9 ms·

If there’s an area where a decentralized blockchain has application, it is surely DNS and the rent-seeking certificate infrastructure.

dimmke 4y ago
You know what? You're right. That's literally the only proposed blockchain application I think I've ever read that I think would actually work.
- deleted 4y ago
  [deleted]
- jeroenhd 4y ago
  I don't think it would. The moment the blockchain would start getting any traction, the big blockchain companies would use their capital to get their hands on every recognizable domain name and within days the only remaining "domains" would look like passwords. You could then probably buy readable domains for exorbitant amounts of cryptocoins. I prefer the current registrar setup over anarchist blockchain hellscapes. You can sue Verisign, you can't sue 0xEf1c6E67703c7BD7107eed8303Fbe6EC2554BF6B.
  - from 4y ago
    You know domain sniping already happens right? There is extensive auctioning infrastructure. And most of the good names were claimed a long time ago. The only way to get an existing domain name without paying the owner for it is to sue over trademark violations or stuff like that which often will cost more than just buying it.
    - jeroenhd 4y ago
      Domain sniping already happens, sure. However, squatters need to invest time and energy into registering these domains whereas a cryptographic system can do all that offline inside the data centers of the cryptosquatter. Some TLDs have provisions against domain squatters and in case of copyright disputes, you can sue the squatters (or request ICANN to release the domain if that isn't possible for some reason). If you have a good reason to demand a domain currently unused, there are ways to get it. With crypto-TLDs, nike.com and microsoft.com would be registered by a malicious player without any kind of recourse. The lack of enforceability makes the entire system pretty useless the moment it takes off.
      - kelthuzad 4y ago
        > However, squatters need to invest time and energy into registering these domains whereas a cryptographic system... The auction system is actually fairer since it gives enough time for every party to bid the highest amount according to their interest instead of relying on sniping services like in the current legacy systems. > whereas a cryptographic system can do all that offline inside the data centers of the cryptosquatter. what does this even mean? >Some TLDs have provisions against domain squatters and in case of copyright disputes, you can sue the squatters Sure, but this is also a double edged sword, since it also opens up abuse i.e. reverse domain hijacking which is a real and common problem. Just this week Charles Schwab tried to rob the legitimate owner of a domain that contained "Schwab", while they tried to hide the fact that the owner's name is also Schwab. [0] >With crypto-TLDs, nike.com and microsoft.com would be registered by a malicious player That's why good builders put in the time and effort to reserve these names from the start. >The lack of enforceability makes the entire system pretty useless the moment it takes off. Sovereignty has its price. No system is perfect, everything has its trade-offs, but I see a lot of people highlighting the best properties of the legacy system while ignoring the best properties of the new systems. The comparisons should be fair and compare the full range of positives and negatives instead of picking and comparing in a bad faith manner. [0] https://domainnamewire.com/2023/01/24/charles-schwab-tries-to-reverse-hijack-domain-name/ https://domainnamewire.com/2023/01/24/charles-schwab-tries-t...
  - detrites 4y ago
    There's a simple solution for that: to buy a domain on-chain that has an equivalent off-chain, the existing owner first needs to prove ownership of that equivalent domain. After, it can be sold freely (as uniques could already). The on-chain contract could be written such that a buyer generates a token, supplied to an on-chain verification oracle that checks token.owned-domain.TLD exists, and if it does grants issuance of the new on-chain version. This essentially allows for a fair transition from the old system to the new system, while eliminating squatting.
    - jeroenhd 4y ago
      What happens to these domains when the "legacy" domain expires and gets re-bought? Do you lose access when you stop paying? What if someone managed to hack your DNS, does it and its integration with TLS then break the supposed security guarantees? This system just seems to be traditional DNS with extra steps and a lack of manual recourse against bad actors, to be honest.
      - deleted 4y ago
        [deleted]
      - detrites 4y ago
        The first question is irrelevant and affects nothing - the same owner proves ownership of both at the outset, if they choose to let the legacy version expire, well they chose that - so who cares what happens to it? I suppose it could be configurable at purchase to allow it to be a recurring verification, if that was desired, but it would seem to overcomplicate for no reason. "Subscribing" to domains each year is legacy inefficiency. I'm not sure what you mean about DNS, any chain-based system would be... chain-based, and therefore cryptographically-assured that a domain points where the owner chooses. "Not your keys, not your domain" applies.
  - DennisP 4y ago
    I don't think that's happened on ENS so far, though there is some domain squatting just like there is on DNS. Though ENS doesn't implement this, it'd be possible to add paid arbitration by humans for resolving trademark disputes. You couldn't get damages but you could get the domain.
  - dimmke 4y ago
    Good points, but I have to point out that what you're describing is literally what happened with our current system, just less extreme. I was recently quoted $250,000 to buy a .com that is not being used and as far as I can tell has never been used but some guy bought in the 90s when I was a young child. Aside from the level of extreme is that really different from "You could then probably buy readable domains for exorbitant amounts of cryptocoins." You touch on what I think the core issue is with domains when you talk about suing Verisign. In some very limited cases, it's possible through litigation to get a domain you feel like you should have. But therein lies the crux of the whole issue: What standard needs to be met before you qualify for a domain name, especially one that is in contention? In cryptocurrency, the criteria to receive the currency was originally solving problems with computing power because they needed some arbitrary measure. In the world of domain names, it's been a lot of different things but mostly just money and time. That standard - what "qualifies" you to own a domain over someone else I think would have to be decided before truly effective regulation can be made or enforced, blockchain or not. Right now it's basically temporal, with some carveouts from lawsuits for trademarks. The current regulations around how domain names work is woefully inadequate (like most regulation around technology) and gives outsized power to private entities. This is something that I think people don't talk about enough when they criticize blockchains. If there was a better job being done with public policy, you'd likely have less people who think a system where there's no way of imposing real regulation is desirable. It's especially bad with technology. My go to example is Apple's App Store, but this area is a good topic too. To me, a happy mix of public/private policy would be best. The government allowing private TLDs, but regulating them. An anti squatting law, price capping new TLD name registrations, an enshrined "specificity system" to claiming an unused (or even used) domain would make the situation so much better, but it'll never happen.
- MrOwnPut 4y ago
  It's been working... for awhile now. But no traction here because... crypto = bad. There's Handshake, ENS, and UnstoppableDomains. Brave supports .eth domains out-of-the-box, hopefully Handshake soon. For Handshake you can use a local resolver that reads the blockchain or use NextDNS. NFTs aren't just for art, y'know. They have real [digital] world use cases for ownership, like DNS.
  - janosdebugs 4y ago
    There is no traction because it's a vanity item. Most people/businesses need their websites to work on the average Joe/Jane's mobile phone, not just on some specialized browser that only a few people use. (=Chrome, Safari, Edge)
    - MrOwnPut 4y ago
      So tech here doesn't gain traction unless the average Joe already uses it? And Brave and NextDNS aren't popular enough for your threshold? Handshake is exactly what would stop the issue happening in TFA, yet everyone ignores it here. For something to go mainstream, you have to talk about it... HN is not a very good tech site if you only talk about the tech that the common person already knows about.
      - janosdebugs 4y ago
        For some products, yes. For example, if you were to make a social media network that targets the general populace for finding their real life friends, it wouldn't work unless you had... well, the general populace on it. No matter how awesome the technology would be. The same with DNS replacements. The projects mentioned in this thread aren't the first to offer an expanded DNS solution for one reason or another. None of them gained traction.
        rvz 4y ago
        > For some products, yes. For example, if you were to make a social media network that targets the general populace for finding their real life friends, it wouldn't work unless you had... well, the general populace on it. Hence why Twitter still has no viable competitor or replacement, especially when the money is still there despite all the hype and mania of it 'dying'.
tptacek 4y ago
Certificates are free, and all certificates are surveilled with a cryptographically secure append-only log. Meanwhile, if you think the biggest problem with the DNS infrastructure we have now is rent-seeking, take a look at the blockchain alternatives that have been proposed. There might be no modern analog to "attempting to sell the Brooklyn Bridge" more fitting than blockchain DNS.
- celdon25 4y ago
  Can you name some examples?
- Yeahsureok 4y ago
  > attempting to sell the Brooklyn Bridge Handshake reserved the top 100,000 Alexa domains and allowed all trademark name holders to claim theirs. Not to mention the ten million in FOSS grants for developers to build tooling Sadly the ideologues will somehow decry their attempts for an alternative while defending the indefensible ICAAN.
  - verdverm 4y ago
    What about everyone else after the 100k? What recourse are they left with when their domain is/was taken by another party? Which party should own the domain? How would doubly registered domains be resolved?
    - kelthuzad 4y ago
      They will remain on their original tld, so brand.com will remain brand.com, they just won't automatically receive their own brand tld, unless they manually start the auction themselves.
      - verdverm 4y ago
        so those below 100k were not reserved, a squatter bought their brand tld, what recourse do they have? What about new brands that have reached the 100k mark since the great reservation?
teddyh 4y ago
The “rent-seeking certificate infrastructure” could be solved if web browsers used the DNS (and DNSSEC) to validate certificates. The DNS, on the other hand, is more tricky. If you want human-readable and globally distinct (and stable) names, you have to have a centralized structure to keep track of who has what name. The best we could come up with was the DNS, which is at least hierarchical instead of completely monolithic. And then it becomes a question of: do you want name holders to continually pay for names in some way, or do you want a land grab model where the person who snagged a name 30 years ago now owns it forever for free? With DNS, that question is decided by each node in the tree of the hierarchy.
- zozbot234 4y ago
  Human-readable names can potentially be pseudo-random, and thus securely generated. What's hard (indeed, considered largely infeasible) is meaningful, decentralized, secure names.
  - gruez 4y ago
    >Human-readable names can potentially be pseudo-random No matter how you dice it, getting humans to remember 128 bits of entropy is going to be a non-starter. Encoding those 128 bits using words doesn't really solve the problem.
    - cdev_gl 4y ago
      I was going to argue that remembering "CorrectBatteryHorseStaple.com" is leagues easier than remembering an 128 bit number, but then I did the math and using the 20k most common english words to encode 128bits you'd need an 8 word phrase, which pretty much solidifies the point you've made. I mean, people can recite poetry far longer, even nonsense poetry ("Twas brillig, and the slithy toves / did gyre and gimble in the wabe") so it's not impossible. But generally speaking, yeah. Nobody wants to navigate to that bit of jabberwocky instead of google.com It does kind of make me long for the days of the HOSTS file, where anyone might alias a hard-to-remember address as something locally meaningful.
  - 4y ago
kragen 4y ago
You're looking for the Ethereum Name Service.
agilob 4y ago
Literally one of the first applications of a blockchain tech https://www.namecoin.org/ https://www.namecoin.org/

dimmke 4y ago

You know what? You're right. That's literally the only proposed blockchain application I think I've ever read that I think would actually work.

deleted 4y ago
[deleted]
jeroenhd 4y ago
I don't think it would. The moment the blockchain would start getting any traction, the big blockchain companies would use their capital to get their hands on every recognizable domain name and within days the only remaining "domains" would look like passwords. You could then probably buy readable domains for exorbitant amounts of cryptocoins. I prefer the current registrar setup over anarchist blockchain hellscapes. You can sue Verisign, you can't sue 0xEf1c6E67703c7BD7107eed8303Fbe6EC2554BF6B.
- from 4y ago
  You know domain sniping already happens right? There is extensive auctioning infrastructure. And most of the good names were claimed a long time ago. The only way to get an existing domain name without paying the owner for it is to sue over trademark violations or stuff like that which often will cost more than just buying it.
  - jeroenhd 4y ago
    Domain sniping already happens, sure. However, squatters need to invest time and energy into registering these domains whereas a cryptographic system can do all that offline inside the data centers of the cryptosquatter. Some TLDs have provisions against domain squatters and in case of copyright disputes, you can sue the squatters (or request ICANN to release the domain if that isn't possible for some reason). If you have a good reason to demand a domain currently unused, there are ways to get it. With crypto-TLDs, nike.com and microsoft.com would be registered by a malicious player without any kind of recourse. The lack of enforceability makes the entire system pretty useless the moment it takes off.
    - kelthuzad 4y ago
      > However, squatters need to invest time and energy into registering these domains whereas a cryptographic system... The auction system is actually fairer since it gives enough time for every party to bid the highest amount according to their interest instead of relying on sniping services like in the current legacy systems. > whereas a cryptographic system can do all that offline inside the data centers of the cryptosquatter. what does this even mean? >Some TLDs have provisions against domain squatters and in case of copyright disputes, you can sue the squatters Sure, but this is also a double edged sword, since it also opens up abuse i.e. reverse domain hijacking which is a real and common problem. Just this week Charles Schwab tried to rob the legitimate owner of a domain that contained "Schwab", while they tried to hide the fact that the owner's name is also Schwab. [0] >With crypto-TLDs, nike.com and microsoft.com would be registered by a malicious player That's why good builders put in the time and effort to reserve these names from the start. >The lack of enforceability makes the entire system pretty useless the moment it takes off. Sovereignty has its price. No system is perfect, everything has its trade-offs, but I see a lot of people highlighting the best properties of the legacy system while ignoring the best properties of the new systems. The comparisons should be fair and compare the full range of positives and negatives instead of picking and comparing in a bad faith manner. [0] https://domainnamewire.com/2023/01/24/charles-schwab-tries-to-reverse-hijack-domain-name/ https://domainnamewire.com/2023/01/24/charles-schwab-tries-t...
- detrites 4y ago
  There's a simple solution for that: to buy a domain on-chain that has an equivalent off-chain, the existing owner first needs to prove ownership of that equivalent domain. After, it can be sold freely (as uniques could already). The on-chain contract could be written such that a buyer generates a token, supplied to an on-chain verification oracle that checks token.owned-domain.TLD exists, and if it does grants issuance of the new on-chain version. This essentially allows for a fair transition from the old system to the new system, while eliminating squatting.
  - jeroenhd 4y ago
    What happens to these domains when the "legacy" domain expires and gets re-bought? Do you lose access when you stop paying? What if someone managed to hack your DNS, does it and its integration with TLS then break the supposed security guarantees? This system just seems to be traditional DNS with extra steps and a lack of manual recourse against bad actors, to be honest.
    - deleted 4y ago
      [deleted]
    - detrites 4y ago
      The first question is irrelevant and affects nothing - the same owner proves ownership of both at the outset, if they choose to let the legacy version expire, well they chose that - so who cares what happens to it? I suppose it could be configurable at purchase to allow it to be a recurring verification, if that was desired, but it would seem to overcomplicate for no reason. "Subscribing" to domains each year is legacy inefficiency. I'm not sure what you mean about DNS, any chain-based system would be... chain-based, and therefore cryptographically-assured that a domain points where the owner chooses. "Not your keys, not your domain" applies.
- DennisP 4y ago
  I don't think that's happened on ENS so far, though there is some domain squatting just like there is on DNS. Though ENS doesn't implement this, it'd be possible to add paid arbitration by humans for resolving trademark disputes. You couldn't get damages but you could get the domain.
- dimmke 4y ago
  Good points, but I have to point out that what you're describing is literally what happened with our current system, just less extreme. I was recently quoted $250,000 to buy a .com that is not being used and as far as I can tell has never been used but some guy bought in the 90s when I was a young child. Aside from the level of extreme is that really different from "You could then probably buy readable domains for exorbitant amounts of cryptocoins." You touch on what I think the core issue is with domains when you talk about suing Verisign. In some very limited cases, it's possible through litigation to get a domain you feel like you should have. But therein lies the crux of the whole issue: What standard needs to be met before you qualify for a domain name, especially one that is in contention? In cryptocurrency, the criteria to receive the currency was originally solving problems with computing power because they needed some arbitrary measure. In the world of domain names, it's been a lot of different things but mostly just money and time. That standard - what "qualifies" you to own a domain over someone else I think would have to be decided before truly effective regulation can be made or enforced, blockchain or not. Right now it's basically temporal, with some carveouts from lawsuits for trademarks. The current regulations around how domain names work is woefully inadequate (like most regulation around technology) and gives outsized power to private entities. This is something that I think people don't talk about enough when they criticize blockchains. If there was a better job being done with public policy, you'd likely have less people who think a system where there's no way of imposing real regulation is desirable. It's especially bad with technology. My go to example is Apple's App Store, but this area is a good topic too. To me, a happy mix of public/private policy would be best. The government allowing private TLDs, but regulating them. An anti squatting law, price capping new TLD name registrations, an enshrined "specificity system" to claiming an unused (or even used) domain would make the situation so much better, but it'll never happen.
MrOwnPut 4y ago
It's been working... for awhile now. But no traction here because... crypto = bad. There's Handshake, ENS, and UnstoppableDomains. Brave supports .eth domains out-of-the-box, hopefully Handshake soon. For Handshake you can use a local resolver that reads the blockchain or use NextDNS. NFTs aren't just for art, y'know. They have real [digital] world use cases for ownership, like DNS.
- janosdebugs 4y ago
  There is no traction because it's a vanity item. Most people/businesses need their websites to work on the average Joe/Jane's mobile phone, not just on some specialized browser that only a few people use. (=Chrome, Safari, Edge)
  - MrOwnPut 4y ago
    So tech here doesn't gain traction unless the average Joe already uses it? And Brave and NextDNS aren't popular enough for your threshold? Handshake is exactly what would stop the issue happening in TFA, yet everyone ignores it here. For something to go mainstream, you have to talk about it... HN is not a very good tech site if you only talk about the tech that the common person already knows about.
    - janosdebugs 4y ago
      For some products, yes. For example, if you were to make a social media network that targets the general populace for finding their real life friends, it wouldn't work unless you had... well, the general populace on it. No matter how awesome the technology would be. The same with DNS replacements. The projects mentioned in this thread aren't the first to offer an expanded DNS solution for one reason or another. None of them gained traction.
      - rvz 4y ago
        > For some products, yes. For example, if you were to make a social media network that targets the general populace for finding their real life friends, it wouldn't work unless you had... well, the general populace on it. Hence why Twitter still has no viable competitor or replacement, especially when the money is still there despite all the hype and mania of it 'dying'.

tptacek 4y ago

Certificates are free, and all certificates are surveilled with a cryptographically secure append-only log. Meanwhile, if you think the biggest problem with the DNS infrastructure we have now is rent-seeking, take a look at the blockchain alternatives that have been proposed. There might be no modern analog to "attempting to sell the Brooklyn Bridge" more fitting than blockchain DNS.

celdon25 4y ago
Can you name some examples?
Yeahsureok 4y ago
> attempting to sell the Brooklyn Bridge Handshake reserved the top 100,000 Alexa domains and allowed all trademark name holders to claim theirs. Not to mention the ten million in FOSS grants for developers to build tooling Sadly the ideologues will somehow decry their attempts for an alternative while defending the indefensible ICAAN.
- verdverm 4y ago
  What about everyone else after the 100k? What recourse are they left with when their domain is/was taken by another party? Which party should own the domain? How would doubly registered domains be resolved?
  - kelthuzad 4y ago
    They will remain on their original tld, so brand.com will remain brand.com, they just won't automatically receive their own brand tld, unless they manually start the auction themselves.
    - verdverm 4y ago
      so those below 100k were not reserved, a squatter bought their brand tld, what recourse do they have? What about new brands that have reached the 100k mark since the great reservation?

teddyh 4y ago

The “rent-seeking certificate infrastructure” could be solved if web browsers used the DNS (and DNSSEC) to validate certificates. The DNS, on the other hand, is more tricky. If you want human-readable and globally distinct (and stable) names, you have to have a centralized structure to keep track of who has what name. The best we could come up with was the DNS, which is at least hierarchical instead of completely monolithic. And then it becomes a question of: do you want name holders to continually pay for names in some way, or do you want a land grab model where the person who snagged a name 30 years ago now owns it forever for free? With DNS, that question is decided by each node in the tree of the hierarchy.

zozbot234 4y ago
Human-readable names can potentially be pseudo-random, and thus securely generated. What's hard (indeed, considered largely infeasible) is meaningful, decentralized, secure names.
- gruez 4y ago
  >Human-readable names can potentially be pseudo-random No matter how you dice it, getting humans to remember 128 bits of entropy is going to be a non-starter. Encoding those 128 bits using words doesn't really solve the problem.
  - cdev_gl 4y ago
    I was going to argue that remembering "CorrectBatteryHorseStaple.com" is leagues easier than remembering an 128 bit number, but then I did the math and using the 20k most common english words to encode 128bits you'd need an 8 word phrase, which pretty much solidifies the point you've made. I mean, people can recite poetry far longer, even nonsense poetry ("Twas brillig, and the slithy toves / did gyre and gimble in the wabe") so it's not impossible. But generally speaking, yeah. Nobody wants to navigate to that bit of jabberwocky instead of google.com It does kind of make me long for the days of the HOSTS file, where anyone might alias a hard-to-remember address as something locally meaningful.
- 4y ago

kragen 4y ago

You're looking for the Ethereum Name Service.

agilob 4y ago

Literally one of the first applications of a blockchain tech https://www.namecoin.org/ https://www.namecoin.org/