News for hackers. Stuff that matters.

A comment on Fedora 21 To Have DNSSEC Validation Enabled By Default. Parent comment

Re:Fedora 21 To Have DNSSEC Validation Enabled By Default by borando on Friday May 02, 2014 @12:29PM (#7686618)
The data in root "." is controlled by ICANN, a US corporation. The data in the most important gTLD, .com, is run by Verisign on contract with the US Chamber of Commerce. The ccTLDs (.fr, .tw, etc.) are controlled by world governments.

Sure, the root and major TLDs are anycasted across the globe, but the "wide range" of organizations are just mirroring content that is in one way or another controlled by world governments, and given (for example) ICE domain seizures, it would be prudent not to over-rely on DNS. Personally I support DNSCurve as a means to secure DNS, not to replace security we already have elsewhere.

[ Parent | on HN ]
Re:Fedora 21 To Have DNSSEC Validation Enabled By Default by danyork on Friday May 02, 2014 @05:11PM (#7688183)
I guess we'll have to agree to disagree. I've worked with the ICANN DNS people enough and am aware of their practices enough (ex. https://www.iana.org/dnssec/icann-dps.txt ) that I don't see how the root zone could be compromised without people knowing.

Separately, DNScurve is interesting, but really solves a different problem than DNSSEC. I find this a useful comparison: http://security.stackexchange.com/questions/45770/if-dnssec-...

[ Parent | on HN ]