Re: OFFTOPIC: DNSSEC groupthink versus improving DNS

[Alex Bligh <[e-mail]>]

--On 8 August 2008 17:24:56 +1000 Duane at e164 dot org <[e-mail]> 
wrote:

>> Is there a technology that can prove that the answer I am getting from
>> my DNS resolver is correct?
>
> Don't use someone else's resolver for starters, then reduce the TTL to
> almost nothing and the chance of being effected is greatly reduced, of
> course DNSSEC won't solve this problem without critical mass either so
> even if you deploy or utilise DNSSEC you could still be effected by
> cache poisoning.

That just goes to prove Ralf's point.
a) DNSSEC may be an ugly pig, but it's the only technology available today
   that PROVES the answer is correct (rather than 'greatly reduces' the
   chance of it being wrong)
b) Like most security measures, both sides need to be using it. It does
   little in practice at the moment because it isn't deployed (no critical
   mass, as you put it). This is not an argument not to deploy it
   ("my gun does not work because it is not loaded, therefore do not load
   it because it does not work"); if anything, it's the opposite.

Alex

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>