HackerTrans
TopNewTrendsCommentsPastAskShowJobs

some_bird

no profile record

comments

some_bird
·vor 6 Monaten·discuss
Ah yes, Kessler's space shredder, something to be feared by all satellites!

It appears that we are very close to an unstoppable runaway process of collisions in space. On one hand, nice that we prevent rich guys from running away to other planets after ruining this one. On the other hand, a lot of services require GPS, it would be chaos if that were to disappear...
some_bird
·vor 8 Monaten·discuss
But you don't need the transparency! The whole transparency thing was added because we have hundreds of Certificate Authorities all over the world who would otherwise have the power to secretly sign a cert for your website without anyone ever knowing.

And if you DO need the extra monitoring, all it takes is periodically retrieving the DNS record and send an alert if it changes. (There is no certificate that needs periodical rotation, you only need to renew the keypair if the server is compromised.)
some_bird
·vor 9 Monaten·discuss
We could also just get rid of webPKI entirely?

But you still need a public key for TLS? Well, just put it in DNS!

And assuming your DNS responses are validated by DNSSEC, it would be even more secure too. You'd be closing a whole lot of attack vectors: from IP hijacks and server-side AitM to CA compromises. In fact, you would no longer need to use CA's in the first place. The chain of trust goes directly from your registrar to your webserver with no third party in between anymore. (And if your registrar or webserver is hacked, you'd have bigger problems...)
some_bird
·vor 9 Monaten·discuss
We already knew that the poorer countries are impacted worse by the IPv4 shortages. CG-NAT didn't solve anything but only delayed long enough to do even more damage. Now these already poor countries also have to do CG-NAT, which is very expensive. They cannot afford this.

I guess that a poor country could go with only IPv6? Local services would be IPv6-only as well and most popular services already have IPv6. And everyone else would have to make this switch eventually, so there'd be benefits...