Re:Universal DNSSEC: Secure DNS for Every Domain
by tptacek on Tuesday November 10, 2015 @05:29PM
(#10543097)
I'm happy to concede that the desktop Linux people don't have this issue. We should look into DNSSEC once Linux wins the desktop.
[ Parent
| on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain
by azernik on Tuesday November 10, 2015 @05:54PM
(#10543242)
Linux is a test case. If you can get Linux to use DNSSEC without cooperation from intermediate routers and caches, then it's just single-organization engineering work - Apple and Microsoft would need to write DNSSEC-capable client implementations (which Microsoft already has for Windows Server) and deploy them. This is an OS feature like any other OS feature.
The obstacles to changing to IPv6, or to making any changes whatsoever to TCP, just aren't there.
Re:Universal DNSSEC: Secure DNS for Every Domain
by tptacek on Tuesday November 10, 2015 @06:05PM
(#10543310)
And so it took 21 years to get to this point with DNSSEC because...
Re:Universal DNSSEC: Secure DNS for Every Domain
by azernik on Tuesday November 10, 2015 @06:15PM
(#10543374)
Because it takes non-zero work, and doesn't add much value on top of SSL/TLS, which got wide deployment first.
As far as I understand, IPSec + DNSSEC gets similar security guarantees to SSL/TLS without identity certification, so once you have one there isn't any real economic incentive to put massive effort into developing the other.