Hacker News Reader

Comment by renewiltord | Hacker News Reader

If we had namespaces that were SSL-signed and DNS piggy-backing this wouldn't be a problem, right?

I recall that when I published to Maven Central, they needed to verify ownership of the package namespace via reverse DNS, i.e. com.ad13f9c.blah package comes from someone controlling ad13f9c.com effectively. It was not complete, of course, because:

1. I don't think the package signature is checked on download, only on upload

2. Ownership of the domain originally and continued ownership of the GPG key will keep you in the running forever

But if we had namespaces with a signature signed by an SSL key and then we could lookup against DNS and then query for the SSL cert, then we're good, right? The Rust ecosystem is hard to use on a plane already so surely that cannot be the constraint.

View on HN

The article is about typo-squatting, there is nothing preventing someone from squatting postgress.org. Also domain registration expires, and allowing someone to take over leftpad.net because the previous volunteer maintainer didn't pay a yearly fee is an anti-feature.

I'm only talking about domain ownership here because I don't understand how this scheme could benefit from TLS certificates. Anybody can get a certificate if they control the domain anyway.

1) Typosquatting DNS adds cost (it's harder to spam the namespace), and it forces the attacker to put down a credit card.

2) Go-style import URLs prevent you from typosquatting a large part of the path. On `example.com/hrd2spll` you can't typosquat the latter part (which would be easier to attack), only the hostname.

> 1) Typosquatting DNS adds cost (it's harder to spam the namespace), and it forces the attacker to put down a credit card.

It also raises the bar of who will publish things. I have a few random projects on github that some people seem to use. I wouldn't pay for a domain name to publish those.

github.com/vladvasiliu/foo works fine, if that's what you want.

How would signing malware prevent that malware from being distributed? I feel like there’s something implicit you haven’t stated that I’m missing.

Ah you're right. I was imagining that folks would get their certs from an out-of-band flow. Welp, there's no reason to expect that. This is why I don't do security, I suppose. Whoops.

This would be very operationally complex (publishing a package means you now have to maintain a website and a TLS cert) for relatively little immediate gain (as an end user, I'm still blindly trusting `coolcrates.biz`).

Reply on news.ycombinator.com