Live data from Hacker News

Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

news.ycombinator.com

31–40 of 123 posts

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#31
post #14
post #12

Earlier quoted context omitted.

It like https. A lot of people in the past viewed HTTPS as a terrible idea that just broke things, and every example where someone had their website go down because of broken certificates or mixed content was proof that https as a concept was broken. Usually people brought up x.509 or revocation lists as the definitive proof that https would never be common.

From a site reliability perspective HTTPS is still broken. Some 15yo OS can't access any site because it doesn't have the certificates or cipher suites. And as you mentioned we need to update certs, webservers and DNS all the time to keep up to date. We only put up with it because it protects users from from snoopers. But that means we live in an inadequate equilibrium. If we abolished mass surveillance rather than i…

HTTPS also guarantees integrity of the content; even for read-only sites it's important to ensure content isn't modified, code isn't injected, etc. There's an argument that a protocol which does integrity-checks only (without data encryption) might be good, that's the NONE cipher in TLS but it was removed in TLS 1.3 I believe; but it wouldn't fundamentally change the problem with 15yo operating systems lacking the software support or whatever.

(More broadly though the operational overhead of software is really high these days in a lot of ways. I think that's true of anything, not just HTTPS, but there are a lot of other historical factors leading to that.)

I think it's a bit of a leap to suggest that just doing things like banning mass surveillance would magically make systems more stable or make 15yo operating systems suddenly relevant on the net again. We'd probably still need a lot of the stuff we have in place already. However, I suggest we try it anyway because there's only one way to find out and oh well we won't lose anything valuable anyway.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#32
>I've been forced to migrate the project and its (few) users to a completely different domain. I cannot inconvenience users by bouncing them back and forth, so the domain Cloudflare ruined for me is now effectively lost, as is the "branding" of the project which was reflected in the domain's name.

If this was that important then you should not have used the free plan.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#33
post #25
post #19

Earlier quoted context omitted.

Do you think criminals care about the law?

Criminals are much less likely to engage in MITM attacks, besides TLAs it's usually shady ISPs who want to inject some content (similar to surveillance that could be made illegal too, ISPs would in fact care). And criminals also have little incentive to attack read-only sites. Even if they did it might be more efficient to allocate resources to law enforcement rather than securing everything that could theoretically…

They're not attacking the sites, they're attacking the users. Incentives are exactly the same with readonly sites.

I'm a web programmer and I have no idea how the law enforcement could in any way help. Nor do I want them to. The idea that I have to cooperate with law enforcement to put a site online is absurd.

See "Tech support scams" on YouTube to see what's being done today. We're talking about billion-dollar crime organizations.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#34
post #17

-- removed. My apologies. --

My domain and users have ended up in limbo beyond anyone's but Cloudflare's control. I cannot transfer it back to the working registrar, or I would without being "angry at some free service". Why do you think berating me with snide remarks is helpful?

My apologies if you read it as a snide remark. I'm usually baffled when support is demanded on free stuff, but i see your point in this particular scenario.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#35
post #29

Earlier quoted context omitted.

You should still protect against MITM attacks even with read-only websites - not all attacks are based on stealing user input.

What's the threat model here?

Random examples of MITM attacks I could do on a read-only website:

* Inserting malicious JavaScript

* Changing content on trusted websites in order to mislead people

* Replacing downloadable application binaries with versions that contain malicious code

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#36

Earlier quoted context omitted.

Are there any case where DNSSEC can be kept enabled? I though it need to be disabled for transferring.

There is, but it requires cooperation between everyone and double signing between the old and new hosting service (for a short period of time). That rarely works out in the real world.

[deleted]

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#37
post #22
post #18

Earlier quoted context omitted.

> If we abolished mass surveillance then we wouldn't need encryption for read-only sites, we could have our cake and eat it too. Mass surveillance is not the only reason to have HTTPS everywhere. It protects not just from snoopers, but from MITM attacks.

Did you notice the "read only sites" part? MITM is hardly relevant for those.

>Did you notice the "read only sites" part? MITM is hardly relevant for those.

I'm sorry but you're not thinking this through very carefully. People still care about authentication of read-only stuff, in the same way much (and it should be all) open source software, particularly from repositories, is signed these days. A great deal of mischief can be done by modifying info in flight, even ignoring privacy concerns entirely. Plenty of not just governmental but corporate bodies could benefit by being able to trivially rewrite whatever populations (or targeted segments of populations) read. Even ignoring what a vector it could be for other attacks. In principle, we could have some universal standard for signing and authenticating as unaltered websites without bothering to encrypt them. But frankly that seems pointless vs just having encryption as well.

Further, like all practical public crypto use in the face of adversaries, there is a lot of benefit from using it universally and thus "hiding in the herd". Otherwise, the mere usage of crypto itself is a signal, and also easier to target and block (not just technically but via laws). Whereas when it's just baked into literally everything that's much harder to outright infeasible, and also destroys that extra bit of signal.

This was all debated and considered extensively while the moves to universal HTTPS were happening. People moved read-only sites as well for a reason.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#39
post #14

Earlier quoted context omitted.

From a site reliability perspective HTTPS is still broken. Some 15yo OS can't access any site because it doesn't have the certificates or cipher suites. And as you mentioned we need to update certs, webservers and DNS all the time to keep up to date. We only put up with it because it protects users from from snoopers. But that means we live in an inadequate equilibrium. If we abolished mass surveillance rather than i…

HTTPS is indeed broken when viewing it from a site reliability perspective. Anyone who has maintained more than a handful of domains simultaneously will agree (personally I’ve managed hundreds, each with their own certificate … it’s an awful experience).

I've had several sites with HTTPS work for many years now with zero effort or SRE time. Let's Encrypt via certbot handles it all for me
Post reply on HN