8 ms·

> there's probably a lot of stuff going on behind the scenes which is proprietary. There really shouldn't be, though. I set up a CA for a large company way ba

by apathy 19y ago

> there's probably a lot of stuff going on behind the scenes which is proprietary. There really shouldn't be, though. I set up a CA for a large company way back in 1998 and while it was a pain in the ass, it wasn't something that a novice Perl hacker couldn't get to run smoothly. (This was before Microsoft fucked everything up by not allowing people to import trusted root CA certs into their own browsers, hence the exorbitant $85K fee to do today what I did for free then) It just isn't that hard to maintain the CRLs and a CA with a proper chain. It's an issue of trust like anything else, which is why I brought up the difficulty of determining whether you trust eg. NSI or Thawte. If you think DNS is easy, I think you should try and get a tld delegated to you. Then sit through some ddos attacks on your tld's root servers and see how easy you think that is. Consider that DNS is meant to be more or less contstantly available, while a cert chain only needs to be checked periodically (and the CRL on cert load). Neither is earthshatteringly hard, neither is easy, they just are. Both rely on standard protocols with extensive documentation.

DanielBMarkham 19y ago
Yeah I got your point about a tld. But I don't think the equivalent for root CAs are something like "man-in-the-middle" attacks. Seems it would be much more political in nature -- ie, something like "next year you guys have to all learn Klingon, wear the same clothes, juggle at least 4 hours a week, and then put up a million in escrow to reduce our risk" After all, it's a trust game, right? So if you're one of the few people running root CAs, you're going to make it really, really difficult to be able to trust other people at your level -- for the benefit of the users, obviously </sarcasm> As we both know, setting up just any old kind of CA isn't the toughest thing in the world to do. It's getting accepted by the community and making the certificates into something useful that's going to be a pain.

by apathy 19y ago

DanielBMarkham 19y ago

Yeah I got your point about a tld. But I don't think the equivalent for root CAs are something like "man-in-the-middle" attacks. Seems it would be much more political in nature -- ie, something like "next year you guys have to all learn Klingon, wear the same clothes, juggle at least 4 hours a week, and then put up a million in escrow to reduce our risk" After all, it's a trust game, right? So if you're one of the few people running root CAs, you're going to make it really, really difficult to be able to trust other people at your level -- for the benefit of the users, obviously </sarcasm> As we both know, setting up just any old kind of CA isn't the toughest thing in the world to do. It's getting accepted by the community and making the certificates into something useful that's going to be a pain.