[dead]
DNSSEC disruption affecting .de domains – Resolved
71–80 of 440 posts
Re: DNSSEC disruption affecting .de domains – Resolved
#72I must be early. There's not a single tptacek DNSSEC rant in this thread yet.
He’s busy with MathAcademy earning XP-SEC
Re: DNSSEC disruption affecting .de domains – Resolved
#73How come I have zero problems with any .de domain I tried accessing in the last half hour?
maybe your upstream doesn't validate DNSSEC?
maybe? I'm using PiHole and 8.8.8.8/1.1.1.1 as upstream, and both options show "DNSSEC" next to their options in settings, so I assumed DNSSEC was enabled (unless I have to enable this somewhere else as well?)
Re: DNSSEC disruption affecting .de domains – Resolved
#74On a slightly unrelated note, I was setting nameservers for two .de domains a few weeks ago and thought my provider was being crazily strict because they kept getting rejected. Turns out you can't point to a nameserver until that nameserver has a zone for the domain, and you can't use nameservers from two providers unless those two providers are both in the NS records at both ends
Re: DNSSEC disruption affecting .de domains – Resolved
#75Wow… it’s definitely not all .de TLDs, but a lot of prominent ones definitely.
Amazon is completely down in Germany. Not only on amazon.de, even in the app.
Re: DNSSEC disruption affecting .de domains – Resolved
#76Finally establishing the concept of Feiertag on the internet. Come back tomorrow.
Internetfreie Dienstage, 21st century variant of Autofreie Sonntage.
Re: DNSSEC disruption affecting .de domains – Resolved
#77how is that possible?
[deleted]
Re: DNSSEC disruption affecting .de domains – Resolved
#78On a slightly unrelated note, I was setting nameservers for two .de domains a few weeks ago and thought my provider was being crazily strict because they kept getting rejected. Turns out you can't point to a nameserver until that nameserver has a zone for the domain, and you can't use nameservers from two providers unless those two providers are both in the NS records at both ends
Common paint point with DNSSEC. It’s brutal in the domain industry because when you buy a name with DNSSEC enabled it oftentimes can’t be setup to resolve due to these sorts of issues. Typically seller needs to deactivate first.
Re: DNSSEC disruption affecting .de domains – Resolved
#79I've considered hard-coding some addresses into firmware as a fallback for a DNS outtage (which is more likely than not just misconfigured local DNS.) Events like this help justify this approach to the unconcerned.
The irony is that DNS is a global and distributed system meant to be resilient. It’s the DNSSEC layer on top in this case causing problems.
Re: DNSSEC disruption affecting .de domains – Resolved
#80I work with a few people specialised in IT security, and some of them take their jobs too seriously and will "lock down" everything to the point that it becomes a very real risk that they lock out everyone including themselves. Fundamentally, security is a solution to an availability problem: The desire of the users is for a system to remain available despite external attack. Systems that become unavailable to everyo…
Security = Confidentiality + Integrity + Availability or alternatively, Security = (exclude unauth'd reads) + (exclude unauth'd writes) + (include auth'd reads and auth'd writes) Gotta satisfy all parts in order to have security.
If you squint at it, you can convert all three to just availability.
Confidentiality = available to us, but nobody else.
Integrity = available to us in a pristine condition.
E.g.: What's the benefit to you if your data is so confidential that you can't read it either? This is a real problem with some health information systems, where I can't access my own health records! Ditto with many government bureaucracies that keep my records safe and secure from me.