5 ms·

I'm with you except on the argument that decentralized reputation systems are easy to game. Isn't ssl and therefore most internet security based around decentr

by jayd16 5y ago

I'm with you except on the argument that decentralized reputation systems are easy to game. Isn't ssl and therefore most internet security based around decentralized reputation through cert validation?

lbotos 5y ago
> decentralized reputation through cert validation? Certs are pretty dang centralized. Also, Your second sentence needs a bit more fleshing out because it doesn't follow.
- jayd16 5y ago
  Certs are certainly decentralized. You can create your own root, share them, etc. There a several highly trusted roots that are chosen by OS makers, not centralized. Some roots are quite big but what part is centralized? Chain of trust is a decentralized reputation protocol and we use it frequently and effectively.
  - rhn_mk1 5y ago
    While it's not strictly centralized, as in, there's no single root, the sets of root certs in usage are extremely similar. There are only a handful that matter, and they overlap significantly because they share choices: Windows, Android, Apple, Firefox, various Linux distros. A contributing factor is that the culture that grew around them makes it uncommon to be able to manipulate your own certificates. If you set up a Web page with your own root cert, you can be sure it will never grow.
nonameiguess 5y ago
Mozilla's latest bundle has 148 root CAs in it: https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReport https://ccadb-public.secure.force.com/mozilla/IncludedCACert... So "decentralized" in the sense that there are more than one, but it's not some hierarchy-less free for all where anyone can attest to their own identity and trustworthiness and the network just automatically accepts that.
- jayd16 5y ago
  Sure it is. You can easily create your own root CA and have others trust it. I don't really understand the complaint because you literally can attest to your own trustworthiness through your own cert. Having others trust you is a taller order. Obviously that isn't automatic.

by jayd16 5y ago

lbotos 5y ago

> decentralized reputation through cert validation? Certs are pretty dang centralized. Also, Your second sentence needs a bit more fleshing out because it doesn't follow.

jayd16 5y ago
Certs are certainly decentralized. You can create your own root, share them, etc. There a several highly trusted roots that are chosen by OS makers, not centralized. Some roots are quite big but what part is centralized? Chain of trust is a decentralized reputation protocol and we use it frequently and effectively.
- rhn_mk1 5y ago
  While it's not strictly centralized, as in, there's no single root, the sets of root certs in usage are extremely similar. There are only a handful that matter, and they overlap significantly because they share choices: Windows, Android, Apple, Firefox, various Linux distros. A contributing factor is that the culture that grew around them makes it uncommon to be able to manipulate your own certificates. If you set up a Web page with your own root cert, you can be sure it will never grow.

nonameiguess 5y ago

Mozilla's latest bundle has 148 root CAs in it: https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReport https://ccadb-public.secure.force.com/mozilla/IncludedCACert... So "decentralized" in the sense that there are more than one, but it's not some hierarchy-less free for all where anyone can attest to their own identity and trustworthiness and the network just automatically accepts that.

jayd16 5y ago
Sure it is. You can easily create your own root CA and have others trust it. I don't really understand the complaint because you literally can attest to your own trustworthiness through your own cert. Having others trust you is a taller order. Obviously that isn't automatic.