Hacker News Reader

No. It's an old hobby project which has nearly fizzled out; the web site hasn't been updated in years.

Alternate roots are on thin ice in general nowadays, especially as there's no reasonable way to safely issue TLS certificates for domains which aren't under the ICANN root. (Running your own CA introduces a lot of messy trust issues and is inadvisable.)

View on HN

Maybe if we switched from the current state of PKI with CAs to DNSSEC and DANE/TLSA, it would be easier.

But doing that would mean to either trust the current resolver you are using, which is unacceptable, as it's sometimes cloudflare or google, or running your own resolver on every device -- which also does not work. It is absolutely crucial for the DNS system we have today that there's a small number of resolvers that have large caches, otherwise root servers would blow up. Unless we massively start implementing some novel RFCs.

Reply on news.ycombinator.com