Hacker News Reader

Comment by tptacek | Hacker News Reader

Certificates are free, and all certificates are surveilled with a cryptographically secure append-only log. Meanwhile, if you think the biggest problem with the DNS infrastructure we have now is rent-seeking, take a look at the blockchain alternatives that have been proposed. There might be no modern analog to "attempting to sell the Brooklyn Bridge" more fitting than blockchain DNS.

View on HN

> attempting to sell the Brooklyn Bridge

Handshake reserved the top 100,000 Alexa domains and allowed all trademark name holders to claim theirs.

Not to mention the ten million in FOSS grants for developers to build tooling

Sadly the ideologues will somehow decry their attempts for an alternative while defending the indefensible ICAAN.

What about everyone else after the 100k? What recourse are they left with when their domain is/was taken by another party? Which party should own the domain? How would doubly registered domains be resolved?

They will remain on their original tld, so brand.com will remain brand.com, they just won't automatically receive their own brand tld, unless they manually start the auction themselves.

so those below 100k were not reserved, a squatter bought their brand tld, what recourse do they have? What about new brands that have reached the 100k mark since the great reservation?

if a brand was not significant enough to reach internet search significance why should they be entitled to their own tld? why should be some company "co" from country x be more entitled to their own tld than the company co with the same name from country y? If they feel they are, they can a) manually start and win the auction b) buy the tld c) use an alternative like .brandHQ,.getbrand,.usebrand or whatever d) just keep using their original domain brand.com, which is the most simple and straight forward solution that requires no effort on their part.

By your logic the evolution of the internet would forever stagnate because developers would be stuck reserving an infinite amount of tlds that keep on popping up, it's just unrealistic and not pragmatic. reserving 100k of the most popular domains is a good faith effort and a pragmatic solution.

And if you want to talk about fairness let's first start talking about the corruption of ICANN[0][1][2] before criticizing emerging solutions.

[0] https://www.theguardian.com/technology/2015/sep/21/icann-int...

[1] https://www.politico.com/news/2022/04/09/website-domain-more...

[2] https://circleid.com/posts/20210413-insult-and-injury-of-us-...

Handshake requires domain owners to pay a biennial "mining fee" to maintain their names, even for names that were "airdropped" to FOSS projects. This is no less of a grift than ICANN.

Oh, that's nice of Handshake. Definitely it makes sense to me now that Handshake should be able to sell the domain namespace! Why not, if they're going to donate to FOSS?

My question to you is: if I donate MAC addresses to FOSS projects, can I tokenize ARP? I promise to be nice about it. The first 10,000 IP addresses can have their ARPCoin for free.

Seriously, this FOSS donation thing with Handshake: it's like selling people the Brooklyn Bridge, but promising generous new bike lanes. See, the FOSS stuff? It wasn't the problem with the plan.

Thomas, I’m not sure what you mean when you say that certificates are free. Self-signed certs are free, but only situationally useful in a business context. Let’s Encrypt certs are free, but not usable in all contexts. GoDaddy, Namecheap, and Verisign will still gladly charge $50-$1500 for certs will various features like $50/SAN, and extended validation. If you want to terminate TLS at an AWS managed edge resource, the happy path is ACM. These are “free”, but arguably you’re paying for the cert with the load balancer or edge resource.

There’s no difference between a blockchain and a cryptographically secure write ahead log, indeed that is how blockchains are defined. Perhaps you assumed that I meant cryptocurrency when I said blockchain? I did not.

(Sorry for the delayed reply.)

Tell me more about the contexts in which you can't use LetsEncrypt certificates.

Older OS. Certbot only supports a limited number of OS (centos 6 not so much). Longer expiry dates.

Certbot isn't the only way to automate Let's Encrypt certificate issuance, and even if it was, you can use hooks to have certbot push certs to other machines.

Sure - for example, when the organization requires an OV or EV certificate.

Yeah, and that happens where?

What’s the use case for OV/EV certs? I thought it was reasonably well established that they herald from the same era as “this site secured by Symantec” icons, and were basically just the same security as DV certs but with the wheels painted chrome and an extra tax for gullible buyers.

It doesn't matter, right? Because anyone who relies on OV/EV certs has chosen to rely on OV/EV certs. If we replaced the whole WebPKI edifice with a blockchain, they'd still make the same decision not to trust the baseline system.

When we talk about the WebPKI being coercively annoying, what we're really talking about are the roots of trust that the browsers have chosen to trust. No browser requires OV/EV.

Yes, a baseline system built on a blockchain could support the validated identity and KYC features of OV/EV certificates. Indeed, this already exists in Sovrin (sovrin.org).

The use case is knowing that a server is owned by who it says it's owned by as validated by a trusted KYC provider. For example, Stripe has an EV cert. Let's Encrypt does not support OV/EV because they cannot automate the KYC checks. Let's Encrypt is focused on the encrypted connection use case.

Can you name some examples?

Reply on news.ycombinator.com