Hacker News new | past | comments | ask | show | jobs | submit login

You make some interesting points, but it's worth adding a little extra context. For example, you mention a period of "almost 3 decades" for DNSSEC, but the first RFC for it was published barely two decades ago in 1997: https://tools.ietf.org/html/rfc2065

As a comparison, the RFC for IPv6 was first published two years earlier, in 1995: https://tools.ietf.org/html/rfc1883 and you could say that "nothing depends on" this too, in that no big commercial sites are served IPv6 only.

The fact that no sites would be taken down if the root private keys were published isn't too surprising either. What would happen if the Let's Encrypt (IdenTrust) private keys were published? Perhaps browsers would do the principled thing and brick ~50% of secure websites: https://w3techs.com/technologies/history_overview/ssl_certif... but I suspect that some pragmatic solution would be found. (In such a situation, though, it would be nice if sites could use TLSA as a defence in depth).

I think that the biggest differences, in terms of adoption rate, are that there isn't a limited supply of non-DNSSEC domain names (unlike the pressure to upgrade from IPv4 to IPv6), and sites don't get a Google search ranking boost (or a shiny padlock in the browser UI) by implementing DNSSEC. Remember that until quite recently even HTTPS was the exception rather than the norm for popular websites.




DNSSEC precedes its first RFC by several years; before that RFC, it was a DoD-funded project run by Trusted Information Systems. It's different today in a variety of ways, but the fundamental design decisions --- offline signers, authenticated denial --- date back to TIS and the USG.

If LetsEncrypt broke, there would be absolute chaos across the Internet.


Maybe, but LetsEncrypt breaking would be fixed much faster than any other CA as it’s the only one where every user is automated.

Contrast that with the legacy model and the emailed zip files of cert chains alone would flood the intertubes.


I like LetsEncrypt and wasn't trying to suggest it was a problem. I think the comparison between LetsEncrypt and DNSSEC is instructive; a LetsEncrypt confidentiality failure would be disastrous, and a DNSSEC confidentiality failure... actually wouldn't matter at all, unless someone out there is doing something really creative and dumb with the protocol.


This might actually be a bad point for letsencrypt. All the eggs are starting to be in the same basket.


If your failures don't count, you're not doing anything important.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: