Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC disruption affecting .de domains – Resolved

status.denic.de

Post reply on HN
Print view View original

391–400 of 440 posts

Re: DNSSEC disruption affecting .de domains – Resolved

#391

Post by icedchai »

belorn wrote: post #208
qazwsxedchac wrote: post #111

Earlier quoted context omitted.

So a single configuration mistake in a single place wiped out external reachability of a major economy. It happened in the evening local time and should be fixable, modulo cache TTLs, by morning. This will limit the blast radius somewhat. Still, at this level, brittle infrastructure is a political risk. The internet's famous "routing around damage" isn't quite working here. Should make for an interesting post mortem.

I am reminded of the warning that zonemaster gives about putting your domain name servers on a single AS, as is common practice for many larger providers. A lot of people do not want others to see this as a problem since a single AS is a convenient configuration for routing, but it has the downside of being a single point of failure. Building redundant infrastructure that can withstand BGP and DNS configuration mista…

It's simple enough to get a secondary DNS server somewhere and put it on $5/month VPS. I use BIND and DNS replication (AXFR/IXFR) handles it.

Re: DNSSEC disruption affecting .de domains – Resolved

#392

Post by icedchai »

account42 wrote: post #361
walrus01 wrote: post #258

Earlier quoted context omitted.

As the CPU/RAM resources to run an authoritative-only slave nameserver for a few domains are extremely minimal (mine run at a unix load of 0.01), it's a very wise idea to put your ns3 or something at a totally different service provider on another continent . It costs less than a cup of coffee per month.

This makes sense for larger providers but just for a small/personal website there is literally zero advantages to having distributed authoritative DNS servers when the webserver is on a single host. Ironically, denic still requires you to have two separate name servers with different IPs for your domain (which can be worked around by changing the IP of the registered name server afterwards lol), a requirement that al…

It depends. Do you also have email or other services for that domain? The advantage is your email doesn't start bouncing when your single host web site / DNS server is down.

Re: DNSSEC disruption affecting .de domains – Resolved

#393

Post by hulitu »

Tepix wrote: post #359
alper wrote: post #356

Earlier quoted context omitted.

Given how amateurish German IT operations is, there is no guarantee whatsoever there will be a post-mortem nor whether it then will make it out under 3-6 months with all the necessary approvals.

Bla bla, always easy to rant... https://blog.denic.de/denic-informiert-uber-die-behebung-der... "Die Störung ist inzwischen behoben und alle Systeme laufen wieder stabil. Die genaue Ursache wird derzeit noch analysiert. Sobald belastbare Erkenntnisse vorliegen, wird DENIC diese transparent zur Verfügung stellen." translation: ‘The disruption has now been resolved and all systems are running smoothly again. The exact…

> alle Systeme laufen wieder stabil

in their dreams.

Re: DNSSEC disruption affecting .de domains – Resolved

#394

Post by gspr »

londons_explore wrote: post #167
ricardo81 wrote: post #60

Earlier quoted context omitted.

I get "content not viewable in your region", from the UK. Not an ideal image sharing website nowadays.

Other countries are available. With a UK passport you can move to Ireland, Thailand, or Australia fairly easily, amongst others.

Are you seriously suggesting that that's a feasible, go-to solution for a problem in your country? For most normal, well-adjusted people?

Re: DNSSEC disruption affecting .de domains – Resolved

#395

Post by 1vuio0pswjnm7 »

krystofbe wrote: post #7

Looks like a DNSSEC issue, not a nameserver outage. Validating resolvers SERVFAIL on every .de name with EDE: RRSIG with malformed signature found for a0d5d1p51kijsevll74k523htmq406bk.de/nsec3 (keytag=33834) dig +cd amazon.de @8.8.8.8 works, dig amazon.de @a.nic.de works. Zone data is intact, DENIC just published an RRSIG over an NSEC3 record that doesn't validate against ZSK 33834. Every validating resolver therefor…

Curious how this comment was originally marked as "dead" but is now on top

I saw it at bottom of thread and vouched for it. Usually when I "vouch" nothing happens

I always ignore the RRSIG lines in zone files. To me it's not "DNS data", it's cruft

But DNSSEC has its true believers. I'm just not one of them

Re: DNSSEC disruption affecting .de domains – Resolved

#396

Post by 1vuio0pswjnm7 »

1vuio0pswjnm7 wrote: post #23

.de TLD is online. DNS working fine DNSSEC not working If using an open resolver, i.e., a shared DNS cache, e.g., third party DNS service such as Google, Cloudflare, etc., then it might fail, or it might not. It depends on the third party DNS provider https://datatracker.ietf.org/meeting/118/materials/slides-11...

To me, a response from a "root DNS server", i.e., [a-m].root-servers.net, is not "wrong" if it contains the correct data that I'm requesting, e.g., domainnames and associated IP numbers

I'm never requesting RRSIGs as I do not use that data. For me, it's just cruft that now comes in the response

Re: DNSSEC disruption affecting .de domains – Resolved

#397

Post by account42 »

icedchai wrote: post #392
account42 wrote: post #361

Earlier quoted context omitted.

This makes sense for larger providers but just for a small/personal website there is literally zero advantages to having distributed authoritative DNS servers when the webserver is on a single host. Ironically, denic still requires you to have two separate name servers with different IPs for your domain (which can be worked around by changing the IP of the registered name server afterwards lol), a requirement that al…

It depends. Do you also have email or other services for that domain? The advantage is your email doesn't start bouncing when your single host web site / DNS server is down.

Email bouncing during rare downtimes is hardly that big of an issue - if its actually important the sender will retry, possibly with a different contact method. And for short downtimes most likely the sender's MTA will just automatically retry a bit later - email is designed to work with temporary failures.

There isn't some magic reliability that everyone needs which just so happens to fall into "not achievable with a single authoritative name server" and "guaranteed with two servers". I'm not saying you should never have more than one, just that isn't the registry's business to decide what kind of availability guarantees you need for your domain.

Re: DNSSEC disruption affecting .de domains – Resolved

#399

Post by thayne »

pocksuppet wrote: post #270
thayne wrote: post #266

Earlier quoted context omitted.

The problem with ASN.1 is that it is big and complicated, and you only need a fraction of it for cryptography, and it isn't really used for anything outside of pki anymore. It wouldn't be as bad if asn.1 had cought on more as a general purpose serialization format and there were ubiquitous decent libraries for dealing with it. But that didn't happen. Probably partly because there are so many different representations…

ASN.1 is protobufs designed by committee. It is a general-purpose serialization format, but there's no good reason to choose it instead of protobufs.

> It is a general-purpose serialization format

Yes. My point is that in practice it hasn't really been used for much outside of cryptography.

> there's no good reason to choose it instead of protobufs

Well, the reason it is used in a lot of the places it is, is because protobufs didn't exist when those protocols or file formats were created.

There are also some things that ASN.1 does better at a technical level. Of important significance to cryptography is that the DER representation is "canonical", meaning that there is only one way to serialize a set of data to bytes. That's important because it means that you can just hash the contents of the serialization for signatures, rather than having to have some kind of separate canonicalization step (which is a common source of mistakes).

Re: DNSSEC disruption affecting .de domains – Resolved

#400

Post by ondohotola »

icedchai wrote: post #391
belorn wrote: post #208

Earlier quoted context omitted.

I am reminded of the warning that zonemaster gives about putting your domain name servers on a single AS, as is common practice for many larger providers. A lot of people do not want others to see this as a problem since a single AS is a convenient configuration for routing, but it has the downside of being a single point of failure. Building redundant infrastructure that can withstand BGP and DNS configuration mista…

It's simple enough to get a secondary DNS server somewhere and put it on $5/month VPS. I use BIND and DNS replication (AXFR/IXFR) handles it.

Have you ANY clue about the size of .DE's name server infrastructure?
Post reply on HN