News for hackers. Stuff that matters.
Re:Spoofing DNS with fragments by tptacek on Tuesday September 11, 2018 @09:04AM (#17959330)
Nerds have been saying this about the HTTP-ization of protocols literally for decades, but HTTP's gradual assimilation of all other protocols has continued basically unimpeded.

Also: your primary objection to DoTLS is that networks block 53/tcp, and you say "same analysis applies to DNS over HTTP", except that, obviously, it does not: the whole reason DoH exists is to address that problem.

Finally, even though I believe over the long term that DoH will be successful and will eventually become the primary mechanism with which browsers look up hostnames, it doesn't have to be for DoH to solve, entirely, the real problems DNSSEC tried to solve.

Re:Spoofing DNS with fragments by JdeBP on Tuesday September 11, 2018 @10:08AM (#17959792)
M. Ahern was, I suspect, referring to the analysis of the first paragraph with "same".

In other words:

> if you think adding DNSSEC verification to a DNS library is hard, try adding a HTTP or a HTTP+TLS stack

Re:Spoofing DNS with fragments by tptacek on Tuesday September 11, 2018 @10:41AM (#17960112)
That doesn't make much sense as an argument. Adding DNSSEC verification to a library is probably harder.