anchor.diff:                return (result);
               }
           aside
  -                  
         
         section(data-bespoke-state='solution-slide')
           h2.full-slide
             | Avoid
             br
             | Complexity
  +        aside
  +          ul
  +            li This is all really complicated
  +            li You think it's hard to follow, imagine trying to explain it
  +            li DNS is a complicated system
  +            li BIND tries to support all of it in every case all the time though
  +            li 137 RFCs listed on their site, as their 'spec'. Plus workarounds, patches, their own features, etc
  +            li TSIG and TKEY are not important features in many cases.
  +            li Support for Windows 2000 sending you updates even less so (~0.01% market share, end of life 5 years ago)
  +            li Complexity makes things like this hard to remove
  +            li Should all definitely be disablable, probably external plugins
  +            li 
  +            li Generally smacks of control plane/data plane confusion
  +            li Cloudflare DNS proxy solves, interestingly: doesn't allow updates.
  +            li Why on earth would you tie updates to the core structure of the internet directly to the most basic lookup operation of the entire internet?
  +            li 
  +            li Found by fuzzer by security researcher
  +            li Could've been absolutely catastophic
  +            li 
  +            li Prefer systems that are implemented and structured simply internally
  +            li Aim for that too, whether you're building your own or major tool code
  +            li Prefer systems that do what you need, and no more
  +            li Less is more
   
         section(data-bespoke-state='topic-slide')
           h4 Nothing is really secure, but
  
positive.code:             s2n(payload, bp);
              memcpy(bp, pl, payload);
          aside
  
        section(data-bespoke-state='topic-slide') 
          h2 The also-rans:
  
negative.code:                   return (result);
              }
          aside
            ul
              li This is the TKEY query processing implementation
              li Takes a request for a key, tries to find the key, sends a response back with it, if you're allowed it
              li It's quite complicated. It's also broken
              li How would you start trying to audit this? Any idea where the catastrophic bug is?
  
        section
          pre(style='font-size: 80%; width: 100%; margin: 0')
  