In 2023 operations for the .GOV TLD transitioned from Verisign to Cloudflare • Hacker News Board

Re: In 2023 operations for the .GOV TLD transitioned from Verisign to Cloudflare

#71

Post by acdha » Sun, Feb 11, 2024, 12:54 AM UTC

DANmode wrote: post #61

acdha wrote: post #31

Earlier quoted context omitted.

“Well known” in conspiracy circles. You’re referring to national security letters and, no, those cannot compel “whatever they need”: it’s limited to release of transactional data, not payload: https://en.wikipedia.org/wiki/National_security_letter Part of why the news about MUSCULAR was so shocking was that the Buah-era NSA was attacking the fiber connections between American tech companies’ data centers, because the…

If that was shocking, put your rubber gloves on for this read: https://en.m.wikipedia.org/wiki/2010s_global_surveillance_di...

Yeah, that page is one of the places you can read about the program I mentioned. I picked that one because it wasn’t news that the NSA spied on people outside of the United States, but a lot of Americans did not expect them to use the same tactics against American companies on US soil.

Re: In 2023 operations for the .GOV TLD transitioned from Verisign to Cloudflare

#72

Post by SOLAR_FIELDS » Sun, Feb 11, 2024, 2:15 AM UTC

gunapologist99 wrote: post #60

sophacles wrote: post #56

Earlier quoted context omitted.

Unlike AWS, GCP or Azure themselves? You think the people who own the computers you use can't see whats happening on them?

Isn't that the whole value proposition of Cloudflare? Nearly all traffic (in terms of volume) gets swallowed by CloudFlare and never approaches most instances: DDoS attacks swallowed whole, WAF rules block illegitimate traffic (which is, in most cases, the vast majority of traffic to dynamic endpoints or, frequently, non-existent endpoints, if you've ever tailed webserver logs), and Cloudflare-caching handles most of…

Yeah, that is one of the main value props of Cloudflare. They just slap you with scale. Entire classes of problems like DDOS just become non issues when you front with them. Most people when talking about Cloudflare have few complaints about the actual services they offer. It’s way more often about how they are so good and widespread that you don’t have many other choices and how dangerous that is in the long term.

Re: In 2023 operations for the .GOV TLD transitioned from Verisign to Cloudflare

#73

Post by pas » Tue, Feb 13, 2024, 2:23 AM UTC

blibble wrote: post #67

pas wrote: post #63

Earlier quoted context omitted.

??? at best that means there's more need for practice, testing, better processes, and so on. it does not mean everything should be easy. (especially changes to a critical name authority.) there's an argument that maybe .nz needs to spend more on this, delegate this, or accept a decreased security assurance, but that's definitely not true in general.

if you read the post-mortem they did everything by the book they made a small mistake, and .nz was down for 2 days as a result of course the 95% of people that have competent ISPs that don't verify DNSSEC records were completely unaffected there's a reason ALL major tech companies refuse to deploy it for their zones

> they made a small mistake

> and .nz was down for 2 days as a result

so it was not a small mistake

yes, the same thing happens when people start using technology that actually verifies what it reads/writes. ie. btrfs, ZFS, ECC, etc. and turns out disks fail, bits rots, etc. it was just unnoticed.