News for hackers. Stuff that matters.

A comment on It is always the DNS. Parent comment

Re:It is always the DNS by wahern on Thursday December 02, 2021 @09:08PM (#29425803)
We don't need DNSSEC because we have TLS certificates. And as we all know, no large tech company has ever had trouble with misconfigured or expired TLS certificates.
[ Parent | on HN ]
Re:It is always the DNS by tptacek on Thursday December 02, 2021 @09:28PM (#29425949)
Why not both sets of problems?
[ Parent | on HN ]
Re:It is always the DNS by belorn on Friday December 03, 2021 @04:14AM (#29428118)
The core issue behind both sets is single point of failure. A misconfigured security system can causes down time. The problem is that security systems tend to be single point of failure by design that fail "safe" by not allowing access.

This would be an excellent security research topic. How to design non-single point of failure security that both fail safe and do not cause down time when misconfigured.

[ Parent | on HN ]