News for hackers. Stuff that matters.

A comment on Parallel Reconstruction of Lawful TLS Wiretapping. Parent comment

Re:Parallel Reconstruction of Lawful TLS Wiretapping by Hizonner on Saturday May 30, 2026 @09:12PM (#48342170)
> It is too fragile (multiple point of failure).

If your DNS isn't working, you're not going to be making connections anyway. And if you can't keep DNSSEC running, you can't keep certs up to date either. DNSSEC is actually much simpler, with fewer failure points, once you set it up.

> It is high volume (=it need be cacheable).

It is. Unlike certificates. And the cache lifetimes are much shorter than typical certificate lifetimes.

[ Parent | on HN ]
Re:Parallel Reconstruction of Lawful TLS Wiretapping by tptacek on Saturday May 30, 2026 @10:37PM (#48342556)
It is self-evidently not correct that companies that can't keep DNSSEC running can't keep certs running. Entire TLDs have fallen off the Internet because DNSSEC has broken. A certificate never took Slack down for half a day. It's just obviously not true.
[ Parent | on HN ]
Re:Parallel Reconstruction of Lawful TLS Wiretapping by Hizonner on Sunday May 31, 2026 @08:29AM (#48345178)
It's amazing what practice and investment can do, even for a fragile system like X.509. Yet certs still break constantly. Like permanently killing people's "perpetual" Microsoft Word licenses in a story posted within hours of this one.
[ Parent | on HN ]