Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 123 posts

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#41

Post by antihero »

the8472 wrote: post #14
belorn wrote: post #12

Earlier quoted context omitted.

It like https. A lot of people in the past viewed HTTPS as a terrible idea that just broke things, and every example where someone had their website go down because of broken certificates or mixed content was proof that https as a concept was broken. Usually people brought up x.509 or revocation lists as the definitive proof that https would never be common.

From a site reliability perspective HTTPS is still broken. Some 15yo OS can't access any site because it doesn't have the certificates or cipher suites. And as you mentioned we need to update certs, webservers and DNS all the time to keep up to date. We only put up with it because it protects users from from snoopers. But that means we live in an inadequate equilibrium. If we abolished mass surveillance rather than i…

It really isn’t hard now there’s letsencrypt. We’ll never live in a world where a connection between the client and server can be completely trusted.

HTTPS is wonderful because it offers a guarantee that the data isn’t tampered with (except with corporate root CAs, but that is fuckery).

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#42

Post by theamk »

medguru wrote: post #6
scrollaway wrote: post #2

> what's the fastest way to get technical assistance when on a free plan? Upgrading to a non-free plan? You don't have to upgrade to enterprise, but even their $20/mo plan comes with support. (Also, I hate to victim-blame here but using DNSSEC was a bad idea in the first place)

Can you please explain why DNSSEC was a bad idea in the first place? It worked perfectly fine with the old registrar.

Basically, it is lots of extra work effort for no real security advantages. Other people wrote a lot about it, here is an example:

https://sockpuppet.org/blog/2015/01/15/against-dnssec/

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#43

Post by medguru »

williamtwild wrote: post #32

>I've been forced to migrate the project and its (few) users to a completely different domain. I cannot inconvenience users by bouncing them back and forth, so the domain Cloudflare ruined for me is now effectively lost, as is the "branding" of the project which was reflected in the domain's name. If this was that important then you should not have used the free plan.

Why do you presume the issue would have gotten immediate attention for the sum of $20? Customers don't make Cloudflare's terms, and customers didn't decide for Cloudflare to offer a free plan with zero markup for their registrar operations.

There is by users' own hands no way out of domain registration issues like these, sooner than 30-45 days when the domain can be transferred once again. Those who decide to offer registrar services, even for free, must hold some liability towards the users and the ecosystem and offer some support to make sure their product actually works.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#44

Post by tedivm »

b3lvedere wrote: post #34
medguru wrote: post #17

Earlier quoted context omitted.

My domain and users have ended up in limbo beyond anyone's but Cloudflare's control. I cannot transfer it back to the working registrar, or I would without being "angry at some free service". Why do you think berating me with snide remarks is helpful?

My apologies if you read it as a snide remark. I'm usually baffled when support is demanded on free stuff, but i see your point in this particular scenario.

No one "read it as a snide remark"- you were snide and rude. Just own it and apologize.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#45

Post by theamk »

belorn wrote: post #12
medguru wrote: post #6

Earlier quoted context omitted.

Can you please explain why DNSSEC was a bad idea in the first place? It worked perfectly fine with the old registrar.

It like https. A lot of people in the past viewed HTTPS as a terrible idea that just broke things, and every example where someone had their website go down because of broken certificates or mixed content was proof that https as a concept was broken. Usually people brought up x.509 or revocation lists as the definitive proof that https would never be common.

Eh, except that HTTPS actually has tangible benefits, unlike DNSSEC.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#47

Post by gigatexal »

medguru wrote: post #9
elithrar wrote: post #3

(It sucks that I had to see this on HN) Can you email me - silverlock at cloudflare - with your ticket ID and domain name so I can understand what broke?

Thank you for the attention, e-mail on its way.

Come back and tell us what happened and the resolution.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#48

Post by jtbayly »

the8472 wrote: post #14
belorn wrote: post #12

Earlier quoted context omitted.

It like https. A lot of people in the past viewed HTTPS as a terrible idea that just broke things, and every example where someone had their website go down because of broken certificates or mixed content was proof that https as a concept was broken. Usually people brought up x.509 or revocation lists as the definitive proof that https would never be common.

From a site reliability perspective HTTPS is still broken. Some 15yo OS can't access any site because it doesn't have the certificates or cipher suites. And as you mentioned we need to update certs, webservers and DNS all the time to keep up to date. We only put up with it because it protects users from from snoopers. But that means we live in an inadequate equilibrium. If we abolished mass surveillance rather than i…

It’s very sad that new SSL sites just don’t work on older computers that work just fine still. We’re not talking about complicated sites that wouldn’t work anyway without new browsers. Just basic HTML.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#49

Post by Spooky23 »

medguru wrote: post #6
scrollaway wrote: post #2

> what's the fastest way to get technical assistance when on a free plan? Upgrading to a non-free plan? You don't have to upgrade to enterprise, but even their $20/mo plan comes with support. (Also, I hate to victim-blame here but using DNSSEC was a bad idea in the first place)

Can you please explain why DNSSEC was a bad idea in the first place? It worked perfectly fine with the old registrar.

DNSSEC doesn’t really solve any problems that you have nor does it meaningfully prevent any security risks.

It does create a lot of operational risk, as you’ve discovered. It also checks a box if you’re building a system for the US Federal .gov.

tptacek has written about this at length on this site and other places.

Re: Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days

#50

Post by baisq »

verdverm wrote: post #39
TedDoesntTalk wrote: post #27

Earlier quoted context omitted.

HTTPS is indeed broken when viewing it from a site reliability perspective. Anyone who has maintained more than a handful of domains simultaneously will agree (personally I’ve managed hundreds, each with their own certificate … it’s an awful experience).

I've had several sites with HTTPS work for many years now with zero effort or SRE time. Let's Encrypt via certbot handles it all for me

Lucky you. I’ve had multiple problems like rate limits, cron not firing, let’s encrypt servers not being able to see challenge files because of obscure rewrite rules… it’s far from flawless
Post reply on HN