261–270 of 440 posts
Earlier quoted context omitted.
Not really? .com and .net are still up If Let's Encrypt goes down, half of the Internet will become inaccessible in a week.
Presumably if LetsEncrypt goes down and stays down for a week, the sites that go down are the ones that see that their CA went down and at no point in the week take the option to get certs from a different CA?
Earlier quoted context omitted.
> Yeah it's only the third largest economy in the world You can both be the 3rd biggest economy in the world and still only be 1/10th of US+China GDPs combined. And only three companies in the Top 100 for Germany: https://companiesmarketcap.com/ Germany is the kingdom of the "mittelstand": many, many, many SMEs. Both GP and you are right: it's the 3rd largest economy in the world and yet it's simply not that big. htt…
what's SME?
Cloudflare has now disabled DNSSEC validation on their 1.1.1.1 resolver: https://www.cloudflarestatus.com/incidents/vjrk8c8w37lz
Welp. I think can call it on DNSSEC now.
Earlier quoted context omitted.
Yeah it's only the third largest economy in the world
> Yeah it's only the third largest economy in the world You can both be the 3rd biggest economy in the world and still only be 1/10th of US+China GDPs combined. And only three companies in the Top 100 for Germany: https://companiesmarketcap.com/ Germany is the kingdom of the "mittelstand": many, many, many SMEs. Both GP and you are right: it's the 3rd largest economy in the world and yet it's simply not that big. htt…
Earlier quoted context omitted.
"The internet's famous "routing around damage" isn't quite working here." DNS is a look up service that runs on the internet. Internet routing of IP packets is what the internet does and that is working fine (for a given value of fine). You remind me of someone using the term "the internet is down" that really means: "I've forgotten my wifi password".
Us non pod-people caught his drift.
Earlier quoted context omitted.
It's not made easier by the fact that a lot of cryptography is either very old and arcane or it's one hell of a mess of code that doesn't make sense without reading standards. I had the misfortune of having to dig deep into constructing ASN.1 payloads by hand [1] because that's the only thing Java speaks, and oh holy hell is this A MESS because OF COURSE there's two ways to encode a bunch of bytes (BIT STRING vs OCTE…
The trick to asn.1 is to generate both parser and serializer from the spec. Elliptic curve math on the other hand is ... yeah, you need to know the math and also know the tricks to code that implements it. Both of those have steep learning curve, but it's hardly because it's a mess or it's old.
It wouldn't be as bad if asn.1 had cought on more as a general purpose serialization format and there were ubiquitous decent libraries for dealing with it. But that didn't happen. Probably partly because there are so many different representations of asn.1.
A bespoke serialization specifically for certificates might actually have aged better, if it was well designed.
Earlier quoted context omitted.
ASN.1 is not used because of just bitpacking. There are other benefits to ASN.1 and it's probably one of the least problematic parts there. People who have thought they can do better have made things like PGP. It's one of the worst cryptographic solutions out there. You're free to try as well though.
People who though they can do better did JWT, that is not complicated at all and has no bugs as well. Also solves 20% of what asn.1 is used for.
And there is a related binary format that uses CBOR (COSE) as well.
Earlier quoted context omitted.
How simple sysadmin was in 1994 with no cryptography on any protocol. Everything could be easily MITM'd. Your credit card number would get jacked left and right in the 90s.
Cool. Feel free to explain how to tighten things up. I've just given them part of a recipe for using DNSSEC. I suspect you are not actually human .. qingcharles.
I must be early. There's not a single tptacek DNSSEC rant in this thread yet.
doesn't this event speak for itself though?
Earlier quoted context omitted.
The trick to asn.1 is to generate both parser and serializer from the spec. Elliptic curve math on the other hand is ... yeah, you need to know the math and also know the tricks to code that implements it. Both of those have steep learning curve, but it's hardly because it's a mess or it's old.
The problem with ASN.1 is that it is big and complicated, and you only need a fraction of it for cryptography, and it isn't really used for anything outside of pki anymore. It wouldn't be as bad if asn.1 had cought on more as a general purpose serialization format and there were ubiquitous decent libraries for dealing with it. But that didn't happen. Probably partly because there are so many different representations…