Re: [Cerowrt-devel] [Ow-tech] DNSSEC

[Dave Taht <dave.taht@gmail.com>]

On Wed, Feb 11, 2015 at 2:11 PM, Seth <list@sysfu.com> wrote:
> On Tue, 10 Feb 2015 16:57:07 -0800, Ranganathan Krishnan <rk@selwastor.com>
> wrote:
>
>> I am looking into ways to improve DNS on the openwireless router software.
>> When I mentioned DNSSEC as one of the items to review, I received this
>> response from one of the developers.
>>
>> http://sockpuppet.org/blog/2015/01/15/against-dnssec/

I lack time in my life for a point by point rebuttal.

>> CeroWRT put in work to include DNSSEC so there must be folks on the
>> CeroWRT
>> list  who don't see it that way.

If you wish to engage the advocates it would help to ask the question
of the relevant mailing lists. There are many, but I don't know them
all, but cc'ing dan york who is big on dane.

To clarify, in cerowrt, dnssec support was one of a dozen technologies
we wanted to prove viable on home routers and e2e, that comcast viewed
it as important enough to fund simon kelly to implement, and it's been
up and working for about 3 years now. We didn't do any real
development of it in cerowrt, we merely tested the results of that
effort and helped file off the rough edges, to make it more generally
deployable. Which it is.

Benefits I see to dnssec end-2-end:

1) The big one, that I personally love, is having a working NXDOMAIN,
where my upstream ISP cannot fill a dns miss with advertising domains.
There are a lot of valuable fallouts from this.

2) It doesn't cost much in terms of cpu or latency

3) A huge percentage of the sites I regularly visit ARE signed.

At least one criticism, now thoroughly eliminated by existence proof,
is that you can't run dnssec on the edge, and the problems that it
causes are mostly invisible - as are the benefits - as it should be.
The author of that post is more than welcome to try it for himself,
day in, day out, as we have.

>> I would appreciate any pointers to
>> discussions refuting
>> the points made in the blog post above. If the points made in the blog
>> post stand
>> there would not be any reason to include DNSSEC in the openwireless
>> router. So,
>> I am looking for counterpoints that might establish that DNSSEC could have
>> value.
>
>
> This talk doesn't refute the problems with DNSSEC, but rather reinforces
> them.
>
> Dan Bernstein: Authenticating The Whole Internet on Vimeo
> http://vimeo.com/18417770
>
> Worth a watch
>
> Dan Kaminsky's response - http://dankaminsky.com/2011/01/05/djb-ccc/
>
> Personally I'm a fan of DNSChain over DNSSEC - https://okturtles.com/

The debate has gone on 15 years. Alternative proposals need to be viable
enough to merit rollout... which, lacking consensus, would take another 15
years.

Certainly I would like to see DNS replaced with something better, and I
am willing to work towards that goal... but given a choice whether to
deploy dnssec more fully or not, I'd choose deployment.
> _______________________________________________
> Ow-tech mailing list
> Ow-tech@lists.eff.org
> https://lists.eff.org/mailman/listinfo/ow-tech



-- 
Dave Täht

thttp://www.bufferbloat.net/projects/bloat/wiki/Upcoming_Talks