but from MITM attacks.

Did you notice the "read only sites" part? MITM is hardly relevant for those.

Examples of read only sites that adversaries might want to alter the content you see:

Your banks support numbers, election poll information, binary downloads/checksums are some really critical ones but the list is really endless given the wide range of possible adversaries and their motives.

One big advantage to pushing HTTPS everywhere is that we don't have to trust people to be able to correctly predict which read only content is sensitive.

I do wish browsers handled expired certs for longstanding sites in a way that was clearer to nontechnical people. We should have the ability to look at a project like the Internet Archive to know the history of a site in terms of both content and the certs it was served under.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#105

Post by ceejayoz »

_wldu wrote: post #101
ceejayoz wrote: post #82

Earlier quoted context omitted.

https://en.wikipedia.org/wiki/Just_culture > Just culture is a concept related to systems thinking which emphasizes that mistakes are generally a product of faulty organizational cultures, rather than solely brought about by the person or persons directly involved. In a just culture, after an incident, the question asked is, "What went wrong?" rather than "Who caused the problem?". Prominent (and very effective) exam…

So when organizations hire people that do not understand the DNS or PKC to maintain their DNS then it is the organization's fault (rather than the person who made the change). I accept that and agree.

But if a bunch of large, well-staffed, engineering-focused, otherwise competent organizations manage to fuck it up regularly, the problem's probably above the individual organizations. Potentially with the spec itself.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#106

Post by mike_hearn »

mike_d wrote: post #98
Yeri wrote: post #84

(CF TAM here) All plans come with support. Even the free plans (community, or email, the bot will deflect the request but if you email you're still stuck, you will get a reply _eventually_ (due to heavy support load, it can take a while though). The correct procedure would be: * turn off DNSsec on old registrar (and wait a day or two) * update NS and/or migrate domain * wait a while and make sure it works * turn on D…

The correct steps are to completely disable DNSSEC and remove the relevant records. It is far too fragile for the majority of use cases. Effort should instead be put into deploying things like DNSCrypt that implement transport security and confidentiality. Transport security is like HTTPS. DNSSEC was the equivalent of PGP signing every webpage. The former brings value to the end user, the latter not so much. Even the…

DNSSEC is however the only way you can make TLS really work. The whole TLS ecosystem is dependent on CAs that are basically just a giant hack. They're signing a statement that they did a bunch of DNS resolutions at a point in time from different network vantage points (maybe, hopefully), and got consistent answers. DNSSEC+DANE lets you get the actual data you want (domain name->public key binding) from the root source, without needing the complicated middlemen.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#107

Post by snowwrestler »

paulnpace wrote: post #68
_wldu wrote: post #54

DNSSEC is notorious for breaking things [1]. I use it on most of my domains, but I would not just 'enable' it on a domain that I cared about and that had real users without a lot of thought and planning. Nor should you. [1] - https://ianix.com/pub/dnssec-outages.html

> DNSSEC is notorious for breaking things My understanding is that people break things.

Sure, everyone makes mistakes, but there’s still a difference between juggling rubber balls and juggling knives.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#109

Post by medguru »

medguru wrote: post #70
hericium wrote: post #63

Earlier quoted context omitted.

Since the issue was made public, we'd love to see some details in case OP (throwaway) doesn't come back.

I'll be back.

https://news.ycombinator.com/context?id=31413856

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#110

Post by mike_d »

mike_hearn wrote: post #106
mike_d wrote: post #98

Earlier quoted context omitted.

The correct steps are to completely disable DNSSEC and remove the relevant records. It is far too fragile for the majority of use cases. Effort should instead be put into deploying things like DNSCrypt that implement transport security and confidentiality. Transport security is like HTTPS. DNSSEC was the equivalent of PGP signing every webpage. The former brings value to the end user, the latter not so much. Even the…

DNSSEC is however the only way you can make TLS really work. The whole TLS ecosystem is dependent on CAs that are basically just a giant hack. They're signing a statement that they did a bunch of DNS resolutions at a point in time from different network vantage points (maybe, hopefully), and got consistent answers. DNSSEC+DANE lets you get the actual data you want (domain name->public key binding) from the root sourc…

DNSSEC+DANE is an affirmation by the United States government that you have followed a chain to an answer about a certificate pinning. Handshake (www.handshake.org, Trigger warning: crypto) will give you what you are talking about (CA non-reliance) anchored in the owner of the website itself.

If you aren't a fan of DV certificates (as you point out verified by resolution), you can always restrict your trust store to only CA certificates that sign EV certificates (verified by business records).

Post reply on HN