But if I'm running BIND on my local machine, it would be just as secure under the DNSCurve proposal as with DNSSEC.
If my organization has a central, recursive, trusted DNS server, then I'm just as secure under DNSCurve as with DNSSEC.
The only place DNSCurve loses if if I have a stub resolver pointing to an *untrusted* recursive resolver on another host, instead of running my own recursive caching resolver. So maybe I just shouldn't do that...
But DNSSEC uses all pre-computed signatures for the zone data. So if you can break the RSA key, you can create fake signatures ahead of time and serve bogus DNS data. Your botnet has got all the time in the world to try to break that key...
DNSSEC addresses this adversary, because it is a data integrity protocol. DNSCurve does not: it explicitly trusts the recursive resolver and offers NO security guarentees against this very serious adversary.
Okay, so where can I find a patch to make glibc's stub resolver verify DNSSEC signatures, so that I can be pretected from my recursive resolvers? DNSSEC has been around for nearly a decade: surely someone's implemented this by now?
If the firmware comes with a liberal license that says that anyone can distribute it, then no, you probably won't care, but if it doesn't, and you start handing around copies of it, then you'll care when their lawyers come knocking.
Good point. I completely agree with that: distros should make sure that all the firmware they're distributing at least comes with a "anyone may distribute this" license.
I don't suspect having such a requirement would even cause much of a flamewar.
I've always wondered why I, as a Freedom-loving-user, should prefer a device which has its non-free firmware embedded in a ROM or Flash chip rather than as a file on a CD or FTP server with my linux distribution.
Because, let's be clear: *where* the non-free firmware is being stored is usually the choice you have.
100% Free hardware would clearly be better, but there's precious little of that around...
So: why is it evil to have the firmware distributed on CD? Why should I care even one itsy-little-bit where it's stored?
Another day, another misuse of law to censor the web. Retail giant Lowe's is suing an irate customer over his use of trademarks and the word Lowe's in a url. A modified logo is now visible but no one should be mislead by something with a big scratchout and "You will be ripped off" written on it.
If you think the system is working, ask someone who's waiting for a prompt.
