4 ms·

I blame NAT. I got online around 1994, behind a corporate firewall through my Dad’s work and it took me ages to work out why no one could reach my web server I

by danw1979 4y ago

I blame NAT. I got online around 1994, behind a corporate firewall through my Dad’s work and it took me ages to work out why no one could reach my web server I was running on that machine, despite getting all the DNS setup right. I think that’s when the penny dropped that the internet isn’t necessarily open; not everyone can reach everyone else. NAT always meant there was something (fiddly port forwards, or broken UPnP) in the way of a user publishing stuff from their own machines. You always had to have a web host - to rely on someone else’s computers - to publish your message. And so it continues.

narrator 4y ago
Bittorrent was the only P2P system that solved all the thorny NAT issues in a satisfactory way.
eternityforest 4y ago
NAT might have been what started it all, but PKI and DNS are the problem now I think. Nobody wants to self host an insecure thing, but security t requires self signed certs(A hassle, often not even supported well, nobody else can see it unless they go through the cert installing hassle either), or a domain name and let's encrypt(Manual work that costs money). What I suspect we should have done is just collapsed TLS and IP into the same protocol, and put the certs hash right onto the IP, so that as long as DNS gives you the right address, you're secure. Then all you have to do is make DNS run over that same secured IP, and DNS will never give you a bad IP, and as soon as you buy a domain, you get security without having to think about it at all on the application side, besides giving yourself a new key in your IP periodically or when it gets compromised. Yggdrasil has it right, but they have to use almost the whole 128 bits, and rely on mesh routing, there's not really a way to fit traditional IPv6 routing AND good security in just 16 bytes. Also, routers with bad UPnP implementations did not help. Now you can't rely on all non-technical users having it enabled because people don't trust it.

narrator 4y ago

Bittorrent was the only P2P system that solved all the thorny NAT issues in a satisfactory way.

eternityforest 4y ago

NAT might have been what started it all, but PKI and DNS are the problem now I think. Nobody wants to self host an insecure thing, but security t requires self signed certs(A hassle, often not even supported well, nobody else can see it unless they go through the cert installing hassle either), or a domain name and let's encrypt(Manual work that costs money). What I suspect we should have done is just collapsed TLS and IP into the same protocol, and put the certs hash right onto the IP, so that as long as DNS gives you the right address, you're secure. Then all you have to do is make DNS run over that same secured IP, and DNS will never give you a bad IP, and as soon as you buy a domain, you get security without having to think about it at all on the application side, besides giving yourself a new key in your IP periodically or when it gets compromised. Yggdrasil has it right, but they have to use almost the whole 128 bits, and rely on mesh routing, there's not really a way to fit traditional IPv6 routing AND good security in just 16 bytes. Also, routers with bad UPnP implementations did not help. Now you can't rely on all non-technical users having it enabled because people don't trust it.