4 ms·

> Key revocation certificates come to mind as a good case for a public blockchain. It's not. It already exists without a blockchain[0]: https://en.wikipedia.or

by hiq 4y ago

> Key revocation certificates come to mind as a good case for a public blockchain. It's not. It already exists without a blockchain[0]: https://en.wikipedia.org/wiki/Certificate_Transparency https://en.wikipedia.org/wiki/Certificate_Transparency [0]: since it's a source of confusion, with the definition (and explanation) of what a blockchain is given there: https://www.schneier.com/essays/archives/2019/02/theres_no_good_reaso.html https://www.schneier.com/essays/archives/2019/02/theres_no_g...

__MatrixMan__ 4y ago
Re: CT, > Logs are operated by many parties, including browser vendors and certificate authorities. Why should we trust browser vendors and certificate authorities? They're high value targets and therefore more likely to be targeted. As for Schneier, he asks: > Would you rather trust a human legal system or the details of some computer code you don’t have the expertise to audit? If I don't have any evidence that the code will fail in the way I'm worried about, but I do have evidence that the legal system frequently fails in the way I'm worried about, then maybe the code. But whatever the case, I definitely prefer a legal system that has to worry about being replaced by code than one whose dominance is assured.
- hiq 4y ago
  > Why should we trust browser vendors and certificate authorities? They're high value targets and therefore more likely to be targeted. You're mentioning that as if blockchain somehow solved this problem. It doesn't. At best, blockchain moves trust around and you end up with a system that won't resist the test of time and end up converging to what you already have, but worse.
  - __MatrixMan__ 4y ago
    If you can generate a valid revocation certificate in the first place, you're already trusted. There's no need for additional trust in this case, just a place to put it that's hard to censor.

by hiq 4y ago

__MatrixMan__ 4y ago

Re: CT, > Logs are operated by many parties, including browser vendors and certificate authorities. Why should we trust browser vendors and certificate authorities? They're high value targets and therefore more likely to be targeted. As for Schneier, he asks: > Would you rather trust a human legal system or the details of some computer code you don’t have the expertise to audit? If I don't have any evidence that the code will fail in the way I'm worried about, but I do have evidence that the legal system frequently fails in the way I'm worried about, then maybe the code. But whatever the case, I definitely prefer a legal system that has to worry about being replaced by code than one whose dominance is assured.

hiq 4y ago
> Why should we trust browser vendors and certificate authorities? They're high value targets and therefore more likely to be targeted. You're mentioning that as if blockchain somehow solved this problem. It doesn't. At best, blockchain moves trust around and you end up with a system that won't resist the test of time and end up converging to what you already have, but worse.
- __MatrixMan__ 4y ago
  If you can generate a valid revocation certificate in the first place, you're already trusted. There's no need for additional trust in this case, just a place to put it that's hard to censor.