Universal DNSSEC: Secure DNS for Every Domain

Re:Universal DNSSEC: Secure DNS for Every Domain by jessaustin on Tuesday November 10, 2015 @04:30PM (#10542663)

I remain impressed that people who were up in arms about the Snowden revelations, or, just yesterday, about NSA stockpiling zero-days, could casually rationalize the largest transfer of control over the Internet to governments in the whole history of the net.

Is this me? I was, and am still, quite concerned about many of Snowden's revelations. I'm not as concerned about "passive" NSA vuln research as e.g. EFF are, although active sabotage of standards and deployed infrastructure has got to stop. I don't intend in this thread to rationalize anything, only to find out more about DNSSEC. For instance, why couldn't DNSSEC be used in addition to other methods such as TLS and DNSCrypt? I appreciate your insight in this area, but it's not clear that DDOS amplification (which, if it could be avoided by anyone, could be avoided by CF with their long experience in packet dropping) is enough of an issue to prevent even trying something like this.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by eastdakota on Tuesday November 10, 2015 @07:51PM (#10543944)

Exactly. And not to mention that we used elliptic curves (so the keys are shorter) and neutered ANY queries (so you can't aggregate records to generate a large DNS response). The net effect it using the CloudFlare DNSSEC implementation for DDoS gets you little to no amplification factor. And that's before the clever things we do around forcing TCP when we expect abuse, etc. Critcize us for many things, but for not thinking through how to mitigate the DDoS risk shouldn't be one of them.

[ Parent | on HN ]

Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @07:58PM (#10543986)

Nobody is criticizing Cloudflare's DDOS protection mechanisms.

[ Parent | on HN ]