TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

DNSSEC surpasses 50% of root domains

36 点作者 seky超过 11 年前

6 条评论

tptacek超过 11 年前
No, 50 of the <i>root domains</i> now support DNSSEC. Nothing resembling 50%, 5%, or .5% of the Internet uses DNSSEC. Nor will it ever.<p>DNSSEC is a bad idea. It provides very little value. It drastically complicates the Internet. It bakes the worst part of TLS --- the static tree PKI --- into the core design of the Internet... and then gives the root of the tree to the US government. It&#x27;s clunky, it uses antiquated crypto (its proponents have been trying to standardize it since 1995), and it leaks your private hostnames to the Internet.<p>I can go on and on and on. Instead, here&#x27;s some older posts I&#x27;ve written about it:<p><a href="https://news.ycombinator.com/item?id=5571937" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=5571937</a><p><a href="https://news.ycombinator.com/item?id=4071178" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=4071178</a><p><a href="https://news.ycombinator.com/item?id=2932378" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=2932378</a>
评论 #7115658 未加载
zdw超过 11 年前
DNSSEC basically has all the problems of SSL registrars with almost no user-facing of the benefits - it&#x27;s still a centralized system that could be overridden by a registrar hack or state level strong-arming, and very few end user systems support actually doing anything when DNSSEC signed records don&#x27;t verify.<p>If you think users are confused by SSL warnings now, how the heck would they understand similar errors at the DNS resolver level?<p>Also, there&#x27;s no-in flight encryption, so it offers no privacy benefit. It also aggravates DNS amplification attacks.<p>The better technology to look into if you&#x27;re concerned about individual user rights and privacy is DNSCurve: <a href="http://dnscurve.org" rel="nofollow">http:&#x2F;&#x2F;dnscurve.org</a><p>It&#x27;s not comparable to DNSSEC other than &quot;It uses crypto with DNS&quot; - they have entirely different goals, but the goals it solves are much more relevant to end users (privacy, forgery, etc.).<p>Personally, I&#x27;d recommend people run both techs, as there&#x27;s no technical reason that makes them incompatible.<p>I have no idea how to solve the UI problems. We&#x27;ve had 15+ years of SSL and there&#x27;s been almost no progress on that.
评论 #7115560 未加载
评论 #7115008 未加载
评论 #7114999 未加载
评论 #7115083 未加载
评论 #7115090 未加载
Jgrubb超过 11 年前
Can one of you knowledgable HNers tell me how I, as a dude who owns some domains and occasionally uses DNS to point them somewhere can get on board with this? Or is something that can only be implemented if you&#x27;re hosting your own DNS?
评论 #7115520 未加载
评论 #7115117 未加载
评论 #7114921 未加载
评论 #7114936 未加载
sanxiyn超过 11 年前
It used to be possible to get HTTPS on Chrome, without warning, without getting certificates from CA, by using DNSSEC. Nobody used it so it was removed.<p><a href="https://www.imperialviolet.org/2011/06/16/dnssecchrome.html" rel="nofollow">https:&#x2F;&#x2F;www.imperialviolet.org&#x2F;2011&#x2F;06&#x2F;16&#x2F;dnssecchrome.html</a>
评论 #7115005 未加载
评论 #7114943 未加载
oliao超过 11 年前
Does anybody know if it is the browser or the operating system that checks the validity of the dns records? Is it enabled on all clients?
评论 #7115485 未加载
评论 #7115183 未加载
AndrewDucker超过 11 年前
At some point can they mandate DNSSEC?
评论 #7114768 未加载