Hacker News Reader

Comment by tialaramex | Hacker News Reader

I think this is a stretch, like saying the X.500 Directory System is widely used based on the fact that PKIX is technically adapting X.509 and thus your TLS certificates depend on the X.500 directory system. End users aren't just "unaware" that it's actually the X.500 system, it functionally isn't the X.500 system, PKIX mandates an "alternate" scheme for the Internet and the directory called for by X.500 has never actually existed.

Likewise then, IS-IS is the protocol that OSI standardized, but we're not using as part of an OSI system.

View on HN

X.500 is widely used in the form of LDAP and Active Directory, however.

Active Directory is not based on X.500 and LDAP was directly created as an alternative to the DAP standard that is part of X.500.

While X.500 is a precursor to both of these things, and influenced both of these things, and both of these things interoperated with X.500, they are not X.500. X.500 is for all intents and purposes pretty much dead in 2024, although I did deploy an X.500 based directory service in 2012 and it's probably still alive and running.

LDAP is just "lightweight" protocol for accessing an X.500 directory service.

The semantics are the same for the accessed store, IIRC. The protocol definition explicitly talks about being used to access X.500 data stores as complementary interface to DAP (which requires lower layers of OSI stack vs LDAP's raw stream of bytes)

Yes, that is why it was invented, as I alluded to. LDAP was an alternative to DAP. DAP is part of the X.500 standard, LDAP is not. LDAP when it was first invented was built to access an X.500 directory. That is no longer a base requirement and most directories in the wild are not built on X.500. Standards mean things, just because LDAP was originally built to access X.500 doesn't mean it's part of X.500, and X.500 is a very detailed and specific standard which most directory services no longer follow.

To reiterate in a slightly different form: Ldap is an inheritor of, and successor to, DAP/X.500, but not backwards compatible and only superficially resembling it at this point.

Ironically there's probably more X.500 remnants in Active Directory than in the UMich-derived LDAP servers, thanks to its Exchange 5.5 legacy.

Reply on news.ycombinator.com