> delegate security to higher layers so that there's not much point in bothering... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

ars on March 10, 2015 | parent | context | favorite | on: HBO Now DNSSEC Misconfiguration Makes Site Unavail...

> delegate security to higher layers so that there's not much point in bothering to poison it. Literally, my answer is DO NOTHING NEW.

That would not help my server - the DNS poisoning is acting like a DDOS. Sure the random victims know they are on the wrong page, but it doesn't help my server for them to know that.

tptacek on March 10, 2015 | [–]

Isn't exactly the same form of DDOS --- not even reaching how many simpler ways there are to DDOS you --- available in DNSSEC, by injecting non-validating records?

xorcist on March 10, 2015 | | [–]

Not exactly, as you don't cache non validating records (for very long).

yuhong on March 10, 2015 | [–]

Wonder if DNSCurve would solve that.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact