Remix.run Logo
▲ eqvinox 10 hours ago

I'm not connecting at all on this discussion because I don't understand what entity/role in DNS/DANE is the equivalent to eMudrah that is to be distrusted and can't / has to deal with compromised key material. It could be either the registrar or the TLD operator. The former you can switch to another one. The latter just makes the entire TLD unusable no matter how you spin it and whether you use DANE or not. Is there some third role you're considering here?

▲tptacek 9 hours ago | parent [-]

This seems simple. Nobody is switching domain names as a result of this eMudhra thing; they're just going to switch CAs, when eMudhra is murdered by the root programs. But switching domain names would be the only thing you could do if a DANE key was mishandled.