5 ms·

> We’ve had the X.509 certificate infrastructure for 30+ years, and it’s only recently become mostly safe and automated enough for people to deploy without risk

by agwa 3y ago

> We’ve had the X.509 certificate infrastructure for 30+ years, and it’s only recently become mostly safe and automated enough for people to deploy without risk. (This includes new risks, like accidentally sending HSTS headers with too large timeouts to the world.) DNSSEC will get there, too. The WebPKI didn't improve on its own; it got there largely because web browser makers have high-leverage points to exert influence, which they used to make sure improvements got done. How do you envision DNSSEC getting there?

411111111111111 3y ago
> it got there largely because web browser makers have high-leverage points to exert influence That's not how I remember it. Unless you excluded google chrome, Microsoft's browsers, and Apples browsers. The change was brought upon by let's encrypt, and Mozilla is the only one of the founders that has a web browser.
tialaramex 3y ago
It certainly helps that we're moving on from "It's irrelevant" to "Actually this is important and it's bad if it's broken". When would you say that happened for the Web PKI? Not last century when the Web PKI comes into existence for sure. Maybe if you squint you could argue for the Baseline Requirements in 2011 as a starting point ? Or maybe the Ten Blessed Methods which was only a few years ago? The browsers do have leverage over the TLDs, and over the DNS resolvers, in the form of how they choose to treat names and name services. For example check the "trusted resolver" policies at Mozilla and Chrome, which IIRC got big US ISPs to swear off nonsense like injecting bogus results into DNS in exchange for having the browser work with their DNS servers.
- agwa 3y ago
  Browsers have leverage over CAs because CAs have to ask browsers to be included in the first place, and because distrusting a CA only temporarily breaks websites until they can switch to a new certificate. What kind of leverage do you think a browser could practically exert over a TLD?
  - tialaramex 3y ago
    As just one example, they can change presentation. Remember the CAs were able to sell an otherwise useless change in presentation for a considerably increased price, you will still occasionally run into people who thought that was crucial to their business.
teddyh 3y ago
Oh, people are already working on it; they do it because: 1. Doing DNSSEC manually is work. 2. Doing DNSSEC manually is risky, which all these outages show. The more DNSSEC usage increases, the more work it will be to do it, and the more people will mess up, and the more the incentives to automate it will increase.

by agwa 3y ago

411111111111111 3y ago

> it got there largely because web browser makers have high-leverage points to exert influence That's not how I remember it. Unless you excluded google chrome, Microsoft's browsers, and Apples browsers. The change was brought upon by let's encrypt, and Mozilla is the only one of the founders that has a web browser.

tialaramex 3y ago

It certainly helps that we're moving on from "It's irrelevant" to "Actually this is important and it's bad if it's broken". When would you say that happened for the Web PKI? Not last century when the Web PKI comes into existence for sure. Maybe if you squint you could argue for the Baseline Requirements in 2011 as a starting point ? Or maybe the Ten Blessed Methods which was only a few years ago? The browsers do have leverage over the TLDs, and over the DNS resolvers, in the form of how they choose to treat names and name services. For example check the "trusted resolver" policies at Mozilla and Chrome, which IIRC got big US ISPs to swear off nonsense like injecting bogus results into DNS in exchange for having the browser work with their DNS servers.

agwa 3y ago
Browsers have leverage over CAs because CAs have to ask browsers to be included in the first place, and because distrusting a CA only temporarily breaks websites until they can switch to a new certificate. What kind of leverage do you think a browser could practically exert over a TLD?
- tialaramex 3y ago
  As just one example, they can change presentation. Remember the CAs were able to sell an otherwise useless change in presentation for a considerably increased price, you will still occasionally run into people who thought that was crucial to their business.

teddyh 3y ago

Oh, people are already working on it; they do it because: 1. Doing DNSSEC manually is work. 2. Doing DNSSEC manually is risky, which all these outages show. The more DNSSEC usage increases, the more work it will be to do it, and the more people will mess up, and the more the incentives to automate it will increase.