Root KSK Ceremony 41

www.iana.org/dnssec/ceremonie...
The Root Key Signing Ceremonies are public events where technical experts from around the world converge every three months to use the private key that secures the DNS, and to ensure it is not compromised.

[@fehminjima]

some one in hollywood must make a movie called "the internet job" about a heist of the internet key
that will make this ceremoney more known worldwide

[@Kriae]

they'll make up stuff to make it more h4ck3ry and it's gonna be terrible

[@PitOVader]

+1

[@Zeragamba]

Greeting from some TH-camr that's obsessed with bricks

[@programagor]

Good job everyone, a truly exceptional ceremony.

[@linkdude64]

Second!

[@jenslumbye7996]

1:15:00 Are they running telnet?

[@cryptearth]

well - I missed it cause I was on limited mobile data and only back on regular broadband again right now
aside from politics we now see that the only solution to just sign two additional keys is not the right answer to the current world wide catastrophe
so, although I know why both facilities had to be based in the US, this was changed back in 2016 - so as RIPE already requested back then another non-us based facility (maybe even along with another non-us root zone maintainer - oh wait, there's already one: RIPE) has to be established
from afaik the last "official" reply to this question was just "yea, too expensive and just infeasible organization wise - we just can't fly around all the staff around teh world" (well - I don't know if there's a list about all staff members - but is just any single one of them not us-based? - if all live in the US this also has to change!)
TLDR: it's pretty much U-EFI: it's supposed to be an open standard - but to make it work only keys from Microsoft are used - and the linux community had to get the "shim-loader" (some short code signed by M$ to complete get rid off all that crypto - basically equivalent to not using crypto at all)
this whole "centralized PKI-based crypto" has to change - Covid-19 won't be the last world wide catastrophe challenging the current infrastructure in place - and the only idea all those crypto experts came up with was "just sign two additional keys" - which doesn't even make sense as the keys are not bound to any date unlike X.509 certs