Consider DNSSEC about tent.io HOT 3 CLOSED

Note: It would be almost impossible to introduce such a hard requirement later on, which would lead to legacy handling of not-yet-secured sites, adding complexity and weakening security. The choice for/against DNSSEC should come soon and decisively.

Personally, I would consider mandatory DNSSEC a /huge/ improvement.

from tent.io.

The problem is that the vast majority of users (even the ones running their own servers) won't have access to name servers that support DNSSEC, let alone understand how to set it up.

from tent.io.

You would hope that BIND 9 is starting to become widespread :/

The good thing is, this could all be handled completely transparent to the user; Tent servers can use their 'own' implementation of a DNS recursive resolver instead of falling back to the one provided by the OS (caching is lost, however) to provide DNSSEC-enabled lookup. The dnsruby gem, for example, works great in that regard, no matter which environment you are in. Example gist: https://gist.github.com/3504294, should output SECURE.

The DNS servers would be another thing. For hosted platforms, running their own DNS server and a cronjob to update the signatures should not be a problem. For self-hosted platforms, their DNS needs to be stored somewhere anyway. A solution to that problem would solve the DNSSEC problem as well.

from tent.io.