From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from omr1.cc.vt.edu (omr1.cc.ipv6.vt.edu [IPv6:2001:468:c80:2105:0:2fc:76e3:30de]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by huchra.bufferbloat.net (Postfix) with ESMTPS id 7026121F1FC for ; Tue, 10 Feb 2015 17:57:04 -0800 (PST) Received: from mr3.cc.vt.edu (mr3.cc.vt.edu [198.82.141.68] (may be forged)) by omr1.cc.vt.edu (8.14.4/8.14.4) with ESMTP id t1B1v0qN009913; Tue, 10 Feb 2015 20:57:00 -0500 Received: from auth1.smtp.vt.edu (auth1.smtp.vt.edu [198.82.161.152] (may be forged)) by mr3.cc.vt.edu (8.14.4/8.14.4) with ESMTP id t1B1ut6d000671; Tue, 10 Feb 2015 20:57:00 -0500 Received: from turing-police.cc.vt.edu ([IPv6:2001:468:c80:2103:4103:ec27:7848:c4c3]) (authenticated bits=0) by auth1.smtp.vt.edu (8.14.4/8.14.4) with ESMTP id t1B1usUB021273 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Tue, 10 Feb 2015 20:56:55 -0500 X-Mailer: exmh version 2.8.0 04/21/2012 with nmh-1.6+dev To: Ranganathan Krishnan In-Reply-To: Your message of "Tue, 10 Feb 2015 16:57:07 -0800." From: Valdis.Kletnieks@vt.edu References: Mime-Version: 1.0 Content-Type: multipart/signed; boundary="==_Exmh_1423619814_1958P"; micalg=pgp-sha1; protocol="application/pgp-signature" Content-Transfer-Encoding: 7bit Date: Tue, 10 Feb 2015 20:56:54 -0500 Message-ID: <133804.1423619814@turing-police.cc.vt.edu> X-Spam-Status: No, score=-0.0 required=5.0 tests=T_RP_MATCHES_RCVD, URIBL_DBL_ABUSE_REDIR autolearn=disabled version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mr3.cc.vt.edu Cc: "" , "cerowrt-devel@lists.bufferbloat.net" Subject: Re: [Cerowrt-devel] DNSSEC X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Feb 2015 01:57:33 -0000 --==_Exmh_1423619814_1958P Content-Type: text/plain; charset=us-ascii On Tue, 10 Feb 2015 16:57:07 -0800, Ranganathan Krishnan said: > I am looking into ways to improve DNS on the openwireless router software. > When I mentioned DNSSEC as one of the items to review, I received this > response from one of the developers. > > http://sockpuppet.org/blog/2015/01/15/against-dnssec/ Right off the bat: "But it doesn't make those attacks infeasible, so sites still need to adopt secure transports like TLS. With TLS properly configured, DNSSEC adds nothing." Which makes the rash assumption that it's appropriate to use TLS for everything. For starters, consider NTP or any other UDP-based system, or any TCP-based protocol that uses something other than TLS. "Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled BIT.LY's TLS keys." Actually, whoever controlled the master for .LY would have controlled BIT.LY, whether or not DNSSEC was in play. If Gaddafi had control of .LY, he could have redirected BIT.LY anywhere he wanted without keys, so the situation is no worse. What DNSSEC does is prevent a Gaddafi that *doesn't* control .LY from swiping control of your view of .LY (including BIT.LY) out from under you. Or your view of .COM, which would probably matter just a tad more to you... I'll let somebody else debunk the rest, I quit reading at that point. :) --==_Exmh_1423619814_1958P Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Exmh version 2.5 07/13/2001 iQIVAwUBVNq25gdmEQWDXROgAQJ4Xw//VmxlOknGdMz6bo+QaZJTn4f/BdWq/4mN KJAet/T5oeLayD6Cqg3CKCyqXGgWlcNK9V/Age66n3uFrYZ87hgnaGDJnXoxtuGM ozDsT58n8iPlIpF0AZEco6yuc0j6mnBjJNFMlwtUNCyZyaHRx0ZvNJK/zW0xJUzM SxhANzsjDfyNe7/zOn7pzy5sqKL4IXh3F3555wy5Pvrd6oOFVOOjfqlYH2GVF1vr dicnaLxJba1ZGS29AHkhBjHeS99yiD0p4loPfhA7O444GyE/iML4+Z54cnZnyvKN tDZMyU34RLTtQ9N9c/jaDVFNokTnBSFCOdLXjidSjwMbWwYX9D2r+loVqlb2R1Nv oO/oClzHbhWLM0L+SGuc6aWMQXmeKRCpfQE3Do2Ae/coA0+Plu5KZL2LpyOWo3I/ zGQOF6tLxzlksBmyXeAwAzt5orW88Abp0IwDyJAsCeMBK0h+Hph+xUBbIpZd4YJi fdSrjw7binKFzIXSfuRbzcYuToLRvomcHJHvF9CAwIT8ivhzIpm+5DVknlKWq9uw 4vvmfh5QPpZ/ujuZz9ryHdyB5Q9/k9sSnr1RL4+p5ByP6jkdQwk10z3s/EFqmxpD e3NUL8DNAEutOsjvdF2dYoRZ04H3KWnlqs9pFPWoyucJndyu4za9sPPUmZtqmFvK Fb3aeGJHtnA= =teLE -----END PGP SIGNATURE----- --==_Exmh_1423619814_1958P--