Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

For privacy, getting records signed is ultimately more long-term important than getting queries encrypted immediately. As DoH shows, bolting on transport layer security is trivial.

For example, you'd never want to set your DoH resolver to an arbitrary TOR hidden service. But there would be no problem querying DNSSEC through TOR (assuming the setup wrapped the server-server protocol in something that allowed such forwarding).



What a strange argument. If you want to argue that Tor is superior to DoH, argue that. DNSSEC has nothing to do with it. Which, of course, is obvious: DNSSEC is passively observable by design.


I'm not arguing TOR is "superior" - rather it just demonstrates a use of not needing to trust an upstream. It's also another datapoint for how easy it is to bolt on transport security.

The general principle I'm appealing to is that it's better for a protocol to be missing more-critical qualities that are easier to add later, than less-critical but harder-to-change qualities that will forever be a hindrance. Signed records make for a fundamental security property that cannot be made up for with transport security.

Another way of looking at it is that the records in DNS/DNSSEC form a higher layer protocol than the server-to-server communication. Every party in the system has to agree on the format/semantics of those data objects, whereas the server-to-server protocols can be upgraded pairwise.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: