Top all-time · #2200
IANIX
Personal blog · ianix.comsecuritysystems
IANIX is a personal blog at ianix.com about security and systems. Since 2014, 37 different Hacker News readers have linked it 54 times, most often “DNSSEC Downtime: List of Outages and Validation Failures”. No feed was found, so read it on the site itself.
IANIX: crypto, unix, internet
Most-linked posts?
- DNSSEC Downtime: List of Outages and Validation Failures20 people · 22 mentions · first linked 2016-09-30
- List of Major DNSSEC Outages and Validation Failures4 people · 5 mentions · first linked 2014-07-02
- Things That Use Ed255193 people · 3 mentions · first linked 2025-09-12
What Hacker News says?
Uh huh. https://ianix.com/pub/dnssec-outages.html
Comment linking /pub/dnssec-outages.html
on “Google flags Immich sites as dangerous”Submitted List of software and things that use or support WireGuard as a story · 109 points
HN discussion> Just because virtually none of the best-regarded security teams haven’t implemented yet doesn’t mean that you shouldn’t implement it Unclear how it makes sense to do something allegedly security related that best-regarded security teams recommend against. Sounds like security theater. Meanwhile, consider the failures: https://ianix.com/pub/dnssec-outages.html Misconfiguation can cause the sites to disappear from t…
Comment linking /pub/dnssec-outages.html
on “The SaaS CTO Security Checklist Redux”Submitted DNSSEC Outage on www.cloudflare.com – 2019-03-21 as a story · 73 points
HN discussion"libsodium" is just NaCl with autoconf cruft added. NaCl does not use autoconf nor even make. It is not necessary but if someone really feels compelled to use it, why stop them? I have never seen any author or end user comment that they dislike using autoconf, or write alternatives to it. Autoconf is loved by all, isn't it? I think what you could say is that using NaCl in your own software is the only way to get goo…
Comment linking /
on “How I implemented my own crypto”Submitted DNSSEC Downtime: List of Outages and Validation Failures as a story · 3 points
HN discussionhttps://sqlite.org/copyright.html Public domain. No "copyleft" license needed Being written in a small, fast, "old and boring" language may be part of what makes SQLite apealing. Another (related) part may be the thoughtfulness and carefulness of its author, e.g., "time, attention and testing" The former, i.e., the author's "time, attention and testing", may matter more than the later, i.e., the author's language ch…
Comment linking /
on “Why Is SQLite Coded In C”Submitted Things That Use Ed25519 as a story · 2 points
HN discussionFirst people need to know about it to use it. Then it needs to actually work and not fail. https://ianix.com/pub/dnssec-outages.html
Comment linking /pub/dnssec-outages.html
on “DNS-over-HTTPS”Submitted ChaCha Usage and Deployment as a story · 2 points
HN discussionreason: offer users of your website the option of per packet encrypted DNS CurveDNS is also not difficult to set up, so if you run your own authoritative DNS for your website, you can provide optional per packet encrypted DNS. There are very few websites that offer this option.^1 If every website provided this option, users would have a better alternative than DoT or DoH.^2 Neither DoT, DoH nor DNSSEC provide per pa…
Comment linking /
on “Why might you run your own DNS server?”Submitted The browser privacy handbook as a story · 1 points
HN discussionI'm assuming you have 2FA turned on already. It sounds from what you're saying like you (and at least a few other hacker news posters) want is an even stricter "no seriously, I promise I won't ever screw up" mode. We try not to have those kinds of modes, because (for example): https://ianix.com/pub/dnssec-outages.html It turns out, black and white security models lead to massive losses of availability when people sc…
Comment linking /pub/dnssec-outages.html
on “The FastMail Security Mindset”Submitted Archive of DNSSEC outages – is DNSSEC finally a dead cow in 2017? as a story · 1 points
HN discussionI use tinyssh. Have used it since 2014 without any problems. I use the external NaCl library, not the internal one based on TweetNaCl. If NaCl, or even TweetNaCl, is "homegrown crypto" why are all these projects using it: https://ianix.com/pub/curve25519-deployment.html OpenSSH included. How much does tinyssh's internal library differ from TweetNaCl's? Wouldn't a security curmudgeon at least examine those difference…
Comment linking /pub/curve25519-deployment.html
on “Tinyssh”Submitted List of Major DNSSEC Outages and Validation Failures as a story · 1 points
HN discussion"File-based domain validation was less secure; one dangling DNS record or webserver mis-configuration is all it takes to hijack a certificate. The remaining domain control validation (DCV) methods for my organization have been reduced to two options: DNS TXT records and email-based validation. DNS validation is a decent and secure option in an organization where DNS management access is tightly controlled. A recent…
Comment linking /pub/dnssec-outages.html
on “SSL certificate requirements are becoming obnoxious”Submitted Things that use Curve25519 as a story · 1 points
HN discussionIt’s been a while but I recall it was a Namecheap issue. https://ianix.com/pub/dnssec-outages/20190221-namecheap/
Comment linking /pub/dnssec-outages/20190221-namecheap/
on “Namecheap vulnerability they refuse to fix: no 2FA on support portal login”Also by this author: https://github.com/cjdelisle/cjdns cjdns was one of the early adopters of NaCl https://nacl.cr.yp.to https://ianix.com/pub/curve25519-deployment.html
Comment linking /pub/curve25519-deployment.html
on “So you want to roll your own crypto?”Are there any other specs that ICANN tells everyone to deploy that regularly take down entire TLDs, DNS providers, and occasionally an entire RIR? [0]: https://www.icann.org/news/announcement-2019-02-22-en [1]: https://ianix.com/pub/dnssec-outages.html (Disclaimer: I work with 'tptacek but I agree with him because he's right not because I have to ;-))
Comment linking /pub/dnssec-outages.html
on “Making email more secure with MTA-STS standard”There's a good index of major DNSSEC outages here, https://ianix.com/pub/dnssec-outages.html
Comment linking /pub/dnssec-outages.html
on “.de TLD offline due to DNSSEC?”https://ianix.com/pub/dnssec-outages.html
Comment linking /pub/dnssec-outages.html
on “.de TLD offline due to DNSSEC?”Denic will be added to the "Major DNSSEC Outages and Validation Failures" list: https://ianix.com/pub/dnssec-outages.html
Comment linking /pub/dnssec-outages.html
on “.de TLD offline due to DNSSEC?”They can join the (rather long) list of TLD DNSSEC outages https://ianix.com/pub/dnssec-outages.html
Comment linking /pub/dnssec-outages.html
on “.de TLD offline due to DNSSEC?”This seems like a weird benchmark, reading from /dev/urandom and gzipping random data does not seem like something most folks will want to do. It even appears like /dev/urandom speeds differ greatly on various architectures [0] and there are issues with /dev/random being fundamentally slow due to the entropy pool [1] (but I guess this is why the author uses /dev/urandom). It would be better to measure something more…
Comment linking /pub/comparing-dev-random-speed-linux-bsd.html
on “ARM Mac: Why I'm Worried About Virtualization”"Can you provide a name or a link?" https://ianix.com/pub/dnssec-outages.html http://web.archive.org/web/20000824181520/http://cr.yp.to/dj... https://media.ccc.de/v/27c3-4295-en-high_speed_high_security... http://cr.yp.to/talks/2017.09.18/slides-djb-20170918-dnssec-... http://cr.yp.to/talks/2016.12.08/slides-djb-20161208-dnssec-... http://cr.yp.to/talks/2016.06.10/slides-djb-20160610-a4.pdf http://cr.yp.to/talks/201…
Comment linking /pub/dnssec-outages.html
on “Large cluster of domains sharing the same pair of 512bit ZSKs and RSA key oddities”DNSSEC is notorious for breaking things [1]. I use it on most of my domains, but I would not just 'enable' it on a domain that I cared about and that had real users without a lot of thought and planning. Nor should you. [1] - https://ianix.com/pub/dnssec-outages.html
Comment linking /pub/dnssec-outages.html
on “Ask HN: Cloudflare broke my domain's DNSSEC making it unreachable since 4 days”How about a page for all those DNSSEC outages? https://ianix.com/pub/dnssec-outages.html
Comment linking /pub/dnssec-outages.html
on “The DNS Museum”No, because nobody really depends on DNSSEC, so nothing will break: - https://ianix.com/pub/dnssec-outages.html - https://twitter.com/tqbf/status/772103926258671618
Comment linking /pub/dnssec-outages.html
on “First-ever DNSSEC root key rollover”
