wibbler2

one of the main points of the article is that people don't check fingerprints, and that you should use encryption layered on top of IRC if you want any real privacy

it's an IRC network aimed at gamers where 98% of channels are public and free for anyone to join without any form of authentication ever.

so you'd be more accurate to say it covers 98/100 of cases, and we leave the other 2 open

the main obstacle these days is that a secure PKI deployment for a network ran by 40 different companies with no legal structure is a hard problem, not the technical challenge of putting a cert in your ircd.conf

author here, note that my view has somewhat changed from that which I held in 2009 from "it's silly" to "we'll do it if when we solve a few problems first."

PKI deployment in a semi-untrusted environment is still very difficult.

freenode messed it up by sharing their private key between all irc servers, which are hosted on other people's hardware. they had servers compromised in this period, and no forward secrecy enabled, so any TLS traffic captured over those multiple years has been effectively compromised.

presumably this was done to save money on CA fees, a problem that's gone away now that letsencrypt exists.

note that when I wrote the article the general assumption was that openssl was a reasonably good piece of software... not many people hold this view today.

an ircd isn't as easy to upgrade as nginx, upgrading them each time there's a new openssl vulnerability would make for a very splitty network.

separating the tls termination from the ircd (and locking it in a seccomp sandbox) would allow it be restarted independently... and is in progress.

(re: nickserv passwords, our channel service supports CRAM-MD5, so that isn't really a problem)