4 ms·

This is a load of ... You can't descentralize the web for 2 reasons: DNS and SSL. And then you have the IP organisation, the name escapes me right now.

by pbalau 8y ago

peterwwillis 8y ago
Both DNS and TLS PKI (nothing uses SSL) are decentralized by design.
- pbalau 8y ago
  Who decides I can or cannot get foobar.tld?
  - Tecuane 8y ago
    That would probably be ICANN[1], and most authoritative name servers follow the policies set out there as the guiding committee is part of ICANN[2]. There are alternative DNS roots, though. I participated in running one myself for a time. 1. https://en.wikipedia.org/wiki/ICANN https://en.wikipedia.org/wiki/ICANN 2. https://en.wikipedia.org/wiki/Root_name_server#Root_server_supervision https://en.wikipedia.org/wiki/Root_name_server#Root_server_s...
    - pbalau 8y ago
      Thanks, I was thinking about ICANN, but i'm a bit tipsy and didn't want to discredit my point by misspelling an organization. Yet, this still proves my point, the internet, as we are experiencing it today, is based on different orgs simply playing nice by some rules established by a central authority. What if they stop doing that? What if the central auth is going to have something against you?
  - amiga-workbench 8y ago
    You are perfectly free to run your own nameserver, nobody has to use it though.
    - troquerre 8y ago
      This means that in practice, DNS is not decentralized.
    - pbalau 8y ago
      Yes I can run my own top level dns. Yes, people can chose to use my dns or they can chose to use the google one. The question is why would they do either, why would they pick mine over the google one, or the google one, over mine. You can argue that the google dns can sign the answer with a cert you trust, thus you know you got the right answer. And then, when you get the address of the service you want to talk to, you can check their cert and know for sure you are again talking to the thing you want to talk to. And here lies the problem, how are you going to check those certs? Are you going to queue at a google office and obtain a cert on a usb stick, then import that in you environment, then do the same for all other services you want to talk to? Or are you going to trust a central authority? What if this central authority is messing with you? What if someone up the chain is messing with your central? Let's not talk about how your router might send your dns request to some guy's home server that answers to 8.8.8.8, instead of google and you can't do shit about it... Everything we know about internet works the way it works, because everybody involved agrees to do the right thing, from ip routing, to dns resolving, to certs verifying. All of this is based on a set of rules set by a central authority, that everybody choses to follow. You can't speak about web decentralization as long as proving who you are is a very centralized system.
- troquerre 8y ago
  DNS at the root level is not decentralized. .com, .io, .net etc are centralized and even owned by for-profit companies.
  - sparkie 8y ago
    Also DNSSEC requires a trusted root signature, I'd hardly consider that decentralized. (But they have a key signing ceremony, so we can trust that it is secure.)
kjetilk 8y ago
Oh, but that's more a matter of where you start and what you bootstrap. In both cases, DNS and TLS CA-based stuff is about trust. You need to trust the DNS server, as there could be malicious servers sneaking in, and you need to trust the cert. But once you have a social network with a large strong set, you could base the trust on the strong set, and in particular, individuals in that strong set who can demonstrate that they have a clue. Once we have that, we can get rid of these achilles heels, but quite frankly, I don't believe in a strategy that takes on those problems first. Sure, I obviously got OpenNIC in my DNS resolution. Haven't once seen an address that required me to use it beyond when I set it up. I think our approach is much better. Base it on people and the strongest part of their network.
troquerre 8y ago
There are projects aiming to decentralize DNS and SSL as well. Handshake[1] decentralizes root DNS and enforces ownership through public-key cryptography. This gets rid of the need for Certificate Authorities which decentralizes both DNS and SSL in one go. Disclaimer: building a registrar[2] for Handshake so we're pretty excited about it! [1] https://handshake.org/ https://handshake.org/ [2] https://namebase.io https://namebase.io

This is a load of ... You can't descentralize the web for 2 reasons: DNS and SSL. And then you have the IP organisation, the name escapes me right now.

by pbalau 8y ago

This is a load of ... You can't descentralize the web for 2 reasons: DNS and SSL. And then you have the IP organisation, the name escapes me right now.

peterwwillis 8y ago

Both DNS and TLS PKI (nothing uses SSL) are decentralized by design.

pbalau 8y ago
Who decides I can or cannot get foobar.tld?
- Tecuane 8y ago
  That would probably be ICANN[1], and most authoritative name servers follow the policies set out there as the guiding committee is part of ICANN[2]. There are alternative DNS roots, though. I participated in running one myself for a time. 1. https://en.wikipedia.org/wiki/ICANN https://en.wikipedia.org/wiki/ICANN 2. https://en.wikipedia.org/wiki/Root_name_server#Root_server_supervision https://en.wikipedia.org/wiki/Root_name_server#Root_server_s...
  - pbalau 8y ago
    Thanks, I was thinking about ICANN, but i'm a bit tipsy and didn't want to discredit my point by misspelling an organization. Yet, this still proves my point, the internet, as we are experiencing it today, is based on different orgs simply playing nice by some rules established by a central authority. What if they stop doing that? What if the central auth is going to have something against you?
- amiga-workbench 8y ago
  You are perfectly free to run your own nameserver, nobody has to use it though.
  - troquerre 8y ago
    This means that in practice, DNS is not decentralized.
  - pbalau 8y ago
    Yes I can run my own top level dns. Yes, people can chose to use my dns or they can chose to use the google one. The question is why would they do either, why would they pick mine over the google one, or the google one, over mine. You can argue that the google dns can sign the answer with a cert you trust, thus you know you got the right answer. And then, when you get the address of the service you want to talk to, you can check their cert and know for sure you are again talking to the thing you want to talk to. And here lies the problem, how are you going to check those certs? Are you going to queue at a google office and obtain a cert on a usb stick, then import that in you environment, then do the same for all other services you want to talk to? Or are you going to trust a central authority? What if this central authority is messing with you? What if someone up the chain is messing with your central? Let's not talk about how your router might send your dns request to some guy's home server that answers to 8.8.8.8, instead of google and you can't do shit about it... Everything we know about internet works the way it works, because everybody involved agrees to do the right thing, from ip routing, to dns resolving, to certs verifying. All of this is based on a set of rules set by a central authority, that everybody choses to follow. You can't speak about web decentralization as long as proving who you are is a very centralized system.
troquerre 8y ago
DNS at the root level is not decentralized. .com, .io, .net etc are centralized and even owned by for-profit companies.
- sparkie 8y ago
  Also DNSSEC requires a trusted root signature, I'd hardly consider that decentralized. (But they have a key signing ceremony, so we can trust that it is secure.)

kjetilk 8y ago

Oh, but that's more a matter of where you start and what you bootstrap. In both cases, DNS and TLS CA-based stuff is about trust. You need to trust the DNS server, as there could be malicious servers sneaking in, and you need to trust the cert. But once you have a social network with a large strong set, you could base the trust on the strong set, and in particular, individuals in that strong set who can demonstrate that they have a clue. Once we have that, we can get rid of these achilles heels, but quite frankly, I don't believe in a strategy that takes on those problems first. Sure, I obviously got OpenNIC in my DNS resolution. Haven't once seen an address that required me to use it beyond when I set it up. I think our approach is much better. Base it on people and the strongest part of their network.

troquerre 8y ago

There are projects aiming to decentralize DNS and SSL as well. Handshake[1] decentralizes root DNS and enforces ownership through public-key cryptography. This gets rid of the need for Certificate Authorities which decentralizes both DNS and SSL in one go. Disclaimer: building a registrar[2] for Handshake so we're pretty excited about it! [1] https://handshake.org/ https://handshake.org/ [2] https://namebase.io https://namebase.io