3 ms·

They're planning on shipping this browser extension with a hardcoded list of DNSNMC server IP addresses. Isn't that a central point of failure? (E.g. If an adve

They're planning on shipping this browser extension with a hardcoded list of DNSNMC server IP addresses. Isn't that a central point of failure? (E.g. If an adversary mounts a DDoS against all servers in that list.) Adversaries wouldn't need to render the service unreachable, just slow it down to painfully-slow speeds for average users. Regular DNS is resilient to this because of its hierarchical design, but the paper seems to be proposing a flat list of DNSNMC servers that will be shipped with the extension by default. Since almost all users will stick with the defaults, subverting those servers would disrupt DNSNMC for most users. This is a good point. Two things: (1) you stopped a bit short in your quote. Here's a bit more from the paper on that: "To avoid falling into the same trap that web browsers enjoy today with Certificate Authorities, okTurtles will encourage the user to use their own DNSNMC server, whether it’s one that they have setup themselves, or one that belongs to someone they trust. Defaults are provided to encourage adoption and to make the software function immediately upon install." (2) That paper is the first public introduction of DNSNMC, and I expect (and really appreciate) everyone who reviews (and has reviewed) it, and pointed out issues like this. That said, this problem could be solved by something like a DHT [1]. Or, it might be a non-issue and not really need something that complicated. Just a live-updating list of trustworthy IP/fingerprint pairs (with bootstrap servers, protected by something like cloudflare), might be all that is necessary for the defaults (which again, the extension would encourage switching off of). Also, it's unclear to me how users or website owners use DNSNMC's REST API to update their blockchain identity entry. Yes, that API is being worked on right now, so your comments are definitely helpful, and you're also very much welcome to provide any and all other feedback. Here's another great place to do it: http://dot-bit.org/forum/viewtopic.php?f=5&t=1423 http://dot-bit.org/forum/viewtopic.php?f=5&t=1423 Thanks again for your fantastic feedback! (What a wonderful Xmas present! :) [1] https://github.com/feross/webtorrent https://github.com/feross/webtorrent

ama729 13y ago
Isn't the same problem than with CA then? Most people wont have their own server or have someone they trust have one. Isn't something like Confluence more interesting on this point of view?
- itistoday2 13y ago
  Isn't the same problem than with CA then? Well, it starts out similar to that problem, and the quote I gave above acknowledges and addresses that. It's not the same problem, though. Running your own CA today, and having it accepted by everyone else, is not simple (almost impossible), even for advanced users. Most people wont have their own server or have someone they trust have one. You sure about that? I see a one-click business opportunity for someone here. :) Isn't something like Confluence more interesting on this point of view? You mean Convergence? Have a look at section 4 in the paper which discusses the issues with that: "Existing attempts to fix this problem"

ama729 13y ago

Isn't the same problem than with CA then? Most people wont have their own server or have someone they trust have one. Isn't something like Confluence more interesting on this point of view?

itistoday2 13y ago
Isn't the same problem than with CA then? Well, it starts out similar to that problem, and the quote I gave above acknowledges and addresses that. It's not the same problem, though. Running your own CA today, and having it accepted by everyone else, is not simple (almost impossible), even for advanced users. Most people wont have their own server or have someone they trust have one. You sure about that? I see a one-click business opportunity for someone here. :) Isn't something like Confluence more interesting on this point of view? You mean Convergence? Have a look at section 4 in the paper which discusses the issues with that: "Existing attempts to fix this problem"