Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC disruption affecting .de domains – Resolved

status.denic.de

Post reply on HN
Print view View original

281–290 of 440 posts

Re: DNSSEC disruption affecting .de domains – Resolved

#281

Post by tptacek »

pocksuppet wrote: post #279
tptacek wrote: post #216

Earlier quoted context omitted.

It's a pretty hard argument to work around: WebPKI certificates should go in the DNS, and also the largest DNS providers might at any moment decide not to validate DNSSEC anymore to get through an outage.

If there's going to be a single point of failure in front of your website, that single point of failure may as well be the only single point of failure instead of having two single points of failure, and it's probably important that people can't spoof responses.

This is a non sequitur.

Re: DNSSEC disruption affecting .de domains – Resolved

#282

Post by liveoneggs »

pocksuppet wrote: post #277
thayne wrote: post #263

Earlier quoted context omitted.

Probably the most common reason to use DNSSEC is to check a box on a list of compliance rules. And I don't think this will change anything for people who need DNSSEC for compliance.

Probably the most common reason to use TLS is to check a box on a list of compliance rules. Is that bad?

browsers pushed it, not compliance

Re: DNSSEC disruption affecting .de domains – Resolved

#283

Post by liveoneggs »

tom1337 wrote: post #189

Cloudflare has now disabled DNSSEC validation on their 1.1.1.1 resolver: https://www.cloudflarestatus.com/incidents/vjrk8c8w37lz

We only disabled SSL on all the websites in one country for a little bit.. I'm sure those credit card numbers were perfectly safe over the wire

Re: DNSSEC disruption affecting .de domains – Resolved

#284

Post by weird-eye-issue »

liveoneggs wrote: post #283
tom1337 wrote: post #189

Cloudflare has now disabled DNSSEC validation on their 1.1.1.1 resolver: https://www.cloudflarestatus.com/incidents/vjrk8c8w37lz

We only disabled SSL on all the websites in one country for a little bit.. I'm sure those credit card numbers were perfectly safe over the wire

They didn't disable SSL you dingus.

Re: DNSSEC disruption affecting .de domains – Resolved

#285

Post by weird-eye-issue »

pocksuppet wrote: post #277
thayne wrote: post #263

Earlier quoted context omitted.

Probably the most common reason to use DNSSEC is to check a box on a list of compliance rules. And I don't think this will change anything for people who need DNSSEC for compliance.

Probably the most common reason to use TLS is to check a box on a list of compliance rules. Is that bad?

Do browsers even load non-HTTPS sites anymore without a massive warning?

Re: DNSSEC disruption affecting .de domains – Resolved

#286

Post by fc417fc802 »

skywhopper wrote: post #184
pocksuppet wrote: post #168

Earlier quoted context omitted.

DNS is a centralization risk, yes. Somehow we've decided this is fine. DNSSEC isn't the only issue - your TLD's nameservers could also be offline, or censored in your country.

DNS is barely centralized. Is there an alternative global name lookup system that is less centralized without even worse downsides?

GNS is the obvious response here, in addition to the various blockchain based solutions. Nothing that enjoys widespread support or mindshare unfortunately.

Even the current centralized ICANN flavor could be substantially more resilient if it instead handed out key fingerprints and semi-permanent addresses when queried. That way it would only ever need to be used as a fallback when the previously queried information failed to resolve.

Re: DNSSEC disruption affecting .de domains – Resolved

#287

Post by fc417fc802 »

the8472 wrote: post #160
qazwsxedchac wrote: post #111

Earlier quoted context omitted.

So a single configuration mistake in a single place wiped out external reachability of a major economy. It happened in the evening local time and should be fixable, modulo cache TTLs, by morning. This will limit the blast radius somewhat. Still, at this level, brittle infrastructure is a political risk. The internet's famous "routing around damage" isn't quite working here. Should make for an interesting post mortem.

fail-closed protocols have introduced some brittleness. A HTTP 1.0 server from 1999 probably still can service visitors today. A HTTPS/TLS 1.0 server from the same year wouldn't.

You're not wrong but objecting to fail-closed in a security sensitive context is entirely missing the point.

Re: DNSSEC disruption affecting .de domains – Resolved

#288

Post by farfatched »

tptacek wrote: post #216
amluto wrote: post #207

Earlier quoted context omitted.

Hahaha. You wish :-p

It's a pretty hard argument to work around: WebPKI certificates should go in the DNS, and also the largest DNS providers might at any moment decide not to validate DNSSEC anymore to get through an outage.

Yes, it's a crappy outcome, but endpoints can still choose to enforce this. Further, it's not a persuasive argument against more DNSSEC usage, since if there was more DNSSEC usage then resolvers would be more reluctant to disable it.

Re: DNSSEC disruption affecting .de domains – Resolved

#289

Post by [deleted] »

walrus01 wrote: post #258
belorn wrote: post #208

Earlier quoted context omitted.

I am reminded of the warning that zonemaster gives about putting your domain name servers on a single AS, as is common practice for many larger providers. A lot of people do not want others to see this as a problem since a single AS is a convenient configuration for routing, but it has the downside of being a single point of failure. Building redundant infrastructure that can withstand BGP and DNS configuration mista…

As the CPU/RAM resources to run an authoritative-only slave nameserver for a few domains are extremely minimal (mine run at a unix load of 0.01), it's a very wise idea to put your ns3 or something at a totally different service provider on another continent . It costs less than a cup of coffee per month.

[deleted]

Re: DNSSEC disruption affecting .de domains – Resolved

#290

Post by deepsun »

belorn wrote: post #208
qazwsxedchac wrote: post #111

Earlier quoted context omitted.

So a single configuration mistake in a single place wiped out external reachability of a major economy. It happened in the evening local time and should be fixable, modulo cache TTLs, by morning. This will limit the blast radius somewhat. Still, at this level, brittle infrastructure is a political risk. The internet's famous "routing around damage" isn't quite working here. Should make for an interesting post mortem.

I am reminded of the warning that zonemaster gives about putting your domain name servers on a single AS, as is common practice for many larger providers. A lot of people do not want others to see this as a problem since a single AS is a convenient configuration for routing, but it has the downside of being a single point of failure. Building redundant infrastructure that can withstand BGP and DNS configuration mista…

On Google cloud it's always four nameservers like

    ns-cloud-c1.googledomains.com
    ns-cloud-c2.googledomains.com
    ns-cloud-c3.googledomains.com
    ns-cloud-c4.googledomains.com
Would not make any sense to do four of them if it's a single AZ. Also, they are geo-aware and routed to your nearest region.
Post reply on HN