5 ms·

Competition is always good. For one, a completely decoupled and separately managed system on a different stack would improve availability of ACME-based certific

Competition is always good. For one, a completely decoupled and separately managed system on a different stack would improve availability of ACME-based certificates. It would also reduce the concentration of trust in one entity. While LE is awesome, the target on their back is only getting bigger. For what it's worth, I'm pretty sure even Let's Encrypt wants to see competitors to Let's Encrypt.

progval 7y ago
> It would also reduce the concentration of trust in one entity. No it wouldn't. If there are 9999 CAs, you need to trust every single one of them. A better argument for having multiple CAs is that it would increase resilience (against takedowns, bugs, money running out, etc.)
- ryacko 7y ago
  Convergence was a project to have multiple notaries to vouch for a TLS certificate instead of a chain of CAs. There are way to decentralize the internet, but there never will be much interest for it.
  - auslander 7y ago
    Extremely funny video by Moxie Marlinspike about it: https://m.youtube.com/watch?v=Z7Wl2FW2TcA https://m.youtube.com/watch?v=Z7Wl2FW2TcA
    - ryacko 7y ago
      Thanks, in some twist of irony, I’ve mistaken Convergence for Perspectives.
- mmalone 7y ago
  I think you’re interpreting my comment about trust too literally. If you’re talking about “Web PKI root of trust” trust then yes, having two CAs just means you’re trusting two third parties without reducing trust in either. I was using the term more broadly and more narrowly... like, trusting them to be good stewards, trusting them with PII, and trusting them to not configure their DNS resolvers to use NSA-controlled DNS. They have more power and more control and become a more attractive target and more susceptible to corruption because the stakes are higher. Maybe I should have said “concentration of control”. If one CA owns 90% of issuances they’ll be able to push their agenda, for sure. To be clear, all of the evidence shows that LE uses this power only for good. But that’s the threat. 30% market share is probably fine. 90% or 100% would be scary.
- deleted 7y ago
  [deleted]
zepearl 7y ago
I agree => small question: in this context wouldn't "diversification" be more appropriate than "competition"?
- jecxjo 7y ago
  In this context I think they are the same.
falcongod082 7y ago
If you're working for profit, competition is awful. If you're not working for profit competition may or may not be good. Regardless, how you personally feel about competition isn't relevant here.

progval 7y ago

> It would also reduce the concentration of trust in one entity. No it wouldn't. If there are 9999 CAs, you need to trust every single one of them. A better argument for having multiple CAs is that it would increase resilience (against takedowns, bugs, money running out, etc.)

ryacko 7y ago
Convergence was a project to have multiple notaries to vouch for a TLS certificate instead of a chain of CAs. There are way to decentralize the internet, but there never will be much interest for it.
- auslander 7y ago
  Extremely funny video by Moxie Marlinspike about it: https://m.youtube.com/watch?v=Z7Wl2FW2TcA https://m.youtube.com/watch?v=Z7Wl2FW2TcA
  - ryacko 7y ago
    Thanks, in some twist of irony, I’ve mistaken Convergence for Perspectives.
mmalone 7y ago
I think you’re interpreting my comment about trust too literally. If you’re talking about “Web PKI root of trust” trust then yes, having two CAs just means you’re trusting two third parties without reducing trust in either. I was using the term more broadly and more narrowly... like, trusting them to be good stewards, trusting them with PII, and trusting them to not configure their DNS resolvers to use NSA-controlled DNS. They have more power and more control and become a more attractive target and more susceptible to corruption because the stakes are higher. Maybe I should have said “concentration of control”. If one CA owns 90% of issuances they’ll be able to push their agenda, for sure. To be clear, all of the evidence shows that LE uses this power only for good. But that’s the threat. 30% market share is probably fine. 90% or 100% would be scary.
deleted 7y ago
[deleted]

zepearl 7y ago

I agree => small question: in this context wouldn't "diversification" be more appropriate than "competition"?

jecxjo 7y ago
In this context I think they are the same.

falcongod082 7y ago

If you're working for profit, competition is awful. If you're not working for profit competition may or may not be good. Regardless, how you personally feel about competition isn't relevant here.