Replying to
@gunstick@mastodon.opencloud.lu now you lost a piece of entropy ;)
Remote
Winfried Angele 🇺🇦🇪🇺
@winfried@fosstodon.org
mastodon 4.7.30 Followers
0 Following
11 Posts
Joined November 20, 2022
Replying to
@jpmens@mastodon.social I guess for nonexistent DS RRs it's the 'minimum' of the de. SOA RR which is 2h. But resolvers may have shorter overwrites.
Replying to
@jpmens@mastodon.social proactive mitigation idea: permanent NTAs for zones that you are sure are not, and will not be, signed. But I'm not sure if the (signed) referrals (NS RRs) of the parent would work once they have expired
Replying to
@jpmens@mastodon.social but I read that it's not common practice to sign referrals.
https://datatracker.ietf.org/doc/html/rfc4035#appendix-B.5
Replying to
Replying to
Replying to
@simon_m@infosec.exchange Yes, DNS resolver operators have implemented workarounds (NTA for de). DENIC has since fixed the issue. A post-mortem report is still pending
Replying to
@jpmens@mastodon.social "particularly when the absence of the DS record must be ‘proven’ for an unsigned child zone."
I wonder when and how often a resolver checks for the presence of the DS in a parent zone. Because it escalated very quickly
Replying to
@jpmens@mastodon.social If I understand correctly, unsigned 'de' zones for which an NTA existed would not have been affected by the incident
Replying to
@jpmens@mastodon.social yes, you're absolutely right! I have a scenario in mind where I control the clients' resolvers and make my own unsigned domains/services more resilient against such incidents