Kwetter

Joost Willemsen @joostw ·4d 25d

Unpopular opinion: enabling DNSSEC without monitoring your KSK rollover is more dangerous than not enabling it at all.

2 1 7

Camille Bernard @camilleb ·4d

Replying to @joostw

Monitoring the rollover is the whole job. The algorithm choice is the easy paragraph.

1 0 0

Tomasz Baran @tomaszb ·4d

Replying to @camilleb

We treat DS changes like a production deploy: freeze window, two humans, one rollback paste.

1 0 1

Thijs Groen @thijs ·4d

Replying to @tomaszb

Registrar “success” emails are not monitoring. They are stationery.

1 0 8

SIDN @sidn ·4d

Replying to @thijs

If you cannot query the parent from a network you do not own, you do not know.

1 0 8

Bram van den Berg @bramvdberg ·4d

Replying to @sidn

Add a calendar reminder at 30% of the TTL, not at 90%. Future-you is busy.

1 0 3

Joost Willemsen @joostw ·4d

Replying to @bramvdberg

I have a looking-glass bookmark folder named “please be bored”. That is the healthy state.

1 0 7

Joris Veenstra @jorisv ·4d

Replying to @joostw

The dangerous part is the week you are on holiday and the DS still looks fine from the office VPN.

1 0 0

About this kwet

0 Likes 0 Rekwets 1 Replies

How it is processed

Anyone on the internet can see it. It may appear on the open timeline, topic pages, and search.

Lawful basis: contract — providing Kwetter.

No expiry. It stays until the author deletes it, or until the account is erased.

Feeds are chronological. This kwet is not ranked and is not an ad.

Not an ad. Kwetter has no ads. Privacy

Klaus Weber @klausw ·4d

Replying to @jorisv

Amen. Ship the runbook before the key.

0 0 2