Hacker News Reader

Fire up a terminal, run "tcpdump -s0 -i en0 udp", open Safari, resolve "www.enteract.com", and tell me if you see a full recursive DNS lookup happening, or if instead you see Safari's stub resolver asking the DHCP-configured DNS cache server for help over the insecure Internet.

View on HN

mDNSResponder supports DNSSEC validation, please look at the source code:

http://opensource.apple.com/source/mDNSResponder/mDNSRespond...

This is like saying "everyone can just run their own DNS server". Of course, as I said, they won't. The fact that Apple has a DNSSEC-resolving recursive lookup server and Safari doesn't use it strengthens my point instead of weakening it.

That doesn't really respond to the point. Does Safari use DNSSEC or not?

Of course it does, Safari uses the resolver provided by OS X, which is mDNSResponder. (It superseded the stub resolver in libSystem.dylib starting with 10.6.)

You are mistaken. https://news.ycombinator.com/item?id=8896092

How's that saying go about only proving the code correct, but not testing it? I think there's a reason tptacek specifically asked about tcpdump of on wire traffic.

Reply on news.ycombinator.com