4 ms·
This is nuts. The only long term solution here is a distributed decentralized DNS service. When there's "default-trust" at some locations (browser CAs), There'
by anilgulecha 10y ago
This is nuts.
The only long term solution here is a distributed decentralized DNS service. When there's "default-trust" at some locations (browser CAs), There's weak-points in the security chain.
What are the best available dDNS solutions. Ideally these are initially backward compatible with redular DNS to help adoption, and then just disregard CAs.
- anilgulecha 10y agoOh and browser vendors, distrust WoSign now! Imagine your regular developer performing a npm install which pulls in code from a compromised MITMed github URL. That's straightforward rootkit compile and install access!
- thesimon 10y ago>Oh and browser vendors, distrust WoSign now! It's not like a lot happened to other authorities (a few pinky-promises)
- garaetjjte 10y agohttps://news.ycombinator.com/item?id=12382752 https://news.ycombinator.com/item?id=12382752
- sandstrom 10y agoSome disagree that this is a good solution, e.g. https://news.ycombinator.com/item?id=12383795 https://news.ycombinator.com/item?id=12383795