Oh, but that's more a matter of where you start and what you bootstrap.

In both cases, DNS and TLS CA-based stuff is about trust. You need to trust the DNS server, as there could be malicious servers sneaking in, and you need to trust the cert.

But once you have a social network with a large strong set, you could base the trust on the strong set, and in particular, individuals in that strong set who can demonstrate that they have a clue.

Once we have that, we can get rid of these achilles heels, but quite frankly, I don't believe in a strategy that takes on those problems first.

Sure, I obviously got OpenNIC in my DNS resolution. Haven't once seen an address that required me to use it beyond when I set it up. I think our approach is much better. Base it on people and the strongest part of their network.

There are projects aiming to decentralize DNS and SSL as well. Handshake[1] decentralizes root DNS and enforces ownership through public-key cryptography. This gets rid of the need for Certificate Authorities which decentralizes both DNS and SSL in one go.

Disclaimer: building a registrar[2] for Handshake so we're pretty excited about it!

[1] https://handshake.org/ [2] https://namebase.io

Both DNS and TLS PKI (nothing uses SSL) are decentralized by design.

DNS at the root level is not decentralized. .com, .io, .net etc are centralized and even owned by for-profit companies.

Also DNSSEC requires a trusted root signature, I'd hardly consider that decentralized.

(But they have a key signing ceremony, so we can trust that it is secure.)

Who decides I can or cannot get foobar.tld?

That would probably be ICANN[1], and most authoritative name servers follow the policies set out there as the guiding committee is part of ICANN[2].

There are alternative DNS roots, though. I participated in running one myself for a time.

1. https://en.wikipedia.org/wiki/ICANN

2. https://en.wikipedia.org/wiki/Root_name_server#Root_server_s...

Thanks, I was thinking about ICANN, but i'm a bit tipsy and didn't want to discredit my point by misspelling an organization. Yet, this still proves my point, the internet, as we are experiencing it today, is based on different orgs simply playing nice by some rules established by a central authority. What if they stop doing that? What if the central auth is going to have something against you?

You are perfectly free to run your own nameserver, nobody has to use it though.

Yes I can run my own top level dns. Yes, people can chose to use my dns or they can chose to use the google one. The question is why would they do either, why would they pick mine over the google one, or the google one, over mine.

You can argue that the google dns can sign the answer with a cert you trust, thus you know you got the right answer. And then, when you get the address of the service you want to talk to, you can check their cert and know for sure you are again talking to the thing you want to talk to.

And here lies the problem, how are you going to check those certs? Are you going to queue at a google office and obtain a cert on a usb stick, then import that in you environment, then do the same for all other services you want to talk to? Or are you going to trust a central authority? What if this central authority is messing with you? What if someone up the chain is messing with your central?

Let's not talk about how your router might send your dns request to some guy's home server that answers to 8.8.8.8, instead of google and you can't do shit about it...

Everything we know about internet works the way it works, because everybody involved agrees to do the right thing, from ip routing, to dns resolving, to certs verifying. All of this is based on a set of rules set by a central authority, that everybody choses to follow. You can't speak about web decentralization as long as proving who you are is a very centralized system.

This means that in practice, DNS is not decentralized.