Hacker News Reader

Comment by agwa | Hacker News Reader

> We’ve had the X.509 certificate infrastructure for 30+ years, and it’s only recently become mostly safe and automated enough for people to deploy without risk. (This includes new risks, like accidentally sending HSTS headers with too large timeouts to the world.) DNSSEC will get there, too.

The WebPKI didn't improve on its own; it got there largely because web browser makers have high-leverage points to exert influence, which they used to make sure improvements got done.

How do you envision DNSSEC getting there?

View on HN

> it got there largely because web browser makers have high-leverage points to exert influence

That's not how I remember it. Unless you excluded google chrome, Microsoft's browsers, and Apples browsers.

The change was brought upon by let's encrypt, and Mozilla is the only one of the founders that has a web browser.

It certainly helps that we're moving on from "It's irrelevant" to "Actually this is important and it's bad if it's broken". When would you say that happened for the Web PKI? Not last century when the Web PKI comes into existence for sure. Maybe if you squint you could argue for the Baseline Requirements in 2011 as a starting point ? Or maybe the Ten Blessed Methods which was only a few years ago?

The browsers do have leverage over the TLDs, and over the DNS resolvers, in the form of how they choose to treat names and name services. For example check the "trusted resolver" policies at Mozilla and Chrome, which IIRC got big US ISPs to swear off nonsense like injecting bogus results into DNS in exchange for having the browser work with their DNS servers.

Browsers have leverage over CAs because CAs have to ask browsers to be included in the first place, and because distrusting a CA only temporarily breaks websites until they can switch to a new certificate.

What kind of leverage do you think a browser could practically exert over a TLD?

As just one example, they can change presentation. Remember the CAs were able to sell an otherwise useless change in presentation for a considerably increased price, you will still occasionally run into people who thought that was crucial to their business.

Oh, people are already working on it; they do it because:

1. Doing DNSSEC manually is work.

2. Doing DNSSEC manually is risky, which all these outages show.

The more DNSSEC usage increases, the more work it will be to do it, and the more people will mess up, and the more the incentives to automate it will increase.

Reply on news.ycombinator.com