Why no DNSSEC requirements for seed nodes? (and why none on bitcoin.org)

[DaveF]

Was going to open an issue in github but figured I would post here in case it had been discussed before and I am having a Google / DuckDuckGo fail in search terms.
Was looking in chainparams.cpp for something and wondered how many seeds used dnssec, checked and the answer was 3 out of 9
Did a little more looking and bitcoin.org and bitcointalk.org don't use it either.

Yes I *know* it's a minor thing. But it does help in security.
I can see not having it here, but elsewhere come on. It's not that tough.

If you are going to run a seed node then I feel that should be requirement.
Any thoughts?

*full disclosure I don't have it on 99% of my own stuff so I am not one to really criticize but, I am not responsible for other peoples money either so there is that....

Either way, it's finally a nice weekend. If you need me I'll be outside....

-Dave

[1714681212]

1714681212

[1714681212]

1714681212

[1714681212]

1714681212

[1714681212]

1714681212

[NotATether]

Because of complexity perhaps? Managing HTTPS certificates, and getting them to work in the first place, is hard enough. I can't imagine how much more difficult manually creating and adding certificates to their nodes or other arbitrary software would be, unless bitcoin-seeder gets the functionality to do those things automatically merged, which is unlikely.

[DaveF]

Because of complexity perhaps? Managing HTTPS certificates, and getting them to work in the first place, is hard enough. I can't imagine how much more difficult manually creating and adding certificates to their nodes or other arbitrary software would be, unless bitcoin-seeder gets the functionality to do those things automatically merged, which is unlikely.

It's not the nodes it's the DNS for the nodes.
https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions

Just about every major DNS provider supports it.
If you want to host a seed node it just seems like a good piece of extra security to be sure that when someone looks up your address it really is you on the other side.


-Dave

[ABCbits]

Was going to open an issue in github but figured I would post here in case it had been discussed before and I am having a Google / DuckDuckGo fail in search terms.

Here are some discussion about or mention DNSSEC,

ops: Enable DNSSEC on all Bitcoin DNS Seed domain names
p2p: monoculture of DNS seeder software
Is EFF's proposed Sovereign Key system similar to how Namecoin/Bitcoin works?

Looks like some people think DNSSEC doesn't have big impact and prefer seed diversity.

[DaveF]

Looks like some people think DNSSEC doesn't have big impact and prefer seed diversity.

  So instead of being sure that the node your are connecting to is the actual node not one that was forged by a DNS attack nobody outside of 3 people want to put in the effort.

:sigh: sometimes some really smart people can make silly decisions.

Will leave this thread open for a bit see if anyone else chimes in.

-Dave