Hacker News Reader

TLS doesn't provide any security in this case because TLS certificates are generated based on DNS. See Lets Encrypt.

Isn’t this why validation is done from multiple locations on different networks? That blocked the 2018 attack and RPKI has made it even harder since.

Yes but it is still possible to execute BGP hijacks that capture 100% of traffic, rendering multi-perspective validation useless. RPKI sadly only solves naive "accidental" BGP hijacks, not malicious BGP hijacks. That's a different discussion though.

I agree and apparently so does the CA/B forum: SC085: Require DNSSEC for CAA and DCV Lookups is currently in intellectual property review.

DCV is CA/B speak for domain-control validation; CAA = these are my approved CAs.

This seems to be optional in the sense that: if a DNS zone has DNSSEC, then validation must succeed. But if DNSSEC is not configured it is not required.

Reply on news.ycombinator.com