Hacker News Reader

Comment by LeonM | Hacker News Reader

Look at the post history of tptacek. The guy really, really dislikes DNSSEC and uses every opportunity to rant about it.

I have to agree that DNSSEC has its flaws, but tptacek can be a bit extreme about it.

View on HN

I think that's a bit of an unfair characterization of tptacek's stance. Make no mistake, he does hate it, and does post against it when he can, but instead of (implicitly) painting him as (unreasonably) extreme about it, why not do something like link to his essay[1] on the topic, and let the GP inform themselves and come to their own conclusion?

(like so) 1. https://sockpuppet.org/blog/2015/01/15/against-dnssec/

This is a super irritating thing to say. I do in fact hate DNSSEC (nobody who pays any attention to me could have missed that fact and I don't hide it). But I "rant" about it on threads about DNS security, which is what you're seeing in my comment history. DNSSEC is small fraction of what I talk about on HN, but DNS security has been a somewhat hot topic in the past week.

When I "rant" about DNSSEC and stop seeing people say "huh, what's wrong with DNSSEC?" as if they were unfamiliar with its problems, that will be my cue to stop "ranting" about it. The comment you're responding to is just such a statement, and you responded to it not with information but with a personal attack.

> The comment you're responding to is just such a statement, and you responded to it not with information but with a personal attack.

You (and korethr) are right, I should have written a more constructive reply. For that, I want apologize.

Are there any other specs that ICANN tells everyone to deploy that regularly take down entire TLDs, DNS providers, and occasionally an entire RIR?

[0]: https://www.icann.org/news/announcement-2019-02-22-en

[1]: https://ianix.com/pub/dnssec-outages.html

(Disclaimer: I work with 'tptacek but I agree with him because he's right not because I have to ;-))

You can be right about something without bringing it up every chance you get, despite it only having a vague relation to any topic being discussed.

Avoiding DNSSEC is literally, in the literal sense of the word literally, the primary motivation for MTA-STS. The relationship to this thread is not vague.

(Source: the section of the RFC that says the primary motivation of MTA-STS is to ensure transport security when deployment of DNSSEC is undesirable or impractical.)

Reply on news.ycombinator.com