Conversation

Notices

1. Embed this notice
   silverwizard (silverwizard@convenient.email)'s status on Wednesday, 20-Nov-2024 04:33:44 JST silverwizard

   • Neil Brown
   @neil Yeah, saved the dying system, but I just can't considered it good, and am constantly surprised others do. (I'm not trying to tell you to hate it, but ya know, strong opinions, internet)
   • Embed this notice
     silverwizard (silverwizard@convenient.email)'s status on Wednesday, 20-Nov-2024 05:00:37 JST silverwizard

     in reply to

     • Neil Brown
     • shiri
     @shiri @neil DANE is the most sensible replacement, but has some weaknesses.
   • Embed this notice
     shiri (shiri@foggyminds.com)'s status on Wednesday, 20-Nov-2024 05:00:38 JST shiri

     in reply to

     • Neil Brown

     @silverwizard @neil has anyone actually established a better system really?

     Not going to argue that LE doesn't have it's problems, or even just the underlying SSL system in general.

     LE thanks to ease and being free without much "competition" it has the crucial problem of hosting far too high a proportion of the the certs for the whole internet.

     SSL in general has the problem of CAs getting hacked and issuing fraudulent certs.

     Only improvement I can think of in that security at all is maybe double-certified certificates? (require you to go through two wholly separate providers with the same key to have a valid key and requiring both to sign for any updates to go through and maybe a certificate chain for whenever it changes hands)

     Beyond that it's always a cludge, people aren't going to check them themselves, they're not going to manage certificates themselves... so you just have a preauthed group of keys installed in your system, trust them to be above board, and then trust the providers of those keys to be above board. Honestly shocked we haven't had more issues, but that's kinda how security goes.

   • Embed this notice
     shiri (shiri@foggyminds.com)'s status on Wednesday, 20-Nov-2024 05:59:31 JST shiri

     in reply to

     • Neil Brown
     @silverwizard @neil For others since it's not trivially searchable: en.wikipedia.org/wiki/DNS-base…
   • Embed this notice
     silverwizard (silverwizard@convenient.email)'s status on Wednesday, 20-Nov-2024 05:59:31 JST silverwizard

     in reply to

     • Neil Brown
     • shiri
     @shiri @neil Sorry, I might be too deep into this
   • Embed this notice
     shiri (shiri@foggyminds.com)'s status on Wednesday, 20-Nov-2024 06:10:31 JST shiri

     in reply to

     • Neil Brown
     @silverwizard @neil nah, just "DANE" is kinda also a word and most people are still using google to search so lord knows where they end up
     silverwizard likes this.