81–90 of 123 posts
Earlier quoted context omitted.
You would usually need to disable DNSSEC, wait 24h, transfer, and then wait for at least 24h before enabling DNSSEC again.
Are there any case where DNSSEC can be kept enabled? I though it need to be disabled for transferring.
DNSSEC is notorious for breaking things [1]. I use it on most of my domains, but I would not just 'enable' it on a domain that I cared about and that had real users without a lot of thought and planning. Nor should you. [1] - https://ianix.com/pub/dnssec-outages.html
> DNSSEC is notorious for breaking things My understanding is that people break things.
> Just culture is a concept related to systems thinking which emphasizes that mistakes are generally a product of faulty organizational cultures, rather than solely brought about by the person or persons directly involved. In a just culture, after an incident, the question asked is, "What went wrong?" rather than "Who caused the problem?".
Prominent (and very effective) example: Aviation safety.
DNSSEC is both easy to break and hard to fix. https://sockpuppet.org/blog/2015/01/15/against-dnssec/
Earlier quoted context omitted.
> DNSSEC is notorious for breaking things My understanding is that people break things.
https://en.wikipedia.org/wiki/Just_culture > Just culture is a concept related to systems thinking which emphasizes that mistakes are generally a product of faulty organizational cultures, rather than solely brought about by the person or persons directly involved. In a just culture, after an incident, the question asked is, "What went wrong?" rather than "Who caused the problem?". Prominent (and very effective) exam…
All plans come with support. Even the free plans (community, or email, the bot will deflect the request but if you email you're still stuck, you will get a reply _eventually_ (due to heavy support load, it can take a while though).
The correct procedure would be:
* turn off DNSsec on old registrar (and wait a day or two)
* update NS and/or migrate domain
* wait a while and make sure it works
* turn on DNSsec in CF dash and update DNSsec settings in the domain
It's not that DNSsec doesn't work -- it's doing exactly what it's supposed to be doing.
I'm also noticing that Cloudflare support is going terribly downhill. I have an issue with the Cloudflare infrastructure on my domain since WEEKS, giving me thousands of 503 Service Temporarily Unavailable errors per day (cloudflare side, not the origin server) and nobody seems to care or able to resolve. Removing the ability to create support tickets on free plan doesn't help at all, I mean, I get it why they're doi…
Recently I had to reach out to @CloudflareSupport on Twitter to get my several day old report of bad Warp+ routing on the forums looked at. It was eventually fixed but it was done in silence and really wasn't something that should've happened in the first place. Nor has there been a followup report on what went wrong.
(CF TAM here) All plans come with support. Even the free plans (community, or email, the bot will deflect the request but if you email you're still stuck, you will get a reply _eventually_ (due to heavy support load, it can take a while though). The correct procedure would be: * turn off DNSsec on old registrar (and wait a day or two) * update NS and/or migrate domain * wait a while and make sure it works * turn on D…
I'm also noticing that Cloudflare support is going terribly downhill. I have an issue with the Cloudflare infrastructure on my domain since WEEKS, giving me thousands of 503 Service Temporarily Unavailable errors per day (cloudflare side, not the origin server) and nobody seems to care or able to resolve. Removing the ability to create support tickets on free plan doesn't help at all, I mean, I get it why they're doi…
It’s weird; If I was affected by a bug on Cloudflare, my first instinct would not be to start giving them money in order to be allowed to inform them about it.
Earlier quoted context omitted.
What's the threat model here?
Random examples of MITM attacks I could do on a read-only website: * Inserting malicious JavaScript * Changing content on trusted websites in order to mislead people * Replacing downloadable application binaries with versions that contain malicious code
Points 2 and 3 are the same, they're about integrity which could be had cheaper with content-addressing (hashes uniquely identifying the content) rather than pulling in the full TLS+CA machinery.
>I've been forced to migrate the project and its (few) users to a completely different domain. I cannot inconvenience users by bouncing them back and forth, so the domain Cloudflare ruined for me is now effectively lost, as is the "branding" of the project which was reflected in the domain's name. If this was that important then you should not have used the free plan.
Why do you presume the issue would have gotten immediate attention for the sum of $20? Customers don't make Cloudflare's terms, and customers didn't decide for Cloudflare to offer a free plan with zero markup for their registrar operations. There is by users' own hands no way out of domain registration issues like these, sooner than 30-45 days when the domain can be transferred once again. Those who decide to offer r…
Its frankly, disgusting.
(CF TAM here) All plans come with support. Even the free plans (community, or email, the bot will deflect the request but if you email you're still stuck, you will get a reply _eventually_ (due to heavy support load, it can take a while though). The correct procedure would be: * turn off DNSsec on old registrar (and wait a day or two) * update NS and/or migrate domain * wait a while and make sure it works * turn on D…
I mean when you are adding a new domain, CF can clearly tell if a domain already has dnssec on or not. Seems like something that should raise a warning to the user.
Source: me, having lost access to my domain for 4 days for reasons that are not yet fully clear to me.