Jump to content

Talk:Domain Name System Security Extensions

Page contents not supported in other languages.
From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by Lowercase sigmabot III (talk | contribs) at 03:51, 4 June 2021 (Archiving 1 discussion(s) to Talk:Domain Name System Security Extensions/Archive 1) (bot). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

WikiProject iconComputing C‑class Low‑importance
WikiProject iconThis article is within the scope of WikiProject Computing, a collaborative effort to improve the coverage of computers, computing, and information technology on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.ComputingWikipedia:WikiProject ComputingTemplate:WikiProject ComputingComputing
CThis article has been rated as C-class on Wikipedia's content assessment scale.
LowThis article has been rated as Low-importance on the project's importance scale.


Section on DNSSEC Lookaside Validation - could add info about removal from software

In the section on DNSSEC Lookaside Validation, the text says:

It is not clear yet if or when DLV support will be removed from BIND and other implementations of validating resolvers.

At this time in 2020, DLV has been retired by RFC 8749 and I believe support for it has already been or is being removed from most resolver software. At some point someone could look at some of the validating resolvers to see anyone is still supporting DLV and update that statement with info about the versions that stopped supporting it. I'm thinking of something like "Support for DLV was discontinued in BIND as of version XXX and in (other software) as of version XXX." - Dyork (talk) 01:32, 4 June 2020 (UTC)[reply]

Addressed today Vickyrisk (talk) 20:05, 5 June 2020 (UTC)[reply]

Needs mention of Root KSK Rollover in 2019

The article has no mention of the Root KSK Rollover in 2019. There are many articles about this in the media and there was an exhaustive comment period from ICANN. It probably needs a whole section in here about the KSK. - Dyork (talk) 01:40, 4 June 2020 (UTC)[reply]

Is Dyork referring

In 2018, ICANN changed the trust anchor for the DNS root for the first time. Many lessons were learned about DNSSEC during that process. Furthermore, many resolver operators became more aware of DNSSEC and turned on validation, and the world got to more clearly see how the entire DNSSEC system worked.

— bottom lines of https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en
23:18, 17 January 2021 (UTC)
Yes, that is what I'm referring to. The root "key signing key" (KSK) was rolled over on 11 October 2018. ICANN has a great amount of info about it and there were many media reports, too. Someone of us (editors) just needs to write some text for the article. - Dyork (talk) 02:14, 18 January 2021 (UTC)[reply]

A few words about "zone enumeration"

Prevention of "zone enumeration" where desired

— At the bottom lines of Domain_Name_System_Security_Extensions#Overview

I didn't know what is "zone enumeration". Turned out it is also called zone walking. DNSSEC target to accurately point non existent domains is considered to amplify the zone enumeration effect. I found https://www.zerosuniverse.com/ethical-hacking/what-is-dns-enumeration/ an enlightening short article. Continuing reading,

NSEC3 … uses cryptographically hashed record names to avoid the enumeration

— Domain_Name_System_Security_Extensions#Resource_records

Turns out there is more discussion at Domain_Name_System_Security_Extensions#Authenticating_NXDOMAIN_responses_and_NSEC. 02:58, 19 January 2021 (UTC)

Requested move 31 March 2021

The following is a closed discussion of a requested move. Please do not modify it. Subsequent comments should be made in a new section on the talk page. Editors desiring to contest the closing decision should consider a move review after discussing it on the closer's talk page. No further edits should be made to this discussion.

The result of the move request was: There's consensus to use the full name of the protocol in the article title. Some editors expressed that many RS will give the full name of the protocol at first mention and then the acronym afterwards, and this style is considered better for Wikipedia, as well as being used in many related articles. (non-admin closure) (t · c) buidhe 13:09, 16 May 2021 (UTC)[reply]


Domain Name System Security Extensions → DNSSEC – Per the Google Ngram viewer here, far less people are using the full name. Per WP:COMMONNAME, DNSSEC should be used. PhotographyEdits (talk) 12:10, 31 March 2021 (UTC) —Relisting. BD2412 T 00:29, 9 May 2021 (UTC)[reply]

  • Uncertain - In general I don't like to use acronyms for page titles, however I do understand the MOS:ACROTITLE principle, and in the case of "DNSSEC" I suspect that a very high percentage of visitors will search for the acronym instead of the full name. At this time I do not directly "oppose" this move as I have done over on the Talk page for "DNS". However, as I did there, I do question whether the Google Ngram Viewer is giving us the most accurate data to help us decide. If that tool is search books for both "Domain Name Security Extensions" and "DNSSEC", then it will naturally find few occurrences of the full name and many occurrences of the acronym because that is how authors write! Is there perhaps a different tool that could look at Google search volume or something similar? - Dyork (talk) 01:21, 1 April 2021 (UTC)[reply]
@Dyork: Let me point out that searching for both terms gives me 60k results here , and only searching for the abbreviation gives 6 million results, see here, which implies that a lot of websites use the abbreviation without explaining the full name. PhotographyEdits (talk) 11:48, 1 April 2021 (UTC)[reply]
@Dyork: Please vote if you have made a decision about it. I'd like to note that you have linked it as DNSSEC on your own user page, contrary to Session Initiation Protocol PhotographyEdits (talk) 13:23, 7 April 2021 (UTC)[reply]
  • Oppose - (Changing from 'Uncertain' to 'Oppose') I just went through and reviewed the other articles in the Internet Security Protocols template box and in the Internet protocol suite and in almost all the articles for other protocols, the title is for the full name of the protocol (with HTTPS and DMARC being two exceptions). I think for consistency with the overall suite of articles, and for reasons others have cited, this article should continue to be titled with the full name of the protocol. - Dyork (talk) 00:13, 8 April 2021 (UTC)[reply]
Thank you for pointing that out. I guess I don't understand Wikipedia's search algorithm, because typing D N S S . . always auto-completes to Dnssec, and unless you type the entire DNSSEC and hit return then you are led to the Dnssec redirect. I guess this is what I think could be improved; I don't think that the literature ever calls it "Dnssec". ---Avatar317(talk) 03:00, 2 April 2021 (UTC)[reply]
Yes, our search function sucks. See WP:CANCER to see what we spend money on instead. One of the way it sucks is that it capitalizes search terms, which is how most people search. If I do a search on "DnSsEc" it should say "(Redirected from DnSsEc)" instead of "(Redirected from Dnssec)" --Guy Macon (talk) 03:46, 2 April 2021 (UTC)[reply]
  • @Avatar317: - do you have an opinion (either 'oppose' or 'support') on the requested move? You don't have to.. but I am just wondering if you do so that we can perhaps move closer to a consensus (or a lack of consensus). Just curious. - Dyork (talk) 01:38, 14 May 2021 (UTC)[reply]
  • 3 opposed
  • 2 supporting
I would also note that a similar request to move was raised for Domain Name System on March 31, and the result was a consensus NOT to move the page to "DNS". I have already stated my opposition above, but I would further strengthen it by stating that I think this page should be consistent with the Domain Name System page, i.e. spelling out the entire name in the title. - Dyork (talk) 02:39, 9 May 2021 (UTC)[reply]
  • @PhotographyEdits: It happens that I am the guy who wrote that particular page on the Internet Society's website.🙂 (That is my employer.) I do understand MOS:ACROTITLE, but I still oppose changing this Wikipedia article title. I think article titles should spell out the whole protocol name, as if you were encountering it the first time in a publication. And, in this case, I think that the article for DNSSEC should remain consistent with the article for DNS, where the full name is spelled out. - Dyork (talk) 01:34, 14 May 2021 (UTC)[reply]
  • @Dyork: Nice that you wrote that. But, the Wikipedia article title should refer to the commonly known name, and the first sentence should explain the full name. I think that the subject is primarily known for its abbreviation and that the same applies for DNS. Another example is IPsec, which is the common name for Internet Protocol Security, while the Internet Protocol article has a fully spelled out title. PhotographyEdits (talk) 09:07, 14 May 2021 (UTC)[reply]
The discussion above is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Does this article need mention of the Trusted Community Representatives?

Reading about the recent death of Dan Kaminsky, I saw that he was a DNSSEC TCR, some of which help manage the root key for the whole thing. I wanted to find out more about this but was surprised to find out that TCRs (their role, how they're selected, etc) are not discussed in this article. Does anyone familiar with the topic think it might be a good subject to add a paragraph about? In case notable TCRs are appropriate to mention, I checked a couple of random names in the list and found two others notable enough to have articles (Bevil Wooding and John Curran (businessman).) EditorInTheRye (talk) 20:10, 28 April 2021 (UTC)[reply]

  • @EditorInTheRye: I think it's actually a bit of a bigger challenge. As I mentioned earlier on this talk page there is no mention in the article about the Root KSK Rollover in 2019. Since writing that, I actually found a brief mention over in the DNS root zone article, but it's just that... brief! This article could really have a bit more of an explanation about how ICANN manages the root key, the fact that they have regular key signing ceremonies in two different data centers, and yes, the role of the TCRs in all of that. There is a good bit of info on IANA's site and also in various media articles that have been written over the years. It's just that "someone" has to make the time to go through all that and add appropriate text to this article. 🙂 - Dyork (talk) 02:22, 29 April 2021 (UTC)[reply]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Talk:Domain_Name_System_Security_Extensions&oldid=1026765135"