Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC disruption affecting .de domains – Resolved

status.denic.de

Post reply on HN
Print view View original

251–260 of 440 posts

Re: DNSSEC disruption affecting .de domains – Resolved

#251

Post by LastTrain »

gerdesj wrote: post #240
qazwsxedchac wrote: post #111

Earlier quoted context omitted.

So a single configuration mistake in a single place wiped out external reachability of a major economy. It happened in the evening local time and should be fixable, modulo cache TTLs, by morning. This will limit the blast radius somewhat. Still, at this level, brittle infrastructure is a political risk. The internet's famous "routing around damage" isn't quite working here. Should make for an interesting post mortem.

"The internet's famous "routing around damage" isn't quite working here." DNS is a look up service that runs on the internet. Internet routing of IP packets is what the internet does and that is working fine (for a given value of fine). You remind me of someone using the term "the internet is down" that really means: "I've forgotten my wifi password".

Us non pod-people caught his drift.

Re: DNSSEC disruption affecting .de domains – Resolved

#252

Post by NooneAtAll3 »

TacticalCoder wrote: post #242
trollbridge wrote: post #158

Earlier quoted context omitted.

Yeah it's only the third largest economy in the world

> Yeah it's only the third largest economy in the world You can both be the 3rd biggest economy in the world and still only be 1/10th of US+China GDPs combined. And only three companies in the Top 100 for Germany: https://companiesmarketcap.com/ Germany is the kingdom of the "mittelstand": many, many, many SMEs. Both GP and you are right: it's the 3rd largest economy in the world and yet it's simply not that big. htt…

what's SME?

Re: DNSSEC disruption affecting .de domains – Resolved

#254

Post by jonah-archive »

fastest963 wrote: post #246
amluto wrote: post #205

Earlier quoted context omitted.

It is indeed a bit sad that Cloudflare had to turn off DNSSEC completely. But I completely understand that they don't have a production-ready, tested path to override DNSSEC validation for only some domains.

[flagged]

Originally it said:

---

The issue has been identified as a DNSSEC signing problem at DENIC, the organization responsible for the .DE top-level domain. Cloudflare has temporarily disabled DNSSEC validation on 1.1.1.1 resolver in order to allow .DE names to continue to resolve. DNSSEC validation will be re-enabled when the signing problems at DENIC are known to have been resolved.

---

(and in case it changes again, now it says)

---

The issue has been identified as a DNSSEC signing problem at DENIC, the organization responsible for the .DE top-level domain. Cloudflare has temporarily disabled DNSSEC validation for .de domains on 1.1.1.1 resolver (as per RFC 7646) in order to allow .DE names to continue to resolve. DNSSEC validation will be re-enabled when the signing problems at DENIC are known to have been resolved.

See RFC 7646 for more details: https://datatracker.ietf.org/doc/html/rfc7646

---

Re: DNSSEC disruption affecting .de domains – Resolved

#255

Post by dwattttt »

tptacek wrote: post #218
Muromec wrote: post #210

Earlier quoted context omitted.

The trick to asn.1 is to generate both parser and serializer from the spec. Elliptic curve math on the other hand is ... yeah, you need to know the math and also know the tricks to code that implements it. Both of those have steep learning curve, but it's hardly because it's a mess or it's old.

The trick to ASN.1 is to serialize/unserialize it backwards.

#1 NSA, I get it now!

Re: DNSSEC disruption affecting .de domains – Resolved

#256

Post by tptacek »

jonah-archive wrote: post #254
fastest963 wrote: post #246

Earlier quoted context omitted.

[flagged]

Originally it said: --- The issue has been identified as a DNSSEC signing problem at DENIC, the organization responsible for the .DE top-level domain. Cloudflare has temporarily disabled DNSSEC validation on 1.1.1.1 resolver in order to allow .DE names to continue to resolve. DNSSEC validation will be re-enabled when the signing problems at DENIC are known to have been resolved. --- (and in case it changes again, now…

The RFC 7646 thing here is the funniest possible addition. This is the greatest day.

Re: DNSSEC disruption affecting .de domains – Resolved

#257

Post by qingcharles »

icedchai wrote: post #163
dlopes7 wrote: post #124

Earlier quoted context omitted.

I love how I work with IT for 20 years and don't understand a single acronym here other than DNSSEC

I've been in IT 30+ years, been running DNS, web servers, etc. since at least 1994. I haven't bothered with DNSSEC due to perceived operational complexity. The penalty for a screw up, a total outage, just doesn't seem worth the security it provides.

How simple sysadmin was in 1994 with no cryptography on any protocol. Everything could be easily MITM'd. Your credit card number would get jacked left and right in the 90s.

Re: DNSSEC disruption affecting .de domains – Resolved

#258

Post by walrus01 »

belorn wrote: post #208
qazwsxedchac wrote: post #111

Earlier quoted context omitted.

So a single configuration mistake in a single place wiped out external reachability of a major economy. It happened in the evening local time and should be fixable, modulo cache TTLs, by morning. This will limit the blast radius somewhat. Still, at this level, brittle infrastructure is a political risk. The internet's famous "routing around damage" isn't quite working here. Should make for an interesting post mortem.

I am reminded of the warning that zonemaster gives about putting your domain name servers on a single AS, as is common practice for many larger providers. A lot of people do not want others to see this as a problem since a single AS is a convenient configuration for routing, but it has the downside of being a single point of failure. Building redundant infrastructure that can withstand BGP and DNS configuration mista…

As the CPU/RAM resources to run an authoritative-only slave nameserver for a few domains are extremely minimal (mine run at a unix load of 0.01), it's a very wise idea to put your ns3 or something at a totally different service provider on another continent. It costs less than a cup of coffee per month.

Re: DNSSEC disruption affecting .de domains – Resolved

#259

Post by gerdesj »

icedchai wrote: post #163
dlopes7 wrote: post #124

Earlier quoted context omitted.

I love how I work with IT for 20 years and don't understand a single acronym here other than DNSSEC

I've been in IT 30+ years, been running DNS, web servers, etc. since at least 1994. I haven't bothered with DNSSEC due to perceived operational complexity. The penalty for a screw up, a total outage, just doesn't seem worth the security it provides.

That was my experience too until I decided that just running email systems for 30 odd years when HN says that is unnatural piqued my weird or something!

I ran up three new VMs on three different sites. I linked all three systems via a private Wireguard mesh. MariaDB on each VM bound to the wg IP and stock replication from the "primary". PowerDNS runs across that lot. One of the VMs is not available from the internet and has no identity within the DNS. The idea is that if the Eye of Sauron bears down on me, I can bring another DNS server online quite quickly and fiddle the records to bring it online. It also serves as a third authority for replication.

I also deployed https://github.com/PowerDNS-Admin/PowerDNS-Admin which is getting on a bit and will be replaced eventually but works beautifully.

Now I have DNS with DNSSEC and dynamic DNS and all the rest. This is how you start signing a zone and PowerDNS will look after everything else:

  # pdnsutil secure-zone example.co.uk
  # pdnsutil zone set-nsec3 example.co.uk
  # pdnsutil zone rectify example.co.uk
Grab a test zone and work it all out first, it will cost you not a lot and then go for "production".

My home systems are DNSSEC signed.

Re: DNSSEC disruption affecting .de domains – Resolved

#260

Post by gerdesj »

qingcharles wrote: post #257
icedchai wrote: post #163

Earlier quoted context omitted.

I've been in IT 30+ years, been running DNS, web servers, etc. since at least 1994. I haven't bothered with DNSSEC due to perceived operational complexity. The penalty for a screw up, a total outage, just doesn't seem worth the security it provides.

How simple sysadmin was in 1994 with no cryptography on any protocol. Everything could be easily MITM'd. Your credit card number would get jacked left and right in the 90s.

Cool. Feel free to explain how to tighten things up.

I've just given them part of a recipe for using DNSSEC. I suspect you are not actually human .. qingcharles.

Post reply on HN