On Thu, 8 May 2014, Maciej Soltysiak wrote:
Hi,
I read a twitter conversation last night where somebody said DNSSEC is
harmful. I asked why and I got this littany of issues:
http://ianix.com/pub/dnssec-outages.html
I was blown away not only by the sheer evidence of outages, but especially
by the quotes in last sections: Miscellaneous and What a mess.
I don't know, have a look, I just wanted to share as I wasn't aware of
things that didn't go well with DNSSEC. I'm not suggesting anything re
Cerowrt here.
The failure mode of encrypted and authenticated communications is
catastrophic failure (=nothing works). There are plenty people who says
the "proceed anyway" option in modern browsers when the certificate
failures occur, is wrong and the user shouldn't be allowed to continue.
This is why security is so hard, because secsurity protects against a
potential and unknown attack, whereas when it doesn't work, you fail
completely and the user just wants things to work so they'd rather turn
security off and proceed anyway.
--
Mikael Abrahamsson email: [email protected]
_______________________________________________
Cerowrt-devel mailing list
[email protected]
https://lists.bufferbloat.net/listinfo/cerowrt-devel
