Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

Post by warrenm » Thu, May 19, 2022, 2:29 PM UTC

the8472 wrote: post #94

warrenm wrote: post #91

Earlier quoted context omitted.

> From a site reliability perspective HTTPS is still broken. Some 15yo OS can't access any site because it doesn't have the certificates or cipher suites Sorry, but this argument doesn't hold water And this coming from someone who supports systems still running NT 4 I have fallback rules enabled on all of my domains - TLS 1.3 is preferred, but older editions will be supported if the need arises (1.2, 1.1, and 1.0 (on…

Doesn't that enable downgrade attacks?

Post by paulnpace » Fri, May 20, 2022, 6:04 PM UTC

tptacek wrote: post #122

paulnpace wrote: post #115

Earlier quoted context omitted.

I've seen far more failed certificate renewal failures than DNSSEC failures from the same teams you appear to be suggesting are perfect and the standard is flawed.

The consequences of a failed certificate renewal are much smaller than the consequences of a DNSSEC failure: if you screw up DNSSEC, your site falls off the Internet, as if it never existed.