Hacker News Reader

Comment by teddyh | Hacker News Reader

The “rent-seeking certificate infrastructure” could be solved if web browsers used the DNS (and DNSSEC) to validate certificates. The DNS, on the other hand, is more tricky. If you want human-readable and globally distinct (and stable) names, you have to have a centralized structure to keep track of who has what name. The best we could come up with was the DNS, which is at least hierarchical instead of completely monolithic. And then it becomes a question of: do you want name holders to continually pay for names in some way, or do you want a land grab model where the person who snagged a name 30 years ago now owns it forever for free? With DNS, that question is decided by each node in the tree of the hierarchy.

View on HN

I think something that is overlooked in this discussion is the idea that names must be unique. If we relax this constraint, the solution space opens up significantly. I don’t believe uniqueness is a fundamental requirement of a name service because I don’t believe that a human-readable string itself carries sufficient information to be trustworthy in and of itself.

(Sorry for the delayed reply, my account is heavily rate limited, so I don’t get to post more than 5 times per hour and less when someone with high karma like downvotes a post and leaves a comment.)

I wonder if you are just seeing the standard five-minute delay that everyone gets when replying inline in a thread. That delay is indeed intended to discourage too-fast back and forth comments, which sometimes lead to arguments.

If that is what you've encountered, you can bypass the delay by clicking the timestamp of the comment you want to reply to. This opens the comment in its own page with a reply box.

Thanks, but no, I don't think that's what's going on here. What I'm experiencing is 60+ minute rate limits after 5 comments plus maybe 5 edits ("You're posting too fast, please slow down. Thanks."), frequently coinciding with higher karma (15k+) users leaving the first reply and a -1 or -2 downvote balance that usually eventually fights its way back up to +1 or +2. When this happens, I'll try to post every 20 minutes or so to test the boundary. Of course, doing that might be tripping a sliding window, or it might be indeed a stricter rate limit. It's hard to know for sure what's going on. In any case, I don't expect an explanation, if the site is really giving super downvotes to certain users with or without their knowledge, telling people that that's the case would undermine the impact of the approach.

> I think something that is overlooked in this discussion is the idea that names must be unique. If we relax this constraint, the solution space opens up significantly.

Hmm. At some point, a user agent would need to disambiguate between competing identical names somehow (at least for the sort of names that identify global internet resources). Are you assuming the existence of a web-of-trust of some sort as an arbiter?

Well, at some point the end-user will have to make a judgement call about the authenticity of the server they're interacting with, but that is no different from what happens now.

>land grab model where the person who snagged a name 30 years ago now owns it forever for free?

This is already the case with the current dns, since paying $10 per year is pretty much nothing to any middle class investor, so they do in fact "own" it forever for "free", relatively speaking.

If I had 10 dollars a year from everyone saying this I would be a new FAANG. Why is everything aimed at middle class Americans.. the average salary around the world is a lot smaller and many domains extensions exists which Americans can't buy.

The early adopters got the first twitter names, instagram names, etc for free forever. People invested time signing up when you never thought of it and they get rewarded.. the platform gets the early adopters. We don't force users to pay and let other take the name and continue to be that person.

Domains should be the same. When a domain expires someone can buy it and pretend they are the original owners.

If they were free you could buy coolformatbestnamecoolformat still get the name you wanted and use a prefix postfix custom format to identify with a group. rubycooldomainruby reactcooldomainreact

Human-readable names can potentially be pseudo-random, and thus securely generated. What's hard (indeed, considered largely infeasible) is meaningful, decentralized, secure names.

What part of ENS doesn't meet your expectations?

It wasn't designed to replace DNS, but there are an increasing number of people using it for that.

It is not always about what something is not doing, but rather the unintended (often malicious) use cases it enables without any way to prevent or mitigate.

curious what “malicious” use cases a decentralized name registry enables that dns doesn’t?

[cricket tunes intensify]

you're focusing on the first part (what it enables) and not the last part (without any way to mitigate)

This, for example I lost my keys or my keys were stolen

ah interesting. won’t multi sig solve this issue? create multiple keys, and have a 2/3. if you lose one, hope you don’t lose the other.

and also - there may be a way for the naming contract to use social recovery for keys.

>Human-readable names can potentially be pseudo-random

No matter how you dice it, getting humans to remember 128 bits of entropy is going to be a non-starter. Encoding those 128 bits using words doesn't really solve the problem.

I was going to argue that remembering "CorrectBatteryHorseStaple.com" is leagues easier than remembering an 128 bit number, but then I did the math and using the 20k most common english words to encode 128bits you'd need an 8 word phrase, which pretty much solidifies the point you've made.

I mean, people can recite poetry far longer, even nonsense poetry ("Twas brillig, and the slithy toves / did gyre and gimble in the wabe") so it's not impossible. But generally speaking, yeah. Nobody wants to navigate to that bit of jabberwocky instead of google.com

It does kind of make me long for the days of the HOSTS file, where anyone might alias a hard-to-remember address as something locally meaningful.

it was considered infeasible until bitcoin demonstrated that it was feasible, as zooko agreed: http://www.aaronsw.com/weblog/squarezooko

http://web.archive.org/web/20210118172102/https://squaretria...

The problem I've got with any signed, cryptographically secure replacement for DNS (including a blockchain-backed solution) is that over time names will be lost. Just like bitcoins get lost.

You need some kind of "admin access" for the system that can fix things like lost keys, at which point you might as well stick with DNS.

or you could stick with losing the names

aaronsw proposed that you could expire unrenewed names after 12 months

i forget what solution namecoin and ens use

I hadn't considered expiry. That does lets lost names re-enter the pool, at least, even if not under the control of the original owner.

> If you want human-readable and globally distinct (and stable) names, you have to have a centralized structure to keep track of who has what name.

Apps on blockchains already play the role of that centralized structure. The most successful I'm aware of is ENS on Ethereum. Whatever economic model you prefer can be implemented this way.

Anybody involved in a "rent-seeking certificate infrastructure" is doing so by choice. Certificates are free. ISRG saw to that. Web browsers aren't going to use DNSSEC.

Reply on news.ycombinator.com