In 2023 operations for the .GOV TLD transitioned from Verisign to Cloudflare

Post by DANmode » Sat, Feb 10, 2024, 9:19 PM UTC

acdha wrote: post #31

phantompeace wrote: post #21

Earlier quoted context omitted.

They were probably exaggerating but it’s well known that American agencies can and will extort whatever they need from any American company and the organisation wouldn’t even be legally allowed to disclose that it even happened through secrecy and gag orders.

“Well known” in conspiracy circles. You’re referring to national security letters and, no, those cannot compel “whatever they need”: it’s limited to release of transactional data, not payload: https://en.wikipedia.org/wiki/National_security_letter Part of why the news about MUSCULAR was so shocking was that the Buah-era NSA was attacking the fiber connections between American tech companies’ data centers, because the…

Post by pas » Sat, Feb 10, 2024, 10:53 PM UTC

blibble wrote: post #62

jpgvm wrote: post #52

Earlier quoted context omitted.

Yeah I hate that people can't acknowledge that friction is sometimes intentional. Not everything -should- be easy. For example I designed a system at a previous company that used Shamir's Secret Sharing to protect a very very important root key. We used an intermediate of this key for most operations but it came time to rotate it and folks were surprised by the ceremony involved in doing so. i.e the root key was decr…

> Not everything -should- be easy. the entirety of .nz probably wouldn't agree with you when they had a 2 day outage due to a slight DNSSEC misconfiguration

Post by cheekibreeki2 » Sat, Feb 10, 2024, 11:18 PM UTC

stefan_ wrote: post #26

overstay8930 wrote: post #10

It is shocking how few people understand how DNS works

It is shocking how few people understand how business works. If you think Cloudflare wants to be in the registrar business, not push their Anti DDoS stuff on a captive audience, I have a bridge to sell you.

Post by blibble » Sat, Feb 10, 2024, 11:19 PM UTC

pas wrote: post #63

blibble wrote: post #62

Earlier quoted context omitted.

> Not everything -should- be easy. the entirety of .nz probably wouldn't agree with you when they had a 2 day outage due to a slight DNSSEC misconfiguration

??? at best that means there's more need for practice, testing, better processes, and so on. it does not mean everything should be easy. (especially changes to a critical name authority.) there's an argument that maybe .nz needs to spend more on this, delegate this, or accept a decreased security assurance, but that's definitely not true in general.

Post by tptacek » Sun, Feb 11, 2024, 12:07 AM UTC

lambdaone wrote: post #42

blibble wrote: post #40

Earlier quoted context omitted.

yet another example of DNSSEC "adding value"

By making it hard just to hijack a crucial TLD and transfer it over to an potential adversary without the cooperation of multiple trusted parties? It seems to me this is DNSSEC working as designed, and being remarkably flexible in doing so. Sometimes things _should_ be difficult to do.