Hacker News: olegarchhttps://news.ycombinator.com/user?id=olegarchHacker News RSShttps://hnrss.org/hnrss v2.1.1Sun, 08 Nov 2026 16:28:04 +0000<![CDATA[New comment by olegarch in "Encrypted traffic interception on Hetzner and Linode targeting Jabber service"]]>Using DANE or so (RRs CAA/TLSA) can help in this case (when provider route traffic to specific port), but does not solve the problem completely. If DNS record will be compromised, then hacker can setup "correct" TLSA/CAA record to trust his fake certificate. As result, problem can be solved, if we will have reliable DNS subsystem, where is impossible to compromise DNS provider or infrastructure.

I think, emerDNS can be used in such critical application: https://emercoin.com/en/documentation/blockchain-services/em...

]]>Sat, 21 Oct 2023 14:59:54 +0000https://news.ycombinator.com/item?id=37967343olegarchhttps://news.ycombinator.com/item?id=37967343https://news.ycombinator.com/item?id=37967343