Re:DNS Drama Exposed (Dramatically)
by chris11 on Tuesday November 25, 2008 @09:44PM
(#377175)
I realize this wired, but did they really have to dramatize it so much?. I mean, come on, talking about the possibility of routing the entire .com domain through his laptop? It sounded like something that Robert Ludlum would write.
Re:DNS Drama Exposed (Dramatically)
by tlrobinson on Tuesday November 25, 2008 @10:39PM
(#377221)
They also portray Kaminsky as a pathetic nobody working out of his lonely apartment, when in reality he was already well respected before the DNS flaw discovery.
Re:DNS Drama Exposed (Dramatically)
by thenextweb on Wednesday November 26, 2008 @07:34AM
(#377563)
Lower on the drama? People get killed in that story, with the reporter present! I remember that story very well. Made an impression on me. more exciting than DNS flaws...
Re:DNS Drama Exposed (Dramatically)
by st3fan on Wednesday November 26, 2008 @02:13PM
(#377949)
I think this is a terrible article. Paul Vixie has done nothing to fix this situation. He certainly does not deserve the fame of the article.
Other DNS servers like DJB-DNS and PowerDNS have implemented proper port randomization as part of their design a LONG time ago. As a result of that those servers are completely unaffected by this DNS exploit.
Vixie and his Bind crew ignored the whole thing for a long time until it blew up in their face. Now it it just an excuse to roll out the monster that is called DNSSEC of course. Great marketing.
Re:DNS Drama Exposed (Dramatically)
by tptacek on Wednesday November 26, 2008 @09:24PM
(#378337)
DNSSEC is a debacle of epic proportions. It has taken over 13 years for that one standards effort to solidify to the point where it is today, which is a "secure DNS" protocol where there is still no real agreement on how to prevent arbitrary people on the Internet from dumping the contents of your zone files.
I predict, without any real evidence to back me up, that DNSSEC is DOA for a simple reason: the total Internetwide deployment of resolver libraries with a "gethostbyname()" interface; none of these libraries can handle transient or "soft" DNS security failures. SSL, a protocol that is far, far easier to deploy and manage than DNSSEC, sees transient errors so often that users are rebelling against the size of the error messages Firefox generates for them. DNSSEC transient failures kill your lookup.
I can give lots of other reasons why DNSSEC isn't going to work, but that's one you might not have thought of.
"In a WORLD where ONE MAN holds the KEY to the entire INTERNET!"
http://en.wikipedia.org/wiki/Don_LaFontaine
What were the odds I'd get to say that twice in one day?
Just don't say it a third time, lest you create an unkillable meme...
Or John Markoff?
Ridiculous. I doubt Vixie said that.
http://www.wired.com/science/discoveries/magazine/16-03/ff_s...
Other DNS servers like DJB-DNS and PowerDNS have implemented proper port randomization as part of their design a LONG time ago. As a result of that those servers are completely unaffected by this DNS exploit.
Vixie and his Bind crew ignored the whole thing for a long time until it blew up in their face. Now it it just an excuse to roll out the monster that is called DNSSEC of course. Great marketing.
I predict, without any real evidence to back me up, that DNSSEC is DOA for a simple reason: the total Internetwide deployment of resolver libraries with a "gethostbyname()" interface; none of these libraries can handle transient or "soft" DNS security failures. SSL, a protocol that is far, far easier to deploy and manage than DNSSEC, sees transient errors so often that users are rebelling against the size of the error messages Firefox generates for them. DNSSEC transient failures kill your lookup.
I can give lots of other reasons why DNSSEC isn't going to work, but that's one you might not have thought of.
(Thomas Ptacek in the article == tptacek on Hacker News)
Not exactly a "summary", but... http://www.unixwiz.net/techtips/iguide-kaminsky-dns-vuln.htm...