Not everything is connected to the grid, you know.
Here's an example of a single hydro dam a LONG way from the grid which (pre-Cryptocurrency gold rush) had 12 MW of unused power generation capacity plus they were talking up the possibility of adding an additional 20 MW of generation.
Obviously some resolvers are misconfigured and a depressingly large number of production DNS servers around the internet will be running remarkably outdated software that couldn't handle the KSK rollover via the RFC 5011 method properly (though how many of these actually have DNSSEC enabled is an open question). For example, I've heard of resolvers breaking because they mishandled the transition and replaced KSK-2010 with KSK-2017 as soon as they got it.
I saw the postponement late last night, and my immediate but completely untested pet theory is that the reason they're getting so many 'broken' resolvers running such new software (RFC 8145 was published in April 2017, unbound 1.6.4 was released June 27, 2017) is short-lived container instances that only have the old root trust anchor reporting in before they've had a chance to obtain the new KSK - if they even stay up long enough to get it.
From the root-dnssec-announce mailing list, it sounds like more information is due Friday:
"Duane Wessels started the research on this and has done a great job. He's presenting it at DNS-OARC in San Jose on Friday."
Of course, the chances are that no small number of apps you might be tempted to restrict will promptly crash since they'll assume that having asked for the permission up front means they'll get whatever data they want when they ask for it.
When someone at my office spotted this story earlier in the day, a bunch of us quickly ran around playing with an android app (which doesn't have permissions to phone home and censors out some of the data) to see what info we could pull off our cards.
Name, number, and expiry are readily available. We figured you could probably replay that data to get some free gas with stolen credentials... but the scanning range with phones is more akin to "hold the card up against it for several seconds to read" than "walk through a crowded room".
High performance DNS software can handle well over 100k QPS on a single core on commodity hardware, but that's not an apples to apples comparison since the benchmarks I'm remembering didn't include any weighting or geo-distribution special sauce.
Here's an example of a single hydro dam a LONG way from the grid which (pre-Cryptocurrency gold rush) had 12 MW of unused power generation capacity plus they were talking up the possibility of adding an additional 20 MW of generation.
https://www.hydroreview.com/business-finance/boralex-acquire...
It's not going to be the only one.