Hacker News Reader

I wrote a long piece that says everything I'd say in a comment here:

http://sockpuppet.org/blog/2015/01/15/against-dnssec/

Thanks, that was a good read, and cleared up a lot of misunderstanding I had about DNSSEC!

You make a strong argument that DNSSEC cannot deliver any real advantages. I did not see anything to support your earlier statement that it's worse than nothing, but given the general uselessness of the protocol, I certainly won't be deploying it.

One thing that makes it 'worse than nothing' is that it contributes to amplification attacks due to large response packets: http://dnscurve.org/amplification.html

Reply on news.ycombinator.com