4 ms·

SSL certificates have their own issues, typically rooted in a centralized authorities dropping the ball or intentionally issuing fraudulent certificates https:

SSL certificates have their own issues, typically rooted in a centralized authorities dropping the ball or intentionally issuing fraudulent certificates https://www.eff.org/deeplinks/2011/04/unqualified-names-ssl-observatory https://www.eff.org/deeplinks/2011/04/unqualified-names-ssl-... https://security.googleblog.com/2013/12/further-improving-digital-certificate.html https://security.googleblog.com/2013/12/further-improving-di... Vapor also addresses decentralization in distribution of content as well. I'm extremely skeptical of Vapor for other reasons, but we ought to at least keep the value proposition clear here.

X6S1x6Okd1st 6y ago
SSL certs can be self signed. Bitcoin addresses are not signed by any agency so they would work under a similar security model as a self signed cert. > Vapor also addresses decentralization in distribution of content as well. How? All I see some way of performing a replay or amplification attack using an unspecified gateway.
- jdonaldson 6y ago
  These are just the details I gleaned from the article. But, I have a similar understanding... that the blockchain functionality is similar to self-signing. The article bills Vapor as helping to decentralize the "data layer" of an api. This naturally has some immediate caveats... like... this sort of framework would not be suitable for real time or streaming Apis. Also, the article doesn't really touch on the cost of maintaining all of this. It's true that vapor api hosts can charge a small transaction fee to maintain/run their processing nodes. I have to wonder what that looks like, and if people are willing to pay a per-request fee for an http transaction. I don't believe this is intended to replace standard authentication, and calling out how it's impractical for common scenarios is fair game. However, I think it's more interesting to think about scenarios where this might be useful.
  - X6S1x6Okd1st 6y ago
    > However, I think it's more interesting to think about scenarios where this might be useful. Such as?
    - jdonaldson 6y ago
      Well, the scenario would involve distributing information where one couldn't/shouldn't rely on a central authority. Imagine using this to coordinate protests against a government, or in countries where there's too much corruption to trust any centralization at all.
      - X6S1x6Okd1st 6y ago
        By my reading wrapping an HTTP request inside a bitcoin transaction does not solve for that use case. Something like IPFS pubsub could work, or you could use any of the on-chain social networks that have sprung up, or you could use E2E group chats like everyone from the Taliban to activists in the US use.
        jdonaldson 6y ago
        E2E group chats are closely related, but ephemeral. IPFS seems also closely related, but it's dealing more with the content of a file, and not really designed for handling the identity of who wrote or distributed the content.
chundicus 6y ago
does Vapor solve any of the issues with SSL? I'm genuinely asking because I can't see that it does

X6S1x6Okd1st 6y ago

SSL certs can be self signed. Bitcoin addresses are not signed by any agency so they would work under a similar security model as a self signed cert. > Vapor also addresses decentralization in distribution of content as well. How? All I see some way of performing a replay or amplification attack using an unspecified gateway.

jdonaldson 6y ago
These are just the details I gleaned from the article. But, I have a similar understanding... that the blockchain functionality is similar to self-signing. The article bills Vapor as helping to decentralize the "data layer" of an api. This naturally has some immediate caveats... like... this sort of framework would not be suitable for real time or streaming Apis. Also, the article doesn't really touch on the cost of maintaining all of this. It's true that vapor api hosts can charge a small transaction fee to maintain/run their processing nodes. I have to wonder what that looks like, and if people are willing to pay a per-request fee for an http transaction. I don't believe this is intended to replace standard authentication, and calling out how it's impractical for common scenarios is fair game. However, I think it's more interesting to think about scenarios where this might be useful.
- X6S1x6Okd1st 6y ago
  > However, I think it's more interesting to think about scenarios where this might be useful. Such as?
  - jdonaldson 6y ago
    Well, the scenario would involve distributing information where one couldn't/shouldn't rely on a central authority. Imagine using this to coordinate protests against a government, or in countries where there's too much corruption to trust any centralization at all.
    - X6S1x6Okd1st 6y ago
      By my reading wrapping an HTTP request inside a bitcoin transaction does not solve for that use case. Something like IPFS pubsub could work, or you could use any of the on-chain social networks that have sprung up, or you could use E2E group chats like everyone from the Taliban to activists in the US use.
      - jdonaldson 6y ago
        E2E group chats are closely related, but ephemeral. IPFS seems also closely related, but it's dealing more with the content of a file, and not really designed for handling the identity of who wrote or distributed the content.

chundicus 6y ago

does Vapor solve any of the issues with SSL? I'm genuinely asking because I can't see that it does