alt Hacker Newstptacek argues that DNSSEC is too flawed to actually do this:
Replies
GoblinSlayer • today at 2:12 PM
ECDSA was added to DNSSEC 3 years before that blog post in april 2012 (rfc6605).
➕ show 1 reply
ranger_danger • today at 1:04 PM
I have seen their comments across this site for a very long time. Unfortunately I do not respect or put any stock in what they say, because of how unbelievably rude and dogmatic they are, and always have been.
"As a rule, strong feelings about issues do not emerge from deep understanding."
➕ show 1 reply
He's right. DNSSEC is a mess, and we should fix that. We should fix that whether or not we delete CAs because CAs rely on DNS to verify that you own your domain. If DNS isn't secure, neither are CAs.
In the long run, fixing bugs is almost always better than working around them. DNSSEC is a bug. So are CAs. We can and should fix both.