Re:DNSSEC KSK Rollover Postponed
by marcosdumay on Friday September 29, 2017 @12:49PM
(#15366880)
> DNS lookups will instantly become susceptible to forgetting that your domain exists entirely if any misconfiguration occurs
Just like TLS with HSTS headers or similar stuff.
That's what security is made to look like today. It is wrong. Things shouldn't simply disappear or get broken, but it's by no way a DNSSEC only problem.
Re:DNSSEC KSK Rollover Postponed
by tptacek on Friday September 29, 2017 @01:52PM
(#15367483)
No, that's not what happens with HSTS. TLS misconfigurations come with dialogs explaining that the site exists but is unreachable due to misconfiguration. DNSSEC misconfigurations make sites vanish from the Internet as if they never existed at all.
Just like TLS with HSTS headers or similar stuff.
That's what security is made to look like today. It is wrong. Things shouldn't simply disappear or get broken, but it's by no way a DNSSEC only problem.