Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC disruption affecting .de domains – Resolved

status.denic.de

Post reply on HN
Print view View original

361–370 of 440 posts

Re: DNSSEC disruption affecting .de domains – Resolved

#361

Post by account42 »

walrus01 wrote: post #258
belorn wrote: post #208

Earlier quoted context omitted.

I am reminded of the warning that zonemaster gives about putting your domain name servers on a single AS, as is common practice for many larger providers. A lot of people do not want others to see this as a problem since a single AS is a convenient configuration for routing, but it has the downside of being a single point of failure. Building redundant infrastructure that can withstand BGP and DNS configuration mista…

As the CPU/RAM resources to run an authoritative-only slave nameserver for a few domains are extremely minimal (mine run at a unix load of 0.01), it's a very wise idea to put your ns3 or something at a totally different service provider on another continent . It costs less than a cup of coffee per month.

This makes sense for larger providers but just for a small/personal website there is literally zero advantages to having distributed authoritative DNS servers when the webserver is on a single host.

Ironically, denic still requires you to have two separate name servers with different IPs for your domain (which can be worked around by changing the IP of the registered name server afterwards lol), a requirement that all other registries I use have dropped or never had because enforcing such a policy at the registry level makes zero sense.

Re: DNSSEC disruption affecting .de domains – Resolved

#362

Post by account42 »

skywhopper wrote: post #184
pocksuppet wrote: post #168

Earlier quoted context omitted.

DNS is a centralization risk, yes. Somehow we've decided this is fine. DNSSEC isn't the only issue - your TLD's nameservers could also be offline, or censored in your country.

DNS is barely centralized. Is there an alternative global name lookup system that is less centralized without even worse downsides?

GP said it was a risk (and it is), not that there are better alternatives. Not all risks can be eliminated easily but you should still be aware of them.

Re: DNSSEC disruption affecting .de domains – Resolved

#363

Post by account42 »

tharkun__ wrote: post #241
muvlon wrote: post #223

Earlier quoted context omitted.

Let's Encrypt has to be down for days before people begin to feel the pain. DNS is very different, it breaks stuff immediately everywhere.

No it doesn't. DNS breaks as soon as TTLs run out. It's your choice to set them so low that stuff breaks immediately.

Unfortunately you can't set DNS TTL arbitrarily high (or low) without some resolvers ignoring your suggestion and using arbitrary values.

Re: DNSSEC disruption affecting .de domains – Resolved

#364

Post by account42 »

the8472 wrote: post #160
qazwsxedchac wrote: post #111

Earlier quoted context omitted.

So a single configuration mistake in a single place wiped out external reachability of a major economy. It happened in the evening local time and should be fixable, modulo cache TTLs, by morning. This will limit the blast radius somewhat. Still, at this level, brittle infrastructure is a political risk. The internet's famous "routing around damage" isn't quite working here. Should make for an interesting post mortem.

fail-closed protocols have introduced some brittleness. A HTTP 1.0 server from 1999 probably still can service visitors today. A HTTPS/TLS 1.0 server from the same year wouldn't.

Backwards compatibility is unfortunately not something security folk care about.

Re: DNSSEC disruption affecting .de domains – Resolved

#365

Post by account42 »

sam_lowry_ wrote: post #342
the8472 wrote: post #160

Earlier quoted context omitted.

fail-closed protocols have introduced some brittleness. A HTTP 1.0 server from 1999 probably still can service visitors today. A HTTPS/TLS 1.0 server from the same year wouldn't.

This is why I still run my blog on HTTP/1.1 only.

What no HTTP/1.0 for those of us too lazy to type the Host header into telnet???

Re: DNSSEC disruption affecting .de domains – Resolved

#366

Post by account42 »

walrus01 wrote: post #125
qazwsxedchac wrote: post #111

Earlier quoted context omitted.

So a single configuration mistake in a single place wiped out external reachability of a major economy. It happened in the evening local time and should be fixable, modulo cache TTLs, by morning. This will limit the blast radius somewhat. Still, at this level, brittle infrastructure is a political risk. The internet's famous "routing around damage" isn't quite working here. Should make for an interesting post mortem.

It looks like a failed key replacement during a scheduled maintenance event. Normally this sort of thing is thoroughly tested and has multiple eyes on for detailed review and planning before changes get committed, but obviously something got missed.

Would be interesting to know how something could get missed. You'd think the system was set up so that new keys could not be published without being verified working in a staging system.

Re: DNSSEC disruption affecting .de domains – Resolved

#367

Post by weird-eye-issue »

red_admiral wrote: post #341
weird-eye-issue wrote: post #285

Earlier quoted context omitted.

Do browsers even load non-HTTPS sites anymore without a massive warning?

neverssl.com works fine for me, only a small warning in the place where the padlock usually is, that no-one checks anyway. The browser would be very unhappy with an on a non-TLS site (localhost excepted). HSTS would trigger the "massive" warning and refuse to load the site, however.

It's more pronounced on desktop

Ah yes I think the HSTS issue is what I was thinking of

Re: DNSSEC disruption affecting .de domains – Resolved

#368

Post by account42 »

profmonocle wrote: post #333
zelon88 wrote: post #312

Earlier quoted context omitted.

This is actually startlingly true. Every FAANG company has their own fiber backbone. Why invest the internet that everyone uses when you can invest in your own private internet and then sell that instead?

It's not like the long-haul fiber not owned by FAANG is a public utility, at least not in most places. Traffic that goes over "the Internet" traverses some mix of your ISP's fiber, fiber belonging to some other ISP they have a deal with, then fiber belong to some ISP they have a deal with, etc. All those ISPs are being paid to provide service, they can invest in their own networks.

And we all know that ISPs are famous for investing in timely infrastructure upgrades.

Re: DNSSEC disruption affecting .de domains – Resolved

#369

Post by account42 »

qingcharles wrote: post #257
icedchai wrote: post #163

Earlier quoted context omitted.

I've been in IT 30+ years, been running DNS, web servers, etc. since at least 1994. I haven't bothered with DNSSEC due to perceived operational complexity. The penalty for a screw up, a total outage, just doesn't seem worth the security it provides.

How simple sysadmin was in 1994 with no cryptography on any protocol. Everything could be easily MITM'd. Your credit card number would get jacked left and right in the 90s.

And your mailman can also just open your letters. So what, it mostly doesn't happen in developed countries. Not everything needs an airtight technical solution, we have way less costly ways to deal with unwanted behavior.

Re: DNSSEC disruption affecting .de domains – Resolved

#370

Post by sam_lowry_ »

account42 wrote: post #365
sam_lowry_ wrote: post #342

Earlier quoted context omitted.

This is why I still run my blog on HTTP/1.1 only.

What no HTTP/1.0 for those of us too lazy to type the Host header into telnet???

Oh, because I host it with a few more sites on my tiny Hetzner cloud server.
Post reply on HN