DNS is a centralization risk, yes. Somehow we've decided this is fine. DNSSEC isn't the only issue - your TLD's nameservers could also be offline, or censored in your country.

▲

skywhopper 4 hours ago | parent | next [-]

DNS is barely centralized. Is there an alternative global name lookup system that is less centralized without even worse downsides?

	▲	fc417fc802 3 minutes ago \| parent \| next [-]
		GNS is the obvious response here, in addition to the various blockchain based solutions. Nothing that enjoys widespread support or mindshare unfortunately. Even the current centralized ICANN flavor could be substantially more resilient if it instead handed out key fingerprints and semi-permanent addresses when queried. That way it would only ever need to be used as a fallback when the previously queried information failed to resolve.
	▲	pocksuppet 3 hours ago \| parent \| prev [-]
		BGP, but the names in question are limited to 128 bits, of which at most 48 will be looked up, and you don't get to choose which 48 bits are assigned to you.

▲

greatgib 4 hours ago | parent | prev | next [-]

Normally it should not have been, with cache and all, but that was the past...

Think about what would happen the day that letsencrypt is borken for whatever reason technical or like having a retarded US leader and being located in the wrong country. Taken into account the push of letsencrypt with major web browsers to restrict certificate validities for short periods like only a few days...

▲

muvlon 3 hours ago | parent [-]

Let's Encrypt has to be down for days before people begin to feel the pain. DNS is very different, it breaks stuff immediately everywhere.

	▲	tharkun__ 3 hours ago \| parent [-]
		No it doesn't. DNS breaks as soon as TTLs run out. It's your choice to set them so low that stuff breaks immediately.

▲

cyberax 4 hours ago | parent | prev [-]

Not really? .com and .net are still up

If Let's Encrypt goes down, half of the Internet will become inaccessible in a week.

▲

akerl_ 3 hours ago | parent | next [-]

Presumably if LetsEncrypt goes down and stays down for a week, the sites that go down are the ones that see that their CA went down and at no point in the week take the option to get certs from a different CA?

	▲	bluejekyll 2 hours ago \| parent [-]
		I guarantee that there are a ton of sites out there not monitoring their certs.

▲

sllabres 3 hours ago | parent | prev | next [-]

So it seems we need something like this [1] for IT infrastructure? ;)

[1] https://outerspaceinstitute.ca/crashclock/

▲

4 hours ago | parent | prev [-]

[deleted]