Slashdot Mirror
Working Around Slow US Gov. On DNS Security
alphadogg writes "Last fall, the US government sought comments from industry about how better to secure the Internet by deploying DNSSEC on the root zone. But it hasn't taken action since then. Internet policy experts anticipate further delays because the Obama Administration hasn't appointed a Secretary of Commerce yet, the position that oversees Internet addressing issues. Meanwhile, the Internet engineering community is forging ahead with a stopgap to allow DNSSEC deployment without the DNS root zone being signed. Known as a Trust Anchor Repository, the alternative was announced by ICANN last week and has been in testing since October."
DNSSEC is overrated.
It's not about security, it's just another way to collect toll on the information superhighway.
I'm sure the CAs are rubbing their hands in glee.
They're not only going to collect money for SSL certs for www.yourdomain.com. Now they get to collect money to sign the "yourdomain.com" DNS entry as well.
And Verisign gets to triple dip if not more.
Apart from the certificate trust scam ("trust us, for you give us money"), too many non-us governments (and non-us non-governmental people, natural or otherwise), won't accept a us govt held root. And why should they?
Yes, arguably a fragmented root it not as good as it should be, but a root held by a single entity, especially one as "trustworthy" as the one with the power to push this through, might, in the long or not so long term, easily cause a plethora of split DNS universes. Which is lots worse.
It really is too bad that the most vocal people with the technical knowledge to understand the impact choose to ignore the politics involved. Yes, smart move people, that will make the issues go away real good.
DNSSEC rely on having a central "trusted" authority to sign all the dns keys. Not even speaking about the inherent security issues with this model, that means that everyone will depend on a single authority for name resolutions (sure Network Solutions loves this)
DNSCurve is a much better solution in that it offers a trust system without the need of a central authority. The key is embedded in the DNS name server (NS) hostnames which are always returned by the upper level name server.
See http://dnscurve.org/index.html
In other news, the Internet is seeing the government as damage and routing around it.
Warning, knife is sharp. Please keep out of children.
Maybe the US Gov. is wise to slow the deployment of DNSSEC. The current design of DNSSEC basically lays out your entire catalogue of DNA entries for anyone to lookup.
Now nobody wants security though obscurity but at the same time nobody wants to give the bad guys a long list of potential targets or a network diagram.
While several solutions to this issue have been suggested most of them flat out fly in the face of how DNSSEC is designed to work.
I think Washington would still be protecting the horse breeders and the stable hand union.
Go green: turn off your refrigerator.
You may be a layman, but you appear to have far more clue about this stuff than most. Yes, once DNSSEC is deployed, anyone with a domain name can publish CERT records and have about the same security as a paid-for CERT. Granted the cert authorities right now require you to give your name and address and such, which publishing CERT records in the DNS won't require so they aren't exactly the same, but close enough considering how little checking the cert authorities do on such information
SPF support for most open source mail servers can be found at libspf2.
In other news, the Internet is seeing the government as damage and routing around it.
Funny, I thought it was always the government seeing the Internet as damage and trying desperately to route around it ;-)
"...because the Obama Administration hasn't appointed a Secretary of Commerce yet..."
That reads like the administration has been lax in getting the position filled. Hopefully the third time's a charm:
http://voices.washingtonpost.com/thefix/2009/02/locke_to_commerce.html?hpid=topnews
I'd argue that one function of government is to fund and/or conduct research that wouldn't be economically viable in a for-profit organization. The space programs contributions to technology have already been well cataloged on slashdot and elsewhere.
1 in 4 Maine children in struggle with hunger.
And it supposed to be so by design, It makes sure that we jump back and forth and fly on every whim that everyone has.
That said the downside it is creates a Failure based culture where it is not what you do right that promotes you but what you do wrong that will get you fired, or prevented from promotion. So for many initiatives no one is willing to put there neck out and push the project. So the DNSSEC is on a list of things to do thats fine, you make sure you have other things on your list and wait until your boss tell you it is a priority... Your Boss will do the same thing until his boss does so etc...
So when the s***t hits the fan everyone will point to the next level up and say it is not my fault. Until it hits the top then the top points at either a Contractor (who they don't fire because they know they didn't do anything wrong they just needed someone to blame) or an Aid which they do fire to show that he is a responsible leader.
To compound the problem most government workers are Unionized and Unions do not like pay based of performance so the people who want to do a good job and do the right thing have no incentive to do so. Unless they are stupid enough to want to run for public office.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Yes and those NASA-based advances only cost us 1 trillion dollars! What a bargain. Oh wait. No. Had those advances been developed privately, like velcro, they'd only cost 1/100th as much. The Market with its competitive natural selection and cost-cutting mechanism ("invisible hand") is naturally more efficient than politicians.
As for cars:
Well we saw what the government can produce. East Germany's government produced the 2-cycle Trabant, which you can smell coming a mile away, and that still used 50s technology in 1990, with massively-long waiting lists (years). Meanwhile the free market in West Germany produced more cars than I can name, with continual constant improvement, and no need to wait to get one.
East versus West Germany is a perfect example of government-provided service versus market-provided service. The former is far inferior to the latter, and the former only offers ONE choice whereas the latter offers many choices, thereby putting the power in the hands of the people, not the politicians.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
On the other hand- US healthcare VS UK NHS
Somehow the US private healthcare is vastly more costly per person per year and worse at actually treating people who are sick.
Yes for the majority of things private enterprise is better at providing it (as in the case of tfa) but it isn't always the case.
Not perfect but if it's something people can want and then save up to afford it then private enterprise works great.
I want Xbox,I don't have the money,I work hard, I save up, I buy it.
On the other hand if part of that chain falls out...
I get sick, I don't have the money, I need healthcare, I work hard... wait I'm sick and can't work... I die.
I want education for my kids,I don't have the money, I work hard but I'm not educated so my labour is worth little, hence I can't save up much, my kids get a crappy education, end up in the exact same position.
Honestly I think that it would have made more sense to leave space alone until tech reached a point where private enterprise could get there profitably but there was that whole international pissing contest.
On the upside it gave a generation an interest in science.
And there are sometimes things which while not profitable are still worth doing like certain kinds of research.
dig +dnssec @a.gov.zoneedit.com. gov.
"Acronyms confuse me."
Then you can has cheeseburgers.
SSL with no, or a bogus cert = "I has encryption. But I might be not be is cat. Might be is dog!"
DNSSEC = "I is cat. You know I is cat"
Need Mercedes parts ?
They're having trouble finding someone who pays their taxes.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
It's only worse at treating people that a sick AND poor. Rich sick people seem to have no complaints. Heck, the US seems to *import* rich sick people, which suggests the system is actually pretty good at caring for sick people, at least if they can afford it.
Known as a Trust Anchor Repository, the alternative was announced by ICANN last week and has been in testing since October.
Ah, so the other alternative, look-aside validation, currently run by the ISC and something I've been using for ages isn't a solution? OK, I'll stop using it right now...
Clues. Isle nine. I'd get one, were I you. ICANN ain't the only game in town.
Resistance is futile. Reactance buggers it up.
The ISC DLV repository doesn't update the dlv.isc.org zone very often, about once a day at present (so I'm told), this further adds to slowing implementation of DNSSEC and registration of dnskeys to this repository.
As a resident of the evergreen state, I'm stoked to see another one our intelligent, liberal, tech-friendly public servants appointed to a federal position:
(from the WP article in parent)
Locke is thoughtful, and having him in charge of the US's interest in IANA sounds like a good idea.
Kerlikowske has the potential to take some interesting decisions regarding marijuana prosecution as well.
The main thing that I'm not understanding is why the US Secretary of Commerce is responsible for specific technology decisions on the DNS.
Surely the political appointee to that post will not be qualified in any capacity to dictate the specifics about DNSSEC deployment.
Additionally, does the US Government still exert so much direct control over the DNS? I thought they divested their control to ICANN, so they could at least appear to not be thugs running the internet for their own benefit. However the ICANN employee specifically states:
'"The ideal scenario is that the root zone is signed," said Kim Davies, manager of root zone services for ICANN."Currently, we have a situation where the root isn't signed, which is largely a political discussion. And in the immediate future, it is not likely that we'll have a signed zone. So we're looking at what's the next best thing."'
Signing the root is a political discussion, needing the secretary of commerce' approval?
Can anyone enlighten me?