In 2023 operations for the .GOV TLD transitioned from Verisign to Cloudflare(indico.dns-oarc.net) |
In 2023 operations for the .GOV TLD transitioned from Verisign to Cloudflare(indico.dns-oarc.net) |
https://indico.dns-oarc.net/event/48/contributions/1038/atta...
https://news.ycombinator.com/item?id=34403055 - Verisign Loses Prestige .Gov Contract to Cloudflare (2023-01-16)
If I remember correctly, there was a certain LEA which approached an US ISP for an informal surveillance request, they refused, and the LEA retaliated by cancelling their contract. I’m failing to find it, so I’d be happy if someone can provide a source.
https://en.wikipedia.org/wiki/Qwest#Refusal_of_NSA_surveilla...
Agencies would have to contract with Cloudflare separately to use the CDN, and each contract is a separate competition where a different part of the government using Cloudflare for a different service would not be considered when reviewing bids.
This changes:
- Registry,
- Name Server and
- DNSEC
More details here:
https://indico.dns-oarc.net/event/48/contributions/1038/atta...
Some people only learn what they want to or need to learn, the bare minimum.
They're the registry, not the registrar. CISA is the registrar for .gov domains, Cloudflare just handles the backend. (DNS and whois infrastructure)
Government employees likely never see anything about Cloudflare at all when they manage the DNS settings for domains, just like I never see anything about Charleston Road Registry (Google subsidiary) when I manage a .dev domain on Name.com.
> push their Anti DDoS stuff on a captive audience
How is this a captive audience? Are you implying Cloudflare won't allow .gov domains to use non-cloudflare nameservers?
This is a very provocative way to spin “selling the CDN services customers are buying”. What reason do we have to think anyone is an unwilling party to that transaction?
Nearly all traffic (in terms of volume) gets swallowed by CloudFlare and never approaches most instances: DDoS attacks swallowed whole, WAF rules block illegitimate traffic (which is, in most cases, the vast majority of traffic to dynamic endpoints or, frequently, non-existent endpoints, if you've ever tailed webserver logs), and Cloudflare-caching handles most of the remainder for static and cacheable files -- leaving those servers with a mostly-sanitized and far lower volume of traffic. If you're using edge workers, even less traffic hits your servers.
But, yes, out of the remaining traffic that enters AWS/GCP/Azure's network, they certainly can see what's happening on those machines if they care to look.
Not everything -should- be easy.
For example I designed a system at a previous company that used Shamir's Secret Sharing to protect a very very important root key. We used an intermediate of this key for most operations but it came time to rotate it and folks were surprised by the ceremony involved in doing so.
i.e the root key was decrypted using X of N members of the SSS group, a new intermediate generated and the special NUC that was designed for this purpose returned to it's safe (which was also using a Yubikey as like a mini-HSM too).
Those keys protected very important PII and I deemed this the minimum necessary friction, ideally I would have went further if that was tenable.
Some things really should be hard and that hardness should be proportional to how horrible the implications of someone unauthorized doing that thing.
the entirety of .nz probably wouldn't agree with you when they had a 2 day outage due to a slight DNSSEC misconfiguration
at best that means there's more need for practice, testing, better processes, and so on. it does not mean everything should be easy. (especially changes to a critical name authority.)
there's an argument that maybe .nz needs to spend more on this, delegate this, or accept a decreased security assurance, but that's definitely not true in general.
they made a small mistake, and .nz was down for 2 days as a result
of course the 95% of people that have competent ISPs that don't verify DNSSEC records were completely unaffected
there's a reason ALL major tech companies refuse to deploy it for their zones
> and .nz was down for 2 days as a result
so it was not a small mistake
yes, the same thing happens when people start using technology that actually verifies what it reads/writes. ie. btrfs, ZFS, ECC, etc. and turns out disks fail, bits rots, etc. it was just unnoticed.