3 ms·

I am not sure whether you are aware of how many recursively self-deprecating RFCs you have to read to be able to implement a DNS resolver. (Hint: it's more tha

I am not sure whether you are aware of how many recursively self-deprecating RFCs you have to read to be able to implement a DNS resolver. (Hint: it's more than 20) At this point it's time to take a step back and think about what problems DNS causes and how it would be possible to mitigate them. And not iterate on the literally first mistake on the internet which was meant to replace the /etc/hosts file. Most security problems are caused by DNS in one way or the other. Heck, even HTTPS and HSTS is botched because of CAs being an inherent requirement only because DNS is unreliable in both terms of transport layer and handshake/discovery. If DNS would be based on cryptographic identity, then we wouldn't even need CAs, and we wouldn't even need that giga zip file of universal trust in foreign organizations called ca-certificates.

otabdeveloper4 3y ago
DNS isn't meant to solve the problem of trust. You probably want something else if that's your problem. (To be honest, only banks and government care about the problem of trust. Let them figure it out, because I really don't care.)
8organicbits 3y ago
I'd love to see a real alternative to DNS, but until there's a real contender my focus is on incrementally improving what we have. My take on the CA system [1] is that it looks crazy at first, and looks worse the more you look, but there's enough checks in place that, in practice, it generally works. [1] https://alexsci.com/blog/ca-trust/ https://alexsci.com/blog/ca-trust/
Avamander 3y ago
> If DNS would be based on cryptographic identity, then we wouldn't even need CAs, and we wouldn't even need that giga zip file of universal trust in foreign organizations called ca-certificates. How would that avoid creating DNS CAs?
- 8organicbits 3y ago
  Typically the domain name of the service is related to (i.e. the fingerprint of) the public key being used. This is unfortunately painful to use, so I don't know anyone using it at scale outside Tor's onion services. https://community.torproject.org/onion-services/advanced/https/ https://community.torproject.org/onion-services/advanced/htt...

otabdeveloper4 3y ago

DNS isn't meant to solve the problem of trust. You probably want something else if that's your problem. (To be honest, only banks and government care about the problem of trust. Let them figure it out, because I really don't care.)

8organicbits 3y ago

I'd love to see a real alternative to DNS, but until there's a real contender my focus is on incrementally improving what we have. My take on the CA system [1] is that it looks crazy at first, and looks worse the more you look, but there's enough checks in place that, in practice, it generally works. [1] https://alexsci.com/blog/ca-trust/ https://alexsci.com/blog/ca-trust/

Avamander 3y ago

> If DNS would be based on cryptographic identity, then we wouldn't even need CAs, and we wouldn't even need that giga zip file of universal trust in foreign organizations called ca-certificates. How would that avoid creating DNS CAs?

8organicbits 3y ago
Typically the domain name of the service is related to (i.e. the fingerprint of) the public key being used. This is unfortunately painful to use, so I don't know anyone using it at scale outside Tor's onion services. https://community.torproject.org/onion-services/advanced/https/ https://community.torproject.org/onion-services/advanced/htt...