Slashdot Mirror
Kaminsky Bug Options Include "Do Nothing," Says IETF
netbuzz writes "Meeting in Minneapolis this week, the Internet engineering community is debating whether to aggressively fashion and apply fixes for the so-called Kaminsky bug in the DNS discovered this summer, or to simply let its threat stand as motivation for all to move with greater speed toward DNSSEC, which is considered the best long-term security solution. Problem with the latter approach is that DNSSEC has been in the works for a decade already, no one is confident it will be universally embraced, and the Kaminsky flaw is causing real problems today.
On top of that, recommending DNSSEC is starting to sound like recommending that everyone start playing Duke Nukem Forever.
No one likes patching sinking ships but it's better than nothing. Doing nothing and waiting for DNSSEC are nearly the same thing.
You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.
Stupid sensationalism.
You can right now use draft-vixie-dnsex-dns0x20 to protect against the kaminsky bug. This option is already available in the unbound nameserver.
Talking about totally talking out of context. Fools!
If IETF does something to mitigate, the unbelievers scream "see we dont need dnssec"
If IETF does not do something, the unbelievers scream "you're blackmailing us into dnssec"
Stop whining and put your foot where your mouth is.
Minneapolis has a "Skyway." Basically, many of he buildings downtown are connected via heated walkways between the second floors. These second floors form literally miles and miles of indoor pedestrian mall. The Hilton where the conference is held is connected to it.
So basically you can go everywhere without having to ever go outdoors. And we have a gig-e Internet link for the duration of the conference. Its computer geek heaven.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Eh, the whole downtown is covered in habitrails, so you can walk from building to building in short sleeves, because you don't ever have to go outside. It's kind of like living on a really big space station, only with gravity.
It was kind of cold in my hotel room, though.
Even an amateur cryptographer would tell you that the more you know about the message, the easier it is to break it.
And a professional cryptographer would tell you to use a signature scheme that is provably secure (under standard cryptographic assumptions) against known plaintext signature forgery, and use a key big enough to satisfy you. Heck, you do all the crypto off-line, so you can pick a big one.
Confidentiality protections reduce the amount of knowledge, and thus protect against attacks that are yet unknown.
Prove the security of your signature scheme in the Universal Composability model and it's secure against all attacks, known and unknown.
I don't think you know what you're talking about.
Oh the iro... No, actually, you _do_ know what you're talking about: amateur cryptography.
DNSCurve protects against denial of service attacks [link]
So to back up your claim, you post a link to someone making the same claim. Now I'm convinced...
It requires far less compute-power than DNSSEC.
Yes, but it requires it on-line. It also requires caching keys for your clients unless you want to double your in- and outbound packet load.
Read the page about DNSCurve. It says "DNSCurve and DNSSEC have complementary security goals. If both were widely deployed then each one would provide some security that the other does not provide."
They're, taken at the word, not meant to replace each other.