.ORG Zone Signed With DNSSEC 89
lothos and several other readers let us know that the Public Interest Registry has announced the key-signing key to validate the signatures on the ORG zone. A few more details are on the PIR DNSSEC page. PC World interviewed PIR CEO Alexa Raad and writes: "On June 2, PIR will announce that it is signing the .org domain with NSEC3 and that it has begun testing DNSSEC with a handful of registrars using first fake and then real .org names. PIR plans to keep expanding its testing over the next few months until the registry is ready to support DNSSEC for all .org domain name operators. Raad says she expects full-blown DNSSEC deployment on the .org domain in 2010."
DNSSEC and domains and subdomains? (Score:4, Interesting)
So what does this mean for domains in the .org realm? Should people be adding DNSSEC to their own domains, and if so what sort of cost should we expect? Also, how does software on a PC validate that a domain is signed?
Yes but how do I implement it... (Score:5, Interesting)
Every time some organisation wants to push some new system or regime they drop into hype overdrive. There are emails, announcements, articles, PDFs a plenty, but try as you might, the actual information you need to enable you to implement stays carefully hidden from view. This isn't about security; if it was the technical details of configuration and operation would be at the top of the list of files to view. It is about some organisation seeking praise and glory for doing something or other.
What should domain owners do? (Score:3, Interesting)
As the owner of a .org domain (used for a few websites and email) is there anything I ought to be doing based on this? I'm registered at Dotster, hosted elsewhere (Dreamhost).
Re:Assumes a centralized DNS system (Score:1, Interesting)
The public root key is like the certificates which are installed in your browser: Unlike the keys of delegated zones, it forms a direct trust relationship, independent of further signatures, so it is indeed much like a self-signed certificate.
An alternative root can establish a completely separate namespace or it can integrate with the "official" DNS namespace and modify it by delegating certain names differently. There is no provision in DNSSEC which allows zones to reject delegations from "unauthorized" higher level zones. Authorization is strictly top-down.
Why DNSSEC? (Score:2, Interesting)
I've read about what DNSSEC does, but I haven't found is an actual reason why anyone should care. Is there one?
Seems to me it kinda-sorta solves a few non-problems, and any actual problems it might touch upon have been solved better by SSL certificates years ago. Is it just that ISC is envious of the SSL cert sellers, and want to create a new action they can have the largest piece of?
Re:Assumes a centralized DNS system (Score:3, Interesting)
I don't think it will happen for the very same reasons you state.
It's not as difficult as you think:
1. Start a new root
2. Root has your domains, but redirects all old domains to the US-controlled system
3. Require ISPs to point to the new root (it's the government, make it tue law)
4. Set a grace period for old domains to register with you
5. Make the cybersquatting reesolution process hell if you don't use the grace period
6. Turn off the lights on the old domains, alias them to the new ones
So you own google.com, EU starts with .comx - better register it or some porn site will take over google.comx until you can get it back. Repeat BS process a few times like the digital TV conversions by offering extensions and saying this time we're REALLY doing it. When you have enough on board, turn off the lights on the old .com, have it resolve same as .comx site. No "black net" sudden transition.
Re:DNSSEC and domains and subdomains? (Score:3, Interesting)
No, you would know that you are at "yourbank.com" you wouldn't know that it's "YOUR bank's website" ... which is the problem the new super certs. are trying to address.
Re:djb (Score:3, Interesting)
Maybe you should actually read up on why Dan's right or wrong about DNSSEC and make a point instead of harping on about his attitude issues.
He may have a god complex, but he's rarely wrong, so you might want to prove him wrong before you assume you have the right to judge his attitude.