News for hackers. Stuff that matters.
Re:Statement on DNS Encryption [pdf] by jeroenhd on Thursday April 22, 2021 @08:31AM (#26901983)
A TLS outage shows all of your visitors a big, red warning message saying "Attackers might be trying to steal your information from example.com (for example, passwords, messages, or credit cards)". Such a warning is a great way of scaring away any business's visitors for good.

A DNSSEC outage shows a message saying "this site cannot be reached at the moment, try again later". I'd much rather have people see the latter than the former.

Signed DNS lookups are quite important for any use of DNS for domain metadata storage, for example in systems like DKIM or SPF. Neither is encrypted, neither is signed in any other way, yet together they control if you can send emails at all, or if your server will get (near) permanently banned from Outlook's spam filters. There are also various PTR records for auto-configuration of various protocols that can easily redirect traffic to other hosts were a victim to get a spoofed version.

We might have abandoned DANE, but there's still important information in DNS. Until we abandon DNS somehow (and I shudder to think what the alternative would be with the way the internet is ruled by Google and Facebook right now), I disagree that the risks are far smaller as you say.

Re:Statement on DNS Encryption [pdf] by tptacek on Thursday April 22, 2021 @11:45AM (#26904064)
A DNSSEC outage does not show a message that "the site cannot be reached at the moment, try again later". It shows the same message that you'd get if the site doesn't exist at all, because that's the result of a failed DNSSEC resolution: the site doesn't exist.