Hacker News Reader

Comment by ejr | Hacker News Reader

  >Virtually no important services on the Internet rely on DNSSEC.

Don't know about "important", but many governments including the U.S. consider it important enough to deploy:

https://en.wikipedia.org/wiki/DNSSEC#Deployment http://fedv6-deployment.antd.nist.gov/

View on HN

The federal government is also one of the leading deployers of X.509 PKI.

I'm not speaking to the validity of whether or not DNSSEC is actually a good idea. Your contention is that it's not. But saying the equivalent of "no one uses it" is demonstrably false.

Enterprises buy all sorts of crazy shit that people don't use. This is the same thing.

I'm sorry, but no, it's not the same thing. (I'm in Toronto, right now, so all messages should start off being polite!) Enterprises DO buy all sorts of crazy stuff but this is not one of them. I know it annoys the critics, but there ARE very real deployments of DNSSEC happening out there. As I cited in another comment, there are 18 million Comcast customers now getting DNSSEC validation. There are millions of users in many European countries that are getting DNSSEC validation.

In Sweden, for example, around 71% of all users are user DNS resolvers that perform DNSSEC validation (scroll down on http://gronggrong.rand.apnic.net/cgi-bin/ccpage?c=XA&x=1&g=0... for the per-country stats)

What percentage of DNS resolutions in Sweden actually involve DNSSEC? Take your time; I've got a pretty good first approximation of the answer. :)

(smiling) You already know the answer - "it depends". What websites were they visiting? If they were going to a lot in .SE, then they might have had a good bit of DNSSEC validation happening. If they were going to .COM websites they probably would have had very little.

Reply on news.ycombinator.com