IssueRaiser

Raise real-world problems, find people facing the same issue, and discuss solutions.2,000 issues0 comments

hackernews (Network)

(1) Because it doesn't actually solve the problem.

tptacekOct 23, 2026, 5:05 PM

(1) Because it doesn't actually solve the problem. The registry operator for .COM is not historically trustworthy either. (2) Because DNSSEC is a nightmare to deploy. Leaving the IANIX-type operational stuff aside, it doesn't work on all network paths; plenty of middleboxes freak out when they see DNS packets with DNSSEC records in them. People see this and want a best-effort system that uses DNSSEC in the majority cases where it does work, but now you have a downgradable, strippable security protocol. (3) eMudhra is being murdered by the root programs as we speak, and when they're gone all we'll remember them for is as a WebPKI incident. The WebPKI itself will continue to function and nobody will care. That can't happen with .COM or .CO.UK or .IO; there's no accountability for those registry operators at all, let alone transparency logs to track what they're doing.

Comments (0)

No comments yet. Start the discussion.

Comment on this issue