Viewing profile — indolering

Montenegro (.me) seems to be aligned with the EU. But I would have expected there to see a legal ruling in France before Montenegro would do this sort of thing. I wouldn't be surpr…

That's not how I remember it: it was an experiment that was useful at the time but didn't work out. It was useful internally to sandbox Flash player, but the limitations of the LLV…

I really wish I had messed with Windows Phone when it was a thing. They were the only ones not to just ship a clone of an existing interface ASAP. But it was closed source and offe…

The floating point "standard" was basically codifying multiple different vendor implementations of the same idea. Hence the mess that floating point is not consistent across implem…

The answer is unequivocally yes: RISC-V is designed to be customizable and a vendor can put whatever they like into a given CPU. That being said, profiles and platform specs are de…

I think it's a joke: you REALLY don't want to own your own servers.

[flagged]

I'm not unaware of this and I agree that WebPKI has greatly reduced global risk. New DNS tech takes a lot longer to implement but that doesn't mean we should kill DNSSEC support li…

> The same reasons not to deploy DNSSEC that face large organizations apply to you: any mistake managing your DNSSEC configuration will take your domain off the Internet (in fact, …

It can be used alongside WebPKI. And as someone who is worried about other protocols, it sure would be nice if I could setup DNSSEC for my domain and have clients pick up on that a…

More rhetorical dunking instead of engaging with the substantive technical issues. I'm done.

But it also applies to every other part of the stack, including WebPKI. Would you accept this as a valid argument against using HTTPS everywhere?

DNSSEC also solves a bunch of real world threat models that do cause massive security issues. I think we should put that effort into DNS as well.

That's fair! My primary gripe was about the need for non-profits to step in to begin with. Sorry if I didn't communicate that well. However, I'm don't feel sorry for registrars or …

I would really appreciate it if you would respond to my points instead of just moving on to another argument. Do you hardcode Github and AWS keys in your SSH config? Do you think i…

DNS is where domain name authority is delegated. Anything you build on top of that is also going to be a world of hurt if it gets compromised.

DNSSEC PKI does not preclude one from hardcoding specific keys in the client as well. Providing global PKI and enabling end-to-end authentication by default for all clients and pro…

Phishing existing isn't a good argument against cryptographically authenticating DNS records.

The engineering effort! ECC solves the theoretical concerns around latency anyway yet we have people arguing that it shouldn't be done. But if it was worth making HTTPS faster to s…

If DNS PKI is compromised, so is HTTPS. So yes, they would be scrambling too.

HTTPS also has expiring keys that also need to be rotated. Most people outsource this to a service provider for them - as is the case with DNS. It's weird how people gripe about st…

And for everyone else that just wants to connect to an SSH session without having to setup PKI themselves? Tying that to the records used to find the domain seems like the obvious …

> None of what you've written here applies to the TLS and WebPKI case, so I'm going to take it that you're not arguing that DNSSEC validation by clients provides a security improve…

> LE isn't primarily funded by non-profits, as you can see from the sponsor list here: https://isrg.org/sponsors/ I mean, Mozilla got the ball rolling and it's still run on donatio…

> They did, and then we spent an enormous amount of time to shave off a few round trip times in TLS 1.3 and QUIC. But if it's worth doing for HTTP, why not for DNS? > Actually, it …