News for hackers. Stuff that matters.

A comment on Why not DANE in browsers. Parent comment

Re:Why not DANE in browsers by tptacek on Sunday January 18, 2015 @06:22PM (#8909419)
It's a cost-benefit issue. Do you believe DNSSEC is so valuable that it's worth (a) breaking connectivity for a significant number of people and (b) incurring the expense of replacing/upgrading the middleboxes that are breaking connectivity? If so, why?
[ Parent | on HN ]
Re:Why not DANE in browsers by tlb on Sunday January 18, 2015 @11:54PM (#8910408)
I don't have a strong opinion on DNSSEC itself. It seems like it might be a good idea for email, at least.

I don't have much sympathy for network admins who block TXT records because it doesn't currently seem to break anything. TXT records are part of the spec, and if some of them have configured something to block them, that's not a good reason for everyone to not have secure systems.

[ Parent | on HN ]