4 ms·

OK, so let's continue this trend and we end-up trusting just one. So we concentrate the entire internet power into just one hand. Because it's such a good idea,

OK, so let's continue this trend and we end-up trusting just one. So we concentrate the entire internet power into just one hand. Because it's such a good idea, right?

gowld 6y ago
Are 2 evil hands better than 1? What's needed are more good hands.
- unnouinceput 6y ago
  There are no good hands. Governments are slow to catch up but they do eventually. So they did catch up with technology and understanding that internet is freedom. Our freedom was these 25 years we had from 95', when proliferation of internet started up to today. Lockdown even more showed they need tight control over our freedom. Unfortunately the future is splinternet, where each country has its own grip on this new media medium called internet, same as they do through regulation over TV and radio.
t0astbread 6y ago
Well, the situation now is you trust 300 CAs and use one (figuratively). Apart from that, these are root CAs meaning any single one of them could compromise every TLS connection, right? So increasing the number of root CAs doesn't divide their power.
TheRealPomax 6y ago
Why? Just because there is a slippery slope argument to be made doesn't mean we have to actually do what it says needs to be done to get to its theoretical end point. Sure, we _could_ remove everything until there's one left, but why would we? If you just want a smaller, publicly vetted list of roots that you can trust because the org that curates that set is explicitly on a mission to keep the internet free, open, and safe for all, then there is no "next step", this is the first and also last one. Is it a good idea to do this? Highly depends on what you do and what you need, but the idea that "we can just keep doing this until there's only one" is super flaky: how many more sets of root certs, vetted by orgs that can be trusted to have privacy and security in mind, are there? Because no org that fits that bill will have a list that is "just the one". There's going to be 100+ certs in their lists.
- unnouinceput 6y ago
  In case you missed, my comment was a sarcasm
  - TheRealPomax 6y ago
    There is no anonymous sarcasm on the internet, unless you tell people up front. If not, there's only text at face value.

OK, so let's continue this trend and we end-up trusting just one. So we concentrate the entire internet power into just one hand. Because it's such a good idea, right?

gowld 6y ago

Are 2 evil hands better than 1? What's needed are more good hands.

unnouinceput 6y ago
There are no good hands. Governments are slow to catch up but they do eventually. So they did catch up with technology and understanding that internet is freedom. Our freedom was these 25 years we had from 95', when proliferation of internet started up to today. Lockdown even more showed they need tight control over our freedom. Unfortunately the future is splinternet, where each country has its own grip on this new media medium called internet, same as they do through regulation over TV and radio.

t0astbread 6y ago

Well, the situation now is you trust 300 CAs and use one (figuratively). Apart from that, these are root CAs meaning any single one of them could compromise every TLS connection, right? So increasing the number of root CAs doesn't divide their power.

TheRealPomax 6y ago

Why? Just because there is a slippery slope argument to be made doesn't mean we have to actually do what it says needs to be done to get to its theoretical end point. Sure, we _could_ remove everything until there's one left, but why would we? If you just want a smaller, publicly vetted list of roots that you can trust because the org that curates that set is explicitly on a mission to keep the internet free, open, and safe for all, then there is no "next step", this is the first and also last one. Is it a good idea to do this? Highly depends on what you do and what you need, but the idea that "we can just keep doing this until there's only one" is super flaky: how many more sets of root certs, vetted by orgs that can be trusted to have privacy and security in mind, are there? Because no org that fits that bill will have a list that is "just the one". There's going to be 100+ certs in their lists.

unnouinceput 6y ago
In case you missed, my comment was a sarcasm
- TheRealPomax 6y ago
  There is no anonymous sarcasm on the internet, unless you tell people up front. If not, there's only text at face value.