He's right. DNSSEC is a mess, and we should fix that. We should fix that whether or not we delete CAs because CAs rely on DNS to verify that you own your domain. If DNS isn't secure, neither are CAs.

In the long run, fixing bugs is almost always better than working around them. DNSSEC is a bug. So are CAs. We can and should fix both.

▲

chimeracoder 3 hours ago | parent [-]

His argument is that DNSSEC is fundamentally broken, and you can't fix it via incremental improvements.

He is not arguing that DNS security cannot or should not be improved; in fact, he explicitly states the exact opposite.

	▲	tptacek an hour ago \| parent [-]
		I don't have an objection to doing a different DNS security system, and in fact I like DoH a lot. You can do DoH all the way back from authority servers if you like, and that addresses domain validation without boiling the ocean with 1990s cryptography the way DNSSEC tries to do.