Half of .gov Sites Fail DNSSEC Test
34
netbuzz writes "US federal government Web sites were mandated to have begun deploying DNS Security Extensions (DNSSEC) by Dec. 31, 2009, but a recent check shows that 51 percent have still failed to do so. That does represent a marked increase over the 20 percent that had complied as of a year ago. 'But if you think the government should be fully deployed by now, it's a disappointing number,' says Mark Beckett, vice president of marketing and product management for Secure64, who conducted the study."
Hello Slashvertisement (Score:5, Insightful)
Study performed by company that competes for government contracts to fix issues pointed out by said study finds that government should hire them.
-Rick
Re: (Score:1, Flamebait)
Re: (Score:2)
Re: (Score:3, Interesting)
Almost half pass! (Score:3)
Seeing as how DNSSEC is even less prevelent in non-government web sites, shouldn't we then be rejoicing that almost half of all government sites are passing? That the government sites are performoring so much better than non-government sites seems like a good sign that while DNSSEC hasn't been completely rolled out, the government is opperating ahead of the market and has easily measurable and enforcable goals to complete the process?
Yeah, I want to see 100% adaptation as well, but attacking the government
Re: (Score:1)
I do work for a government agency, and you are wrong.
The problem is that too many of the full time employees have already retired (but haven't left), and the ones that haven't 'retired' want to make sure nothing changes so they can't be let go...
There is no need or requirement to keep "technically" educated, because through politics you can easily prevent change.
"under staffed and overworked" - what a joke; try overstaffed and under-motivated
Re: (Score:1)
Stop the presses: OMB mandate ignored! (Score:3, Insightful)
Government agencies ignored an OMB mandate. This is not exactly news.
Re: (Score:3)
Cricket Liu on DNSSEC (Score:4, Interesting)
Coincidentally I was just yesterday at a DNSSEC seminar presented by Cricket Liu. While obscenely complicated compared to the more or less basic operation of a non-DNSSEC name server, it is super easy to (and really operationally required IMHO to) automate the entire DNSSEC part of DNS administration. Of course he showed his own employers DNS tool (he works for infoblox.com) but there are other choices and methods of automating and he did not really make it into a big sales pitch for his employer, just a simple screenshot showing its ease of use and a few minutes to describe it.
Anyways, I plan to start really investigating the deployment of DNSSEC now.
Re: (Score:2)
I eagerly await your demonstration of Power over Ethernet over Voice. (PoEoV).
Re: (Score:2)
PoEoV has been held up in the IETF draft process. The stupid skanks at the ITU-T won't back me until I get a major vendor like Cisco or Juniper involved. But Cisco won't talk to me unless I am willing to sell them my idea so they can name it CiscoVoice-E and Juniper wants to put it in their MX series but have an 18 month screening process before they will even beta it but wont formally adopt it without industry standardization (chicken-or-egg problem, hello!!) Perhaps The Onion will give me some good public
Re: (Score:2)
This was the presentation in Minneapolis? I was there too. I thought it was excellent, as was the food. I did wind up wearing a bunch of salad dressing on my shirtsleeve though.
DNSSEC needs to get implemented, and that soon. Of course when I hear the statistics on how many ancient unpatched servers are out there with recursion turned on for world+dog, I want to cry.
Re: (Score:2)
Yes in Minneapolis. The food was good but as a vegetarian the "meat" dish was something I passed on and then I was left hungry at the end. Not complaining though, free food and the presentation very efficiently articulated the overall situation. I wish I had asked a couple more questions that came to mind after I had already left: statusopinion of other non-DNSSEC enhancement technologies like DNSCURVE and secondly Cricket's opinion on DNSSEC proxy tools in general with one example being phreebird by Dan Ka
Confusing wording... (Score:2)
Wow, talk about confusingly worded summary. If you're going to talk about how many sites have failed to pass the test, and then compare that to previous numbers, make sure that the second number is ALSO the percentage that FAILED and not the precentage that PASSED. At first I though it was saying that, last time, only 20% failed the test and was wondering why the OP seemed to be suggesting that 51% failure is better than 20% failure.
Re: (Score:1)
Wow, talk about confusingly worded summary. If you're going to talk about how many sites have failed to pass the test, and then compare that to previous numbers, make sure that the second number is ALSO the percentage that FAILED and not the precentage that PASSED. At first I though it was saying that, last time, only 20% failed the test and was wondering why the OP seemed to be suggesting that 51% failure is better than 20% failure.
It's not confusing at all. If you're not paying attention, you might get confused... but if you have any reading comprehension it should be pretty clear what is being stated.
You'd think the people that read a site (formerly?) billed as "News for Nerds" would appreciate the importance of Implicit vs. Explicit.
Half *not signed* not *failing* (Score:3)
Re: (Score:1)
No. It means they validate as insecure which means there was no cryptographic proof that the answers returned are good.
Now there have been broken configurations but they usually get fixed relatively quickly.