Hacker News Reader

Comment by Spare_account | Hacker News Reader

I'm surprised both of the key-signing locations are in the US. There should be more locations in other countries.

It’s not a USG power play. It just so happens that a large portion of internet engineers and architects live in the United States.

But it's probably worth remembering that DNSSEC is a PKI over which the USG and its Five Eyes partnership has enormous, outsized influence; they have de facto custody over the most important TLDs on the Internet, a demonstrated willingness to intervene in DNS for policy goals, and, unlike a suborned CA, the TLDs cannot be revoked when the IC abuses them.

"Ceremony" is the right word for IANA's handling of the root zone, which is a McGuffin in the Internet security model; the DNS roots won't be what the IC targets.

> But it's probably worth remembering that DNSSEC is a PKI over which the USG and its Five Eyes partnership has enormous, outsized influence; they have de facto custody over the most important TLDs on the Internet, a demonstrated willingness to intervene in DNS for policy goals, and, unlike a suborned CA, the TLDs cannot be revoked when the IC abuses them.

You're off base.

DNSSEC is not any more nebulous than the existing structure and control mechanism with regards to domain names. It (mostly) is adding cryptographic under-pinnings to the responses. The control remains the same (registrar level).

I'm not off base, and the Five Eyes governments obviously control the most important TLDs, as anyone who was around during the piracy seizures knows. The control remains the same, yes: controlled by the USG.

Reply on news.ycombinator.com