Can't blame hacks for getting facts wrong...
... when over half the "security experts" in fact know nothing and unsurprisingly aren't very effective at this "delivering security" thing. Predictably, you end up with a lot of cargo culting.
Of course it's often enough the hacks that propel attention seekers to "expert" or even "guru" status without much checking or balancing at all. But that's a different discussion.
I for me know what DNSsec is and what it does but that's about it. Oh, and that there's a lot of contention about whether the solution is any good or fit for purpose or whatever. And of course there's an alternative by DJB that is better in some really narrow technical aspects but probably a lot worse for real-world use, as most of his code tends to be.
DNS is amazingly resilient, like how a certain ISP had half its servers answer with port zero (really) in the packets and they never noticed (really). Or how the IPv6 bunch badly borked the DNS design by inventing AAAA (_and_ A6) records instead of moving over to an inet6 domain. There's a reason multiple domains exist, and this is it, you know. So I'm not surprised DNSsec is such a bodge.
But then, we recently were forced to conclude (again, really) that the PKI is a complete crock. And as for PGP/GPG, read _why johnny can't encrypt_. That's the state of using crypto these days. What bothers me most, though, is the active refusal of (especially certain high-profile) "security consultants" to even consider the political ramifications of forcing governments to do anything, like signing the root. Yes, ICANN is still very much a government puppet, as much as everyone would like to deny it. Playing the ostrich doesn't make that go away. We simply can't afford to ignore elephants like that.
For now, likely nothing will happen. But building a threat of impending balkanisation right into your infrastructure isn't the smartest or most forward-looking thing to do.
Biting the hand that feeds IT
