Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Handshake – Decentralized naming and certificate authority

handshake.org

Post reply on HN
Print view View original

41–50 of 104 posts

Re: Handshake – Decentralized naming and certificate authority

#41

Post by xvilka »

capableweb wrote: post #33
rvz wrote: post #29

Earlier quoted context omitted.

> It's 2022, and there are plenty of production-ready non-PoW chains out there already. Yeah. Like Solana, Polygon, Helium, Celo, etc? Which they went down. Why would something that operates like a CA, DNS or TLDs be suitable on those 'production-ready' chains? PoW makes sense for this use case. > Please stop killing the planet. I agree. I'd rather have something useful burning the planet and is an improvement than s…

> Yeah. Like Solana, Polygon, Helium, Celo, etc? Which they went down I do know Solana has had downtime and Celo not even being a cryptocurrency but something centralized, but when did Polygon have any downtime? I have some automation happening over the Polygon network and never encountered any downtime, when did this happen?

Cardano/Ada never went down as well.

Re: Handshake – Decentralized naming and certificate authority

#42

Post by RL_Quine »

capableweb wrote: post #36
RL_Quine wrote: post #24

Earlier quoted context omitted.

> The search bar on their homepage returns no handbrake results That's sadly not correct. https://www.namecheap.com/domains/registration/results/?doma... For example using "beast mode" on the front page search, a good portion of the domains are "handshake" entries with only a tiny little (i) button to distinguish them from actual domain names which could be used in the real world. I can add them to my cart with no ot…

> For example using "beast mode" on the front page search, a good portion of the domains are "handshake" entries with only a tiny little (i) button to distinguish them from actual domain names which could be used in the real world. I also see a "pill" / "tab" that says "Handshake" and hovering the "tiny little (i)" kindly informs you what Handshake means. https://i.imgur.com/kr0465o.png Do you not see the same design…

https://i.imgur.com/FqG1Mjj.png

Three of the four domains here are on sale, all have a pale blue pill with white text, two have a (i) logo, one of them is nonfunctional and can not be used as a domain name in the way that a customer would typically expect. It's an incredibly deceptive listing in the wider context, nothing about the way it is presented would make you even consider that what is being sold in that line is valueless for a normal use case of buying a domain name.

Re: Handshake – Decentralized naming and certificate authority

#43

Post by mavhc »

jedimind wrote: post #39
chriswarbo wrote: post #32

Earlier quoted context omitted.

> So perhaps we also should look at stopping running broken machine learning / deep learning models continuously on many data centers for 10+ years which that is also incinerating the planet. That's Whataboutism https://en.wikipedia.org/wiki/Whataboutism

That's a Nonargument https://www.merriam-webster.com/dictionary/nonargument . Giving examples of technologies that can also be considered "a waste of energy" is a valid argument. Why is using energy playing graphics intensive games with high-end graphics cards not considered a "waste of energy"? It's a value judgment that lacks perspective. Dismissing some technology for its energy usage without providing a better al…

Just tax everything the amount it costs to clean up the pollution it causes, then you can do whatever you want without a problem

Re: Handshake – Decentralized naming and certificate authority

#44

Post by mavhc »

rajman187 wrote: post #37

A very similarly named startup that seeks to help college students find their first opportunities https://www.crunchbase.com/organization/handshake-2 Meanwhile, the claims on this website: > Email became Gmail, usenet became reddit, blog replies became facebook and Medium, pingbacks became twitter, squid became Cloudflare, even gnutella became The Pirate Bay While not even accurate, these centralized services became…

Mostly just shows that open systems require more resources to develop at as rapid a pace as closed systems.

Email/Usenet were fossilised the day they were born pretty much, we're still living with stupid fixed width lines of text in 2022, people just gave up on replying correctly, and no one could fix usenet spam.

Web apps have instant new version deployment, but are centralised, automatically updating docker containers are probably a half decent solution to a federated network.

The most popular website creation system is Wordpress though, that's mostly open and decentralised

Re: Handshake – Decentralized naming and certificate authority

#45

Post by tialaramex »

rhyselsmore wrote: post #27
lizardactivist wrote: post #21

A very big security problem with current domain certificates is that browsers accept any certificate for any domain, as long as they trust the issuer. There is no concept or notion of who is supposed to have issued the certificate.

Certificate Transparency Logging allows you to view the issuances of certificates. CAA records provide some extra defence ( https://en.m.wikipedia.org/wiki/DNS_Certification_Authority_... ). It’s not perfect, but it’s getting better.

Specifically the purpose of CAA is to enable a subscriber (say, the owner of ycombinator.com) to tell trustworthy Certificate Authorities thanks, but no thanks. It is not a message for anybody else. If you're not a CA you don't need to read CAA records.

For example, say you're Facebook, you've got an arrangement with DigiCert where on top of the Ten Blessed Methods of the Baseline Requirements, DigiCert promises to go exclusively through a six man "Certificate management" team at Facebook for all .facebook.com and .fb.com names. Even if Marketing really wants coca-cola-advert.facebook.com they can't get a certificate without an OK from that six man team. Well, (and something similar really happened years ago) the deal you cut with DigiCert doesn't magically apply to every other CA. The Baseline Requirements do, but not your custom deal, so other CAs don't need to know about your rules and may issue coca-cola-advert.facebook.com certificates to the marketing guys who've set up the coca-cola-advert.facebook.com web site just obeying the Ten Blessed Methods.

CAA records are in the Baseline Requirements, and so Facebook can write a CAA which says "Only DigiCert may issue". And if you look with your preferred DNS querying tool, that is exactly what they did. CAA for facebook.com is 0 issue "digicert.com"

If you posit that there are crooks at some other CA issuing bogus certificates, CAA doesn't stop that. The crooks can ignore such a rule, the same way a crook can ignore the "Employees only" sign on a door. But, we can see what the public CAs are doing, so, if any of them are crooked we can notice that and kick them out. For the most part humans, including those running a CA, can be lazy and incompetent but they aren't malevolent.

Re: Handshake – Decentralized naming and certificate authority

#46

Post by whatisweb3 »

Application-level protocols should not be attempting to secure their own consensus mechanisms - it ties the security of the application to the base token.

If you are seeking decentralized naming and certificate authorities you can look at Ethereum and ENS. Besides the eventual transition to Proof-of-Stake, building an application on top of an existing consensus mechanism means that your application will inherit the security of that blockchain.

Re: Handshake – Decentralized naming and certificate authority

#47

Post by rvz »

p4bl0 wrote: post #6

Another similar and interesting project, and which is not blockchain-based, is the GNU Name System: https://www.gnunet.org/en/gns.html

Out of the gate from [0], as soon as one tries to install it, they are met with this:

   Notice: GNUnet is still undergoing major development. It is largely not yet ready for usage beyond developers.
On top of the Linux-focused attitude to this project (GNUnet, GNS, etc) which that is already limiting its usefulness and user friendliness to the average joe, if it is not available on other systems like Windows or macOS how does one even begin to use it?

At the very least it should be accessible via a browser. For Handshake that is accessible with the Beacon Browser. [1] Ethereum Name Service (ENS) domains are accessible via Brave Browser, and Beacon Browser [1]. That gives the impression to general users that it actually works.

[0] https://www.gnunet.org/en/install.html

[1] https://impervious.com/beacon

Re: Handshake – Decentralized naming and certificate authority

#48

Post by aaomidi »

dotancohen wrote: post #23
lizardactivist wrote: post #21

A very big security problem with current domain certificates is that browsers accept any certificate for any domain, as long as they trust the issuer. There is no concept or notion of who is supposed to have issued the certificate.

How would that work? Add another DNS record? It would have to be out of band as the server cannot be trusted (see HPKP), and DNS itself could just as easily be MITMed as an HTTPS request, often even moreso.

That’s what CAA records are for, and the enforcement is happening before it gets to the end user by the various root programs.

Re: Handshake – Decentralized naming and certificate authority

#50

Post by noname120 »

rvz wrote: post #26

This is the only rare valid use case and need for a blockchain given the seizure of TLDs like what happened to .org [0] recently. It's very interesting to see Namecheap, Gateway.io, Encirca, etc use it and its very surprising to see some ICANN TLDs being claimed on Handshake. [0] https://news.ycombinator.com/item?id=21611677

I agree.

I'm not very convinced about the upside-downside ratio of this implementation though

But it has the merit of being a blockchain use that isn't complete non-sense.

Post reply on HN