5 ms·

It's not without drawbacks, but TLS gives almost everyone good security/privacy by default. And for those who really need it, anyone who does even a basic amoun

It's not without drawbacks, but TLS gives almost everyone good security/privacy by default. And for those who really need it, anyone who does even a basic amount of research can gain very good levels of confidence in the privacy of their TLS setup. Also, there are degrees of federation. It doesn't have to be a wild wild west of the sort we see with projects like Mastodon. A closed federation can have strict rules on who can participate, can enforce constraints on auditing and rapid updates, and so on, and still be a federation. In fact, we see some of this in TLS - not everyone can participate, but there are dozens of independent organizations working within an internal governance models. Another example is EFnet, which is a federated chat network which has regulations on who can participate: http://www.efnet.org/?module=docs&doc=16 http://www.efnet.org/?module=docs&doc=16 Moxie conveniently ignores all of this because it serves his interests to be ignorant of it. It has been repeatedly brought to his attention. Moreover, he has put out legal threats to any project which tries to fork Signal to research these features.

tialaramex 5y ago
> In fact, we see some of this in TLS - not everyone can participate, but there are dozens of independent organizations working within an internal governance models I think what's happened here is that you don't understand the difference between TLS, a network protocol, and the Web PKI, a Public Key Infrastructure and so you've sort of muddled both together, which is revealing on its own. You've also imagined a fairytale outcome that doesn't match reality. Moxie's strategy works and yours didn't, and you're here telling everybody you don't agree but reality doesn't care whether you agree with it or not.
- ddevault 5y ago
  >I think what's happened here is that you don't understand the difference between TLS, a network protocol, and the Web PKI, a Public Key Infrastructure and so you've sort of muddled both together, which is revealing on its own. I understand the difference, and the condescending snark is not appreciated. I don't think the difference is very important in this case. It's also revealing, perhaps, that you don't understand that the "Web PKI" is used far and wide in domains outside of the web. >Moxie's strategy works and yours didn't, and you're here telling everybody you don't agree but reality doesn't care whether you agree with it or not. Oh, bugger off. The only group who has even made a serious attempt to do it properly is Matrix and one "meh" implementation does not damn an entire design.
  - tialaramex 5y ago
    > I understand the difference, and the condescending snark is not appreciated. I don't think the difference is very important in this case. As an example, you wrote earlier: > In fact, we see some of this in TLS - not everyone can participate As written this is nonsense of course. TLS is a series of published standard protocols, everyone can "participate" by implementing one of the protocols, and at their option some or even all optional extensions. But for the Web PKI things are quite different, only some can participate and under exacting conditions. On one side, Certificate Authorities can only participate via the root trust programmes of key trust stores operated by Mozilla, Microsoft, and Apple, plus Google (for Android and, perhaps sooner or later, Chrome) and Oracle (for the JRE). Participation in these programmes requires obeying the CA/B BRs, but also is at the sole discretion of each programme operator and so their own policies apply† As subscribers, the Web PKI is only interested in certifying names in the Internet's DNS hierarchy and, to a small extent in the Internet's IP address hierarchy. Other names aren't actually certifiable in the Web PKI, sometimes to the surprise of would-be subscribers (and even, once in a while, CAs) Finally as a relying party (the role all of us occupy even if in addition to other roles) the Web PKI is only applicable to the Internet, which of course is a lot of things but it isn't everything. > It's also revealing, perhaps, that you don't understand that the "Web PKI" is used far and wide in domains outside of the web. That's true, and has been for many years, and yet, there's a reason it's named the Web PKI anyway. Notice the B in CA/B stands for "Browser" even though today these are (except Mozilla) operating system vendors, historically they're the browser vendors. You could imagine alternate worlds where say, IBM, Apple and Sony are the biggest players in CA/B instead of Mozilla, Microsoft and Apple, and it really isn't about the web at all, but they're quite different from our world. If you don't like the phrase "Web PKI" you could sometimes substitute PKIX, but, ultimately PKIX isn't quite the same thing. PKIX is technical, it explains how to use the X.500 system's certificate format (X.509) to talk about the Internet instead of the X.500 directory, but it makes few substantive policy decisions. Certificates you get from Let's Encrypt are PKIX certificates, but, the ones you mint for testing with self-service tools or that come supplied with many Linux installs are also PKIX certificates and those aren't trustworthy. Certificates from Let's Encrypt are also part of the Web PKI and that's why you trust them. † These policies can be quite significant, for example Microsoft's programme requires that participants agree to revoke certificates if Microsoft so chooses. In practice Microsoft seems to use this power to kill off certain types of phishing scam that attack Microsoft's products. Mozilla's programme has historically been the origin of a lot of important public policy some of which is now in the CA/B BRs.

tialaramex 5y ago

> In fact, we see some of this in TLS - not everyone can participate, but there are dozens of independent organizations working within an internal governance models I think what's happened here is that you don't understand the difference between TLS, a network protocol, and the Web PKI, a Public Key Infrastructure and so you've sort of muddled both together, which is revealing on its own. You've also imagined a fairytale outcome that doesn't match reality. Moxie's strategy works and yours didn't, and you're here telling everybody you don't agree but reality doesn't care whether you agree with it or not.

ddevault 5y ago
>I think what's happened here is that you don't understand the difference between TLS, a network protocol, and the Web PKI, a Public Key Infrastructure and so you've sort of muddled both together, which is revealing on its own. I understand the difference, and the condescending snark is not appreciated. I don't think the difference is very important in this case. It's also revealing, perhaps, that you don't understand that the "Web PKI" is used far and wide in domains outside of the web. >Moxie's strategy works and yours didn't, and you're here telling everybody you don't agree but reality doesn't care whether you agree with it or not. Oh, bugger off. The only group who has even made a serious attempt to do it properly is Matrix and one "meh" implementation does not damn an entire design.
- tialaramex 5y ago
  > I understand the difference, and the condescending snark is not appreciated. I don't think the difference is very important in this case. As an example, you wrote earlier: > In fact, we see some of this in TLS - not everyone can participate As written this is nonsense of course. TLS is a series of published standard protocols, everyone can "participate" by implementing one of the protocols, and at their option some or even all optional extensions. But for the Web PKI things are quite different, only some can participate and under exacting conditions. On one side, Certificate Authorities can only participate via the root trust programmes of key trust stores operated by Mozilla, Microsoft, and Apple, plus Google (for Android and, perhaps sooner or later, Chrome) and Oracle (for the JRE). Participation in these programmes requires obeying the CA/B BRs, but also is at the sole discretion of each programme operator and so their own policies apply† As subscribers, the Web PKI is only interested in certifying names in the Internet's DNS hierarchy and, to a small extent in the Internet's IP address hierarchy. Other names aren't actually certifiable in the Web PKI, sometimes to the surprise of would-be subscribers (and even, once in a while, CAs) Finally as a relying party (the role all of us occupy even if in addition to other roles) the Web PKI is only applicable to the Internet, which of course is a lot of things but it isn't everything. > It's also revealing, perhaps, that you don't understand that the "Web PKI" is used far and wide in domains outside of the web. That's true, and has been for many years, and yet, there's a reason it's named the Web PKI anyway. Notice the B in CA/B stands for "Browser" even though today these are (except Mozilla) operating system vendors, historically they're the browser vendors. You could imagine alternate worlds where say, IBM, Apple and Sony are the biggest players in CA/B instead of Mozilla, Microsoft and Apple, and it really isn't about the web at all, but they're quite different from our world. If you don't like the phrase "Web PKI" you could sometimes substitute PKIX, but, ultimately PKIX isn't quite the same thing. PKIX is technical, it explains how to use the X.500 system's certificate format (X.509) to talk about the Internet instead of the X.500 directory, but it makes few substantive policy decisions. Certificates you get from Let's Encrypt are PKIX certificates, but, the ones you mint for testing with self-service tools or that come supplied with many Linux installs are also PKIX certificates and those aren't trustworthy. Certificates from Let's Encrypt are also part of the Web PKI and that's why you trust them. † These policies can be quite significant, for example Microsoft's programme requires that participants agree to revoke certificates if Microsoft so chooses. In practice Microsoft seems to use this power to kill off certain types of phishing scam that attack Microsoft's products. Mozilla's programme has historically been the origin of a lot of important public policy some of which is now in the CA/B BRs.