News for hackers. Stuff that matters.

A comment on 1.1.1.1 lookup failures on October 4th, 2023.

Re:1.1.1.1 lookup failures on October 4th, 2023 by jolux on Wednesday October 04, 2023 @08:44PM (#37773608)
The buried lede here seems to be that this is yet another serious outage (indirectly) caused by using DNSSEC, though I understand why they don’t emphasize this part, given their strong advocacy for DNSSEC adoption.
[ Parent | on HN ]
Re:1.1.1.1 lookup failures on October 4th, 2023 by dc396 on Wednesday October 04, 2023 @10:37PM (#37774297)
As I read it, DNSSEC signature expiry was what triggered people noticing the root data was stale. That would seem to be a somewhat positive outcome.
[ Parent | on HN ]
Re:1.1.1.1 lookup failures on October 4th, 2023 by ipaddr on Thursday October 05, 2023 @01:41AM (#37775240)
Would you rather an error or stale dns?
[ Parent | on HN ]
Re:1.1.1.1 lookup failures on October 4th, 2023 by mcesch on Thursday October 05, 2023 @04:17AM (#37776078)
Having had to troubleshoot a third-party service not so dissimilar to 1.1.1.1 and prove to them that their infrastructure was misbehaving in a similar manner, I'll take the error thank you.
[ Parent | on HN ]
Re:1.1.1.1 lookup failures on October 4th, 2023 by patmorgan23 on Thursday October 05, 2023 @08:30AM (#37777735)
Well it's a free public resolver service. There's plenty of other options and you can even run your own very easily.
[ Parent | on HN ]
Re:1.1.1.1 lookup failures on October 4th, 2023 by jolux on Thursday October 05, 2023 @11:24PM (#37786840)
> DNSSEC signature expiry was what triggered people noticing the root data was stale

If you noticed your brakes had failed because you ended up in a ditch I wouldn't really say that's a positive outcome.

Frankly I can't believe they don't have better monitoring for a system as critical as that.

[ Parent | on HN ]
Re:1.1.1.1 lookup failures on October 4th, 2023 by mcesch on Thursday October 05, 2023 @04:47AM (#37776278)
I don't know why Cloudflare, like Amazon, often get a free-pass on HN for their DNS implementation bugs. Regardless of DNSSEC's merits or otherwise, this bug isn't inherent to DNSSEC.
[ Parent | on HN ]