Re:DNSSEC failures are how you get people to disable DNSSEC
by toast0 on Thursday June 01, 2023 @02:03AM
(#36148009)
fake-hwclock[1] is useful for this. I don't know much about Pi-Hole, but if it involves writable storage and has a package manager, fake-hwclock may be available from there.
> At least we need to get better at building fault tolerant systems.
Security and fault tolerance are at odds here. Failing closed when you can't validate is correct, but not so useful. Properly modeling the clock might give you a way to get bootstrapped, but then an adversary would arrange for a bootstrap situation so they could interfere with your clock and then make use of the incorrect time for their nefarious purposes.
> At least we need to get better at building fault tolerant systems.
Security and fault tolerance are at odds here. Failing closed when you can't validate is correct, but not so useful. Properly modeling the clock might give you a way to get bootstrapped, but then an adversary would arrange for a bootstrap situation so they could interfere with your clock and then make use of the incorrect time for their nefarious purposes.
[1] https://git.einval.com/cgi-bin/gitweb.cgi?p=fake-hwclock.git