Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

F-Droid site certificate expired

gitlab.com

Post reply on HN
Print view View original

111–115 of 115 posts

Re: F-Droid site certificate expired

#111

Post by pas »

echelon wrote: post #79
pas wrote: post #74

Earlier quoted context omitted.

Things are "scare walled" because things are scary. Just because something claims to be OSI-fucking-open-source doesn't mean anything. It's better to be pragmatic. Agreed. The developer community needs to get its shit together if it wants to have carvouts compared to the other ~99.9999% of users.

> Things are "scare walled" because things are scary. It's 100% about power. Imagine if websites were scare walled. If Microsoft had owned the Internet, that might have happened. Websites can do "scary" things, after all. You can buy guns and knives and drive 60 miles per hour. You can give your banking information away. So many things scare the user less than Google does. Not to mention you have to go five settings…

trade offs are real. you can't simply claim that regulation on sharp metal sticks is not something that exists. (China and the UK for example)

guns are regulated everywhere, even in places with very lax gun laws.

believe it or not, but ... cars are regulated too!

I agree that we should stop being afraid, and especially we should stop being inconsistent (claiming to protect kids while doing absolutely none of the things that have favorable cost-benefit ratio with regards to actual kid protection outcomes).

I 100% agree with standing up for our rights, functions, features and all that means ownership of computing devices.

And when the chips fall to the ground it means that Google et al. has the right to do whatever the fuck they want with their shit.

And adding all this up leads to the obvious conclusion that we need to put our money where our mind is. (And we need to spend it at places where they are more aligned with our interests.)

Re: F-Droid site certificate expired

#112

Post by 0xbadcafebee »

xorcist wrote: post #110
0xbadcafebee wrote: post #81

Earlier quoted context omitted.

The registrar is not equivalent to a CA in DANE. - A CA validates requests, signs CSRs, publishes cert revocation, issues certificates and trust anchors. - A registrar in DANE merely passes a DS record you created to the TLD, along with the promise that this record was created by the domain zone owner. It's basically the validation step. Nothing to do with establishing or securing data, key/record management, etc; th…

The registry, not the registrar (sorry, I managed to mistype above, despite trying to be careful about these terms). The comparison with the CA is apt. The registry signs the DS record. The model you suggest is a variant of what I allude to in my second paragraph above. That is indeed both an obvious, simple, and much more secure model than the web PKI we use today. I tried to push for similar ideas several years bef…

I've added to my TODO list to propose an RFC. It might literally be up to the two of us to fix it :)

Re: F-Droid site certificate expired

#113

Post by alfiedotwtf »

Wowfunhappy wrote: post #75
tremon wrote: post #63

Earlier quoted context omitted.

> If you're on a traditional home internet connection, who exactly can tamper with your traffic? Your ISP can, and that's not great, but it doesn't strike me as blaring siren levels of terrible, either. This characterization in on the same level of sophistication as "the Internet is just a series of pipes". Every transit station has the opportunity to read or even tamper with the bytes on an unencrypted http connecti…

Thanks for this, I legitimately didn't realize every interlink in the entire chain has the ability to tamper with a connection. I'm still very concerned about the centralization of https but I understand the need somewhat more.

Ask gay people in Iran, Uyghurs living in China, and investigative journalists in Washington, if encrypting internet traffic is a good thing or not.

Maybe a more relatable scenario for you - it was only a few years ago that you could turn cable modems into promiscuous mode to see ALL PLAIN TEXT TRAFFIC of the people living in your street!

So, if you you still think encryption isn't needed for the average person - what's your gmail username and password?

Re: F-Droid site certificate expired

#114

Post by Tepix »

tptacek wrote: post #106
Tepix wrote: post #95

Earlier quoted context omitted.

There should be an option to go without a recognized CA by publishing your website TLS certificate details via DNSSEC. I don‘t see any disadvantages over automatically issued certificates.

(1) It doesn't work reliably, because middleboxes don't pass DNSSEC/TLSA records reliably, so there has to be a downgrade path, so it's strippable. (2) It's much slower than the TLS WebPKI. (3) There's no transparency log and never will be, both because it hasn't been designed and because Google and Mozilla basically had to mug the WebPKI CA's in a dark alley to make CT happen. (4) It requires you to set up DNSSEC, w…

    > (1) It doesn't work reliably, because middleboxes don't pass DNSSEC/TLSA records reliably, so there has to be a downgrade path, so it's strippable.
They need to be fixed but yes it is a real problem from what i've heard.

    > (2) It's much slower than the TLS WebPKI.
Caching should make it fast enough. Do you have real-world numbers?

    > (3) There's no transparency log and never will be, both because it hasn't been designed and because Google and Mozilla basically had to mug the WebPKI CA's in a dark alley to make CT happen.
That is an excellent point. Do you have a solution?

    > (4) It requires you to set up DNSSEC, which is so error prone that some of the largest engineering teams in the world have managed to take their sites (and also countries) offline.
I really don't like DNSSEC myself – i'd rather have seen DNSCurve https://dnscurve.org/ succeed – but at a certain point, i think we just have to go with it.

Re: F-Droid site certificate expired

#115

Post by tptacek »

Tepix wrote: post #114
tptacek wrote: post #106

Earlier quoted context omitted.

(1) It doesn't work reliably, because middleboxes don't pass DNSSEC/TLSA records reliably, so there has to be a downgrade path, so it's strippable. (2) It's much slower than the TLS WebPKI. (3) There's no transparency log and never will be, both because it hasn't been designed and because Google and Mozilla basically had to mug the WebPKI CA's in a dark alley to make CT happen. (4) It requires you to set up DNSSEC, w…

> (1) It doesn't work reliably, because middleboxes don't pass DNSSEC/TLSA records reliably, so there has to be a downgrade path, so it's strippable. They need to be fixed but yes it is a real problem from what i've heard. > (2) It's much slower than the TLS WebPKI. Caching should make it fast enough. Do you have real-world numbers? > (3) There's no transparency log and never will be, both because it hasn't been desi…

It's not going to be fixed. You have to design protocols for the Internet we actually have, not the one you want. I don't have a solution for any of these problems; the conclusion I come to is, DNSSEC is a dead letter. That's happened with lots of protocols in the past, and it is going to happen with this one too.
Post reply on HN