DNSSEC KSK rollover breaks DNS resolution for .nz domains

throwaway892238 wrote: post #2

If a safety upgrade to driving a car made people crash their cars more, you'd call that a bug. For DNS it's a feature called DNSSEC.

if your browser ignored all certificate errors, I guess you'd call that a feature?

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#5

Post by [deleted] » Mon, May 29, 2023, 10:56 PM UTC

gg-plz wrote: post #4

throwaway892238 wrote: post #2

If a safety upgrade to driving a car made people crash their cars more, you'd call that a bug. For DNS it's a feature called DNSSEC.

if your browser ignored all certificate errors, I guess you'd call that a feature?

[deleted]

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#6

Post by josephcsible » Mon, May 29, 2023, 10:57 PM UTC

throwaway892238 wrote: post #2

If a safety upgrade to driving a car made people crash their cars more, you'd call that a bug. For DNS it's a feature called DNSSEC.

Your analogy would only be valid for a bug that made impersonating a site easier somehow, which this one didn't.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#7

Post by lucgagan » Mon, May 29, 2023, 10:57 PM UTC

I hope the situation gets resolved swiftly, and lessons learned from this incident can contribute to stronger and more reliable DNSSEC practices in the future.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#8

Post by tptacek » Mon, May 29, 2023, 11:00 PM UTC

gg-plz wrote: post #4

throwaway892238 wrote: post #2

If a safety upgrade to driving a car made people crash their cars more, you'd call that a bug. For DNS it's a feature called DNSSEC.

if your browser ignored all certificate errors, I guess you'd call that a feature?

If your browser ignored all certificate errors, you'd have a real security problem. That's not at all the case for DNSSEC: it's possible that all of the DNSSEC root keys could hit Pastebin and nobody would really need to be paged.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#9

Post by Spooky23 » Mon, May 29, 2023, 11:01 PM UTC

throwaway892238 wrote: post #2

If a safety upgrade to driving a car made people crash their cars more, you'd call that a bug. For DNS it's a feature called DNSSEC.

Fortunately, New Zealanders benefit from all of the problems solved by DNSSEC.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#10

Post by tptacek » Mon, May 29, 2023, 11:02 PM UTC

lucgagan wrote: post #7

I hope the situation gets resolved swiftly, and lessons learned from this incident can contribute to stronger and more reliable DNSSEC practices in the future.

The root KSK rollover had to be postponed twice, for several years, because of operational problems pulling this off in the US. It's difficult to do because the nature of the DNS makes it difficult. The utility of DNSSEC is so marginal that it's kind of sad that you're right, and that engineers are gradually getting better doing this hard, stupid thing.