Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC disruption affecting .de domains – Resolved

status.denic.de

Post reply on HN
Print view View original

341–350 of 440 posts

Re: DNSSEC disruption affecting .de domains – Resolved

#341

Post by red_admiral »

weird-eye-issue wrote: post #285
pocksuppet wrote: post #277

Earlier quoted context omitted.

Probably the most common reason to use TLS is to check a box on a list of compliance rules. Is that bad?

Do browsers even load non-HTTPS sites anymore without a massive warning?

neverssl.com works fine for me, only a small warning in the place where the padlock usually is, that no-one checks anyway.

The browser would be very unhappy with an on a non-TLS site (localhost excepted). HSTS would trigger the "massive" warning and refuse to load the site, however.

Re: DNSSEC disruption affecting .de domains – Resolved

#342

Post by sam_lowry_ »

the8472 wrote: post #160
qazwsxedchac wrote: post #111

Earlier quoted context omitted.

So a single configuration mistake in a single place wiped out external reachability of a major economy. It happened in the evening local time and should be fixable, modulo cache TTLs, by morning. This will limit the blast radius somewhat. Still, at this level, brittle infrastructure is a political risk. The internet's famous "routing around damage" isn't quite working here. Should make for an interesting post mortem.

fail-closed protocols have introduced some brittleness. A HTTP 1.0 server from 1999 probably still can service visitors today. A HTTPS/TLS 1.0 server from the same year wouldn't.

This is why I still run my blog on HTTP/1.1 only.

Re: DNSSEC disruption affecting .de domains – Resolved

#344

Post by sam_lowry_ »

greensh wrote: post #325
tptacek wrote: post #276

Earlier quoted context omitted.

Pretty sure that rant doesn't exist.

It does kinda? at least the part about to much security and it's really funny: https://tom7.org/httpv/httpv.pdf also available as Video on YouTube.

I host my blog on HTTP/1.1 only. But I also have an amateur radio station and I listen occasionally to (unencrypted!) air traffic frequencies around nearby airport.

Re: DNSSEC disruption affecting .de domains – Resolved

#345

Post by Avamander »

cyberax wrote: post #272
Avamander wrote: post #222

Earlier quoted context omitted.

It is not fine. Keeping key material safe is not a boolean between "permanently safe" and "leaks immediately". Keeping key material secure for more than a decade while it's in active use is vastly more complex than keeping it secure for a month, until it rotates. For all we know, some ex-employee might be walking around with that KSK, theoretically being able to use it for god knows what for an another decade.

> Keeping key material secure for more than a decade while it's in active use is vastly more complex than keeping it secure for a month, until it rotates. Nope. Key material rotation is just circus when it's done for the sake of rotation. > For all we know, some ex-employee might be walking around with that KSK, theoretically being able to use it for god knows what for an another decade. Or maybe an employee has comp…

> Or maybe an employee has compromised the new key that is going to be rotated in, while the old key is securely rooted in an HSM?

Also possible, but that'd be an active threat that has some probability of being caught.

Never replacing keys allows permanent compromise that can only be caught if someone directly observes misuse.

Though nobody monitors DNSSEC like that, nor uses it, so it's fine from that aspect I guess.

Re: DNSSEC disruption affecting .de domains – Resolved

#346

Post by elp »

fulafel wrote: post #309
tptacek wrote: post #199

Earlier quoted context omitted.

Welp. I think can call it on DNSSEC now.

OTOH there was recently a DNSSEC-saved-the-day piece of news: https://incrypted.com/en/dns-attack-on-eth-limo-was-stopped/

That only worked because the attacker didn't understand dnssec. If they had unsigned the domain first and then hijacked it they would have succeeded.

I haven't been able to find any cases of genuine dns hijack attacks in the last few years. Would love to know if anyone else can?

Only about 40% of the crypto companies seem to use dnssec. Seems like a target rich environment.

Re: DNSSEC disruption affecting .de domains – Resolved

#347

Post by gpvos »

bluejekyll wrote: post #261
akerl_ wrote: post #236

Earlier quoted context omitted.

Presumably if LetsEncrypt goes down and stays down for a week, the sites that go down are the ones that see that their CA went down and at no point in the week take the option to get certs from a different CA?

I guarantee that there are a ton of sites out there not monitoring their certs.

"A ton" being a misspelling of "the vast, vast majority".

Re: DNSSEC disruption affecting .de domains – Resolved

#348

Post by fragmede »

akerl_ wrote: post #236
cyberax wrote: post #190

Earlier quoted context omitted.

Not really? .com and .net are still up If Let's Encrypt goes down, half of the Internet will become inaccessible in a week.

Presumably if LetsEncrypt goes down and stays down for a week, the sites that go down are the ones that see that their CA went down and at no point in the week take the option to get certs from a different CA?

Are there alternative CAs that are anywhere as easy to deal with as Lets encrypt?

Re: DNSSEC disruption affecting .de domains – Resolved

#349

Post by 0123456789ABCDE »

tptacek wrote: post #276
pocksuppet wrote: post #269

Earlier quoted context omitted.

Let's Encrypt going down isn't equivalent to a rant about how encryption was a terrible idea from the very beginning and we should all just use unencrypted traffic.

Pretty sure that rant doesn't exist.

not to disagree on the merits of encryption — i'm not a clown, but scripting.com is still port 80 only, and Dave is the type to write a rant

Re: DNSSEC disruption affecting .de domains – Resolved

#350

Post by belorn »

walrus01 wrote: post #258
belorn wrote: post #208

Earlier quoted context omitted.

I am reminded of the warning that zonemaster gives about putting your domain name servers on a single AS, as is common practice for many larger providers. A lot of people do not want others to see this as a problem since a single AS is a convenient configuration for routing, but it has the downside of being a single point of failure. Building redundant infrastructure that can withstand BGP and DNS configuration mista…

As the CPU/RAM resources to run an authoritative-only slave nameserver for a few domains are extremely minimal (mine run at a unix load of 0.01), it's a very wise idea to put your ns3 or something at a totally different service provider on another continent . It costs less than a cup of coffee per month.

For a very long time, the computer club I was in operated a DNS server on a Pentium 75MHz and after the last major hardware upgrade it had a total of 110MB RAM memory and 2G disk space. It worked great except that before the upgrade it tended to run out of ram whenever there was a Linux kernel update, a problem we solved forever by populating all the ram slots with the maximum that the motherboard could handle to that nice 110 MB.
Post reply on HN