Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It wouldn't prevent getting the wrong answer, sure. But a smart resolver would see DS records at the parent and recognize it as an unsigned, thereby invalid, response.


Thus, DNSSEC doesn't protect against censorship.

It's hilarious that people are saying DNSSEC can be used in Turkey (or anywhere else) to defend against censorship. Either they don't know what they're talking about or don't care about having an honest discussion. Or both.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: