Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC disruption affecting .de domains – Resolved

status.denic.de

Post reply on HN
Print view View original

331–340 of 440 posts

Re: DNSSEC disruption affecting .de domains – Resolved

#331

Post by jll29 »

thayne wrote: post #266
Muromec wrote: post #210

Earlier quoted context omitted.

The trick to asn.1 is to generate both parser and serializer from the spec. Elliptic curve math on the other hand is ... yeah, you need to know the math and also know the tricks to code that implements it. Both of those have steep learning curve, but it's hardly because it's a mess or it's old.

The problem with ASN.1 is that it is big and complicated, and you only need a fraction of it for cryptography, and it isn't really used for anything outside of pki anymore. It wouldn't be as bad if asn.1 had cought on more as a general purpose serialization format and there were ubiquitous decent libraries for dealing with it. But that didn't happen. Probably partly because there are so many different representations…

Assuming there are some libraries for it, would this make a pretty good case for LLM-generated ports of these existing libraries into other languages or onto other OSs/platforms? One implementation could be treated as "the spect".

Re: DNSSEC disruption affecting .de domains – Resolved

#332

Post by weird-eye-issue »

pocksuppet wrote: post #330
weird-eye-issue wrote: post #318

Earlier quoted context omitted.

Yeah just ignore the big "not secure" warning in the URL bar

I just checked it. You mean the very small open padlock icon? The era of browsers warning loudly about HTTP was a decade ago, it got reversed due to pushback.

Well I checked both Chrome and Firefox on mobile and my desktop and they were all much more obvious than just an "open padlock". They both said "Not Secure" and in Firefox it was bright red text. Also in incognito mode Chrome refused to even open the site without a full screen warning. They all make it super clear non-HTTPS sites are not secure so I'm not really sure what your point is?

Re: DNSSEC disruption affecting .de domains – Resolved

#333

Post by profmonocle »

zelon88 wrote: post #312
otabdeveloper4 wrote: post #304

Earlier quoted context omitted.

> The internet's famous "routing around damage" ...is only for Pentagon networks and military stuff. It's not for us normal people. (We get Cloudflare and FAANG bullshit instead.)

This is actually startlingly true. Every FAANG company has their own fiber backbone. Why invest the internet that everyone uses when you can invest in your own private internet and then sell that instead?

It's not like the long-haul fiber not owned by FAANG is a public utility, at least not in most places.

Traffic that goes over "the Internet" traverses some mix of your ISP's fiber, fiber belonging to some other ISP they have a deal with, then fiber belong to some ISP they have a deal with, etc.

All those ISPs are being paid to provide service, they can invest in their own networks.

Re: DNSSEC disruption affecting .de domains – Resolved

#334

Post by tommit »

ulfw wrote: post #264
TacticalCoder wrote: post #242

Earlier quoted context omitted.

> Yeah it's only the third largest economy in the world You can both be the 3rd biggest economy in the world and still only be 1/10th of US+China GDPs combined. And only three companies in the Top 100 for Germany: https://companiesmarketcap.com/ Germany is the kingdom of the "mittelstand": many, many, many SMEs. Both GP and you are right: it's the 3rd largest economy in the world and yet it's simply not that big. htt…

How is 1/10th the size of number 1 and 2 COMBINED small? In what world is that a small number? Especially as those two are 1.8 billion people vs 0.08 billion for Germany

This comparison threw me for such a loop. What an odd way to present a point.

Re: DNSSEC disruption affecting .de domains – Resolved

#335

Post by tommit »

Medicineguy wrote: post #324
mschuster91 wrote: post #155

Earlier quoted context omitted.

Not sure if serious or /s

Almost certainly /s. "Danke Merkel" ("Thanks Merkel") was once a sincere criticism from conservatives regarding her policies (esp. during 2015 refugee crisis), but it quickly evolved into a sarcastic, deadpan joke used to blame her for literally anything that goes wrong in daily Germany - even years after she left. Interesting phenomenon...

It's our version of Thanks Obama.

Re: DNSSEC disruption affecting .de domains – Resolved

#336

Post by profmonocle »

tptacek wrote: post #274
cyberax wrote: post #273

Earlier quoted context omitted.

You're wrong. Both .com and .net are signed (`dig RRSIG com.`), and if they screw up, then all the com/net zones will become inaccessible.

Virtually no zones under .com/.net are signed, which was the only point I was making. It has no adoption here.

Even if example.com is unsigned, the delegation from .com to example.com will still be signed (including an attestation that example.com is unsigned). So lack of DNSSEC adoption by users of the TLD wouldn't save them here.

Re: DNSSEC disruption affecting .de domains – Resolved

#337

Post by nkydr0i0 »

Medicineguy wrote: post #324
mschuster91 wrote: post #155

Earlier quoted context omitted.

Not sure if serious or /s

Almost certainly /s. "Danke Merkel" ("Thanks Merkel") was once a sincere criticism from conservatives regarding her policies (esp. during 2015 refugee crisis), but it quickly evolved into a sarcastic, deadpan joke used to blame her for literally anything that goes wrong in daily Germany - even years after she left. Interesting phenomenon...

What about "Thanks Obama"[0]

[0] https://en.wikipedia.org/wiki/Thanks,_Obama

Re: DNSSEC disruption affecting .de domains – Resolved

#339

Post by phicoh »

akerl_ wrote: post #280
pocksuppet wrote: post #279

Earlier quoted context omitted.

If there's going to be a single point of failure in front of your website, that single point of failure may as well be the only single point of failure instead of having two single points of failure, and it's probably important that people can't spoof responses.

Nobody had to hack it. A system at DENIC broke, and so Cloudflare turned off DNSSEC validation for all of their users accessing .de. If DNSSEC was actually important for the security model of those users, that would be a huge deal.

If DNSSEC is part of your security model, you want local validation. Not relying on third party resolver that you don't have a contract with.

Beyond that, DNS has the AD bit. If you need DNSSEC secure data (for example for the TLSA record), then when Cloudflare turns off DNSSEC validation, the AD bit will be clear and things will stop working.

Re: DNSSEC disruption affecting .de domains – Resolved

#340

Post by dizhn »

siva7 wrote: post #82

Crazy. I can't remember an incident like this ever happened before and it's still not fixed? .de is probably the most important unrestricted domain after .com from an economical perspective. Millions of businesses are "down".

Must have been mid 2000s. Root dns servers were down. Super hard to diagnose the issues it causes on your side because it "never happens".
Post reply on HN