In message <A75AD418-262A-4F12-A7FA-3C8D3861D1DA@orthanc.ca>, Lyndon Nerenberg writes:
On Aug 31, 2016, at 6:36 PM, Matt Palmer <mpalmer@hezmatt.org> wrote:
Thanks, Netscape. Great ecosystem you built.
Nobody at that time had a clue how this environment was going to scale, let alone what the wide-ranging security issues would be.
And where were you back then, not saving us from our erroneous path ...
Well lots of people have been pointing out the risks for years. We are no where at "to big to fail" here. We also have TLSA which can be used to prevent spoofed CERTs being successful. If you have a CERT you should be publishing a TLSA records and have it DNSSEC signed. Mark -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org