News for hackers. Stuff that matters.

A comment on Universal DNSSEC: Secure DNS for Every Domain. Parent comment

Re:Universal DNSSEC: Secure DNS for Every Domain by azernik on Tuesday November 10, 2015 @05:54PM (#10543242)
Linux is a test case. If you can get Linux to use DNSSEC without cooperation from intermediate routers and caches, then it's just single-organization engineering work - Apple and Microsoft would need to write DNSSEC-capable client implementations (which Microsoft already has for Windows Server) and deploy them. This is an OS feature like any other OS feature.

The obstacles to changing to IPv6, or to making any changes whatsoever to TCP, just aren't there.

[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by tptacek on Tuesday November 10, 2015 @06:05PM (#10543310)
And so it took 21 years to get to this point with DNSSEC because...
[ Parent | on HN ]
Re:Universal DNSSEC: Secure DNS for Every Domain by azernik on Tuesday November 10, 2015 @06:15PM (#10543374)
Because it takes non-zero work, and doesn't add much value on top of SSL/TLS, which got wide deployment first.

As far as I understand, IPSec + DNSSEC gets similar security guarantees to SSL/TLS without identity certification, so once you have one there isn't any real economic incentive to put massive effort into developing the other.

[ Parent | on HN ]