[Cerowrt-devel] DNSSEC

[Cerowrt-devel] DNSSEC

[Ranganathan Krishnan]

I am looking into ways to improve DNS on the openwireless router software. 
When I mentioned DNSSEC as one of the items to review, I received this 
response from one of the developers. 

http://sockpuppet.org/blog/2015/01/15/against-dnssec/

CeroWRT put in work to include DNSSEC so there must be folks on the CeroWRT
list  who don't see it that way. I would appreciate any pointers to discussions refuting 
the points made in the blog post above. If the points made in the blog post stand 
there would not be any reason to include DNSSEC in the openwireless router. So, 
I am looking for counterpoints that might establish that DNSSEC could have value. 

Thanks,
Ranga

Re: [Cerowrt-devel] [Ow-tech] DNSSEC

[Dave Taht]

On Wed, Feb 11, 2015 at 2:11 PM, Seth <list@sysfu.com> wrote:
> On Tue, 10 Feb 2015 16:57:07 -0800, Ranganathan Krishnan <rk@selwastor.com>
> wrote:
>
>> I am looking into ways to improve DNS on the openwireless router software.
>> When I mentioned DNSSEC as one of the items to review, I received this
>> response from one of the developers.
>>
>> http://sockpuppet.org/blog/2015/01/15/against-dnssec/

I lack time in my life for a point by point rebuttal.

>> CeroWRT put in work to include DNSSEC so there must be folks on the
>> CeroWRT
>> list  who don't see it that way.

If you wish to engage the advocates it would help to ask the question
of the relevant mailing lists. There are many, but I don't know them
all, but cc'ing dan york who is big on dane.

To clarify, in cerowrt, dnssec support was one of a dozen technologies
we wanted to prove viable on home routers and e2e, that comcast viewed
it as important enough to fund simon kelly to implement, and it's been
up and working for about 3 years now. We didn't do any real
development of it in cerowrt, we merely tested the results of that
effort and helped file off the rough edges, to make it more generally
deployable. Which it is.

Benefits I see to dnssec end-2-end:

1) The big one, that I personally love, is having a working NXDOMAIN,
where my upstream ISP cannot fill a dns miss with advertising domains.
There are a lot of valuable fallouts from this.

2) It doesn't cost much in terms of cpu or latency

3) A huge percentage of the sites I regularly visit ARE signed.

At least one criticism, now thoroughly eliminated by existence proof,
is that you can't run dnssec on the edge, and the problems that it
causes are mostly invisible - as are the benefits - as it should be.
The author of that post is more than welcome to try it for himself,
day in, day out, as we have.

>> I would appreciate any pointers to
>> discussions refuting
>> the points made in the blog post above. If the points made in the blog
>> post stand
>> there would not be any reason to include DNSSEC in the openwireless
>> router. So,
>> I am looking for counterpoints that might establish that DNSSEC could have
>> value.
>
>
> This talk doesn't refute the problems with DNSSEC, but rather reinforces
> them.
>
> Dan Bernstein: Authenticating The Whole Internet on Vimeo
> http://vimeo.com/18417770
>
> Worth a watch
>
> Dan Kaminsky's response - http://dankaminsky.com/2011/01/05/djb-ccc/
>
> Personally I'm a fan of DNSChain over DNSSEC - https://okturtles.com/

The debate has gone on 15 years. Alternative proposals need to be viable
enough to merit rollout... which, lacking consensus, would take another 15
years.

Certainly I would like to see DNS replaced with something better, and I
am willing to work towards that goal... but given a choice whether to
deploy dnssec more fully or not, I'd choose deployment.
> _______________________________________________
> Ow-tech mailing list
> Ow-tech@lists.eff.org
> https://lists.eff.org/mailman/listinfo/ow-tech



-- 
Dave Täht

thttp://www.bufferbloat.net/projects/bloat/wiki/Upcoming_Talks

Re: [Cerowrt-devel] DNSSEC

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 1325 bytes --]

On Tue, 10 Feb 2015 16:57:07 -0800, Ranganathan Krishnan said:
> I am looking into ways to improve DNS on the openwireless router software.
> When I mentioned DNSSEC as one of the items to review, I received this
> response from one of the developers.
>
> http://sockpuppet.org/blog/2015/01/15/against-dnssec/

Right off the bat:

"But it doesn't make those attacks infeasible, so sites still need to adopt
secure transports like TLS. With TLS properly configured, DNSSEC adds nothing."

Which makes the rash assumption that it's appropriate to use TLS for everything.

For starters, consider NTP or any other UDP-based system, or any TCP-based
protocol that uses something other than TLS.

"Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled
BIT.LY's TLS keys."

Actually, whoever controlled the master for .LY would have controlled BIT.LY,
whether or not DNSSEC was in play. If Gaddafi had control of .LY, he could have
redirected BIT.LY anywhere he wanted without keys, so the situation is no
worse. What DNSSEC does is prevent a Gaddafi that *doesn't* control .LY from
swiping control of your view of .LY (including BIT.LY) out from under you.

Or your view of .COM, which would probably matter just a tad more to you...

I'll let somebody else debunk the rest, I quit reading at that point. :)


[-- Attachment #2: Type: application/pgp-signature, Size: 848 bytes --]