From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ob0-x230.google.com (mail-ob0-x230.google.com [IPv6:2607:f8b0:4003:c01::230]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by huchra.bufferbloat.net (Postfix) with ESMTPS id 7EBE121F182 for ; Tue, 10 Feb 2015 17:51:32 -0800 (PST) Received: by mail-ob0-f176.google.com with SMTP id wo20so649481obc.7 for ; Tue, 10 Feb 2015 17:51:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=VcK9qbnQz1HWWYjReQNSSbQpxaWk/Z/DBecmrEqpKIc=; b=rI0JVtuEe1qU61avX4R8h4/6eVFXHCFhzY4fPt5iM98YZFeCTN20Zay4JNIuHsJnlr OmTKUXLWdBurICUoLjdwYONILbDqKoRrJ0P3xwZsBhbuYQ1rRImtzwbwctp1uFK/AsEP 2Kl687d03lI1/f9B7go4AV5vrQ619F7vIsP9+9PidkgDk78QVQXOqusMWJ2Js0VrE8rn QYhuVQYucYpzV45s08PwD9J9XE4tlMVkuQYyDpE+x5AY5ZPUVRFfgSQzw/LopxqlNq+S tzrmn4YXv8MAcpQblPTdYCa8fIFsr1Uyi2DK9ckkiu3MO5ETg6teAT5n70el7jo2YFaW mDbQ== MIME-Version: 1.0 X-Received: by 10.202.204.88 with SMTP id c85mr5212667oig.81.1423619491771; Tue, 10 Feb 2015 17:51:31 -0800 (PST) Received: by 10.202.51.66 with HTTP; Tue, 10 Feb 2015 17:51:29 -0800 (PST) In-Reply-To: References: Date: Wed, 11 Feb 2015 14:51:29 +1300 Message-ID: From: Dave Taht To: Seth Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Cc: dnsmasq-discuss , Evan Hunt , Dan York , "cerowrt-devel@lists.bufferbloat.net" , ow-tech@lists.eff.org Subject: Re: [Cerowrt-devel] [Ow-tech] DNSSEC X-BeenThere: cerowrt-devel@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: Development issues regarding the cerowrt test router project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Feb 2015 01:52:01 -0000 On Wed, Feb 11, 2015 at 2:11 PM, Seth wrote: > On Tue, 10 Feb 2015 16:57:07 -0800, Ranganathan Krishnan > wrote: > >> I am looking into ways to improve DNS on the openwireless router softwar= e. >> When I mentioned DNSSEC as one of the items to review, I received this >> response from one of the developers. >> >> http://sockpuppet.org/blog/2015/01/15/against-dnssec/ I lack time in my life for a point by point rebuttal. >> CeroWRT put in work to include DNSSEC so there must be folks on the >> CeroWRT >> list who don't see it that way. If you wish to engage the advocates it would help to ask the question of the relevant mailing lists. There are many, but I don't know them all, but cc'ing dan york who is big on dane. To clarify, in cerowrt, dnssec support was one of a dozen technologies we wanted to prove viable on home routers and e2e, that comcast viewed it as important enough to fund simon kelly to implement, and it's been up and working for about 3 years now. We didn't do any real development of it in cerowrt, we merely tested the results of that effort and helped file off the rough edges, to make it more generally deployable. Which it is. Benefits I see to dnssec end-2-end: 1) The big one, that I personally love, is having a working NXDOMAIN, where my upstream ISP cannot fill a dns miss with advertising domains. There are a lot of valuable fallouts from this. 2) It doesn't cost much in terms of cpu or latency 3) A huge percentage of the sites I regularly visit ARE signed. At least one criticism, now thoroughly eliminated by existence proof, is that you can't run dnssec on the edge, and the problems that it causes are mostly invisible - as are the benefits - as it should be. The author of that post is more than welcome to try it for himself, day in, day out, as we have. >> I would appreciate any pointers to >> discussions refuting >> the points made in the blog post above. If the points made in the blog >> post stand >> there would not be any reason to include DNSSEC in the openwireless >> router. So, >> I am looking for counterpoints that might establish that DNSSEC could ha= ve >> value. > > > This talk doesn't refute the problems with DNSSEC, but rather reinforces > them. > > Dan Bernstein: Authenticating The Whole Internet on Vimeo > http://vimeo.com/18417770 > > Worth a watch > > Dan Kaminsky's response - http://dankaminsky.com/2011/01/05/djb-ccc/ > > Personally I'm a fan of DNSChain over DNSSEC - https://okturtles.com/ The debate has gone on 15 years. Alternative proposals need to be viable enough to merit rollout... which, lacking consensus, would take another 15 years. Certainly I would like to see DNS replaced with something better, and I am willing to work towards that goal... but given a choice whether to deploy dnssec more fully or not, I'd choose deployment. > _______________________________________________ > Ow-tech mailing list > Ow-tech@lists.eff.org > https://lists.eff.org/mailman/listinfo/ow-tech --=20 Dave T=C3=A4ht thttp://www.bufferbloat.net/projects/bloat/wiki/Upcoming_Talks