TEteddyh·Oct 9, 2023
For moving DNSSEC-signed domains, there’s MUSIC: <https://github.com/DNSSEC-Provisioning/music>
In Review of the .nz DNSSEC Chain Validation Incident on 29-30 May 2023 [pdf]DNSSEC-Provisioning
music
Go2023–2023
DNSSEC-Provisioning / music
music
Multi-Signer Controller (MuSiC)
2Distinct people
4Mentions
1Explicit recommenders
6GitHub stars
What to know before exploring
What it is
Multi-Signer Controller (MuSiC)
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
One major problem with new security technology is that testing is generally created as the result of failure, rather than preceding the failure so that it doesn't occur in the…
belorn used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by week4 dated mentions
Observed mentions: 2023-05-30 00:01:36 UTC to 2023-10-09 08:14:59 UTC. Weeks start Monday, UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| May 29 | 2023-05-29 00:00:00 UTC | 2023-06-05 00:00:00 UTC | 3 | 0 | 3 |
| Jun 5 | 2023-06-05 00:00:00 UTC | 2023-06-12 00:00:00 UTC | 0 | 0 | 0 |
| Jun 12 | 2023-06-12 00:00:00 UTC | 2023-06-19 00:00:00 UTC | 0 | 0 | 0 |
| Jun 19 | 2023-06-19 00:00:00 UTC | 2023-06-26 00:00:00 UTC | 0 | 0 | 0 |
| Jun 26 | 2023-06-26 00:00:00 UTC | 2023-07-03 00:00:00 UTC | 0 | 0 | 0 |
| Jul 3 | 2023-07-03 00:00:00 UTC | 2023-07-10 00:00:00 UTC | 0 | 0 | 0 |
| Jul 10 | 2023-07-10 00:00:00 UTC | 2023-07-17 00:00:00 UTC | 0 | 0 | 0 |
| Jul 17 | 2023-07-17 00:00:00 UTC | 2023-07-24 00:00:00 UTC | 0 | 0 | 0 |
| Jul 24 | 2023-07-24 00:00:00 UTC | 2023-07-31 00:00:00 UTC | 0 | 0 | 0 |
| Jul 31 | 2023-07-31 00:00:00 UTC | 2023-08-07 00:00:00 UTC | 0 | 0 | 0 |
| Aug 7 | 2023-08-07 00:00:00 UTC | 2023-08-14 00:00:00 UTC | 0 | 0 | 0 |
| Aug 14 | 2023-08-14 00:00:00 UTC | 2023-08-21 00:00:00 UTC | 0 | 0 | 0 |
| Aug 21 | 2023-08-21 00:00:00 UTC | 2023-08-28 00:00:00 UTC | 0 | 0 | 0 |
| Aug 28 | 2023-08-28 00:00:00 UTC | 2023-09-04 00:00:00 UTC | 0 | 0 | 0 |
| Sep 4 | 2023-09-04 00:00:00 UTC | 2023-09-11 00:00:00 UTC | 0 | 0 | 0 |
| Sep 11 | 2023-09-11 00:00:00 UTC | 2023-09-18 00:00:00 UTC | 0 | 0 | 0 |
| Sep 18 | 2023-09-18 00:00:00 UTC | 2023-09-25 00:00:00 UTC | 0 | 0 | 0 |
| Sep 25 | 2023-09-25 00:00:00 UTC | 2023-10-02 00:00:00 UTC | 0 | 0 | 0 |
| Oct 2 | 2023-10-02 00:00:00 UTC | 2023-10-09 00:00:00 UTC | 0 | 0 | 0 |
| Oct 9 | 2023-10-09 00:00:00 UTC | 2023-10-16 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
4 sourcesOne major problem with new security technology is that testing is generally created as the result of failure, rather than preceding the failure so that it doesn't occur in the first place. Even very basic things like verifying that a new key actually fit the intended lock (ie, that a new key correspond to the published data) is a concept that people tend to implement only once they have had experienced a failure.
One general solution is to have standardized tools with standardized testing. Transferring a domain should always involve testing the old data, testing the old keys, testing the new data, testing the new keys, testing the chain of delegation, testing the chain of trust and so on. Some TLD's has gone as far as doing basic sanity test before a domain owner is allowed to transfer a domain. (industry term is to delegate a domain, sin
Read the rest
ce transfer is strictly about legal ownership)
Thankfully there are initiatives to create standard tools and standard test. Zonemaster (https://zonemaster.net) is one I recommend for testing, which is the result of a collaboration between .se and .fr. There is also initiatives for tooling that create multi-signing (https://github.com/DNSSEC-Provisioning/music), which is to have multiple keys operating for the same domain.
Redundancy in HSM's are nice, but redundancy is not a replacement for testing and backup procedures. It was one of the hard lessons learned by the IT industry, especially with data. No amount of RAID will save a company if a rogue script deletes all the files, or if the database becomes corrupt. A lot of experts learned the hard way that redundancy is mostly just a complement to sanity tests and backup procedures.
> Exhorting people to not screw up things like DNSSEC KSK rollover clearly hasn't worked, so the only real solution would be better ways to automatically recover from it.
No, the solution is to automate the rollovers, so that they can’t be screwed up by manual handling. <https://github.com/DNSSEC-Provisioning/music>
In DNSSEC failures are how you get people to disable DNSSECWhat the real problem probably is, is that all this is still being done by hand. It should be automated, and there is some work being done in that area: <https://github.com/DNSSEC-Provisioning/music>
In DNSSEC KSK rollover breaks DNS resolution for .nz domains