Replacing cert authorities with something DNS-based (or alternative decentralized DNS based) doesn't actually seem relevant to the problem they are highlighting, of sci-hub's DNS records being removed by private or government actors making it harder to find sci-hub... no?
In what sense is DNSSEC decentralized? IMHO signing the root zone is about the most-centralizing thing that has ever happened to the Internet.
Handshake [1] is the next generation of DNS, as opposed to the ICANN controlled legacy system. It is more decentralized since a single actor does not control the system. You cannot be de-platformed without the consensus of the community and a fork, as opposed to a decision made by a single or small group of actors.
> Or does it also serve as a certificate authority somehow?
Since you can verify a certificate against a DANE TLSA record which is retrievable from a DNS zone with DS records stored on chain, the CA is no longer required for trust -- only cryptography. Checkout the paper which goes into far more detail [2]. The entire system actually incentivizes the Internet to become more secure -- which is pretty exciting!
> Is it actually more decentralized than DNS
It's more decentralized than DNS in that the root becomes the blockchain instead of ICANN. This project simply finishes the beautiful DNS ecosystem, which was already decentralized, other than the root.
Now we are all root, democratically.
Its an alternative DNS, with a method to use that alternative DNS as a way of authorizing ssl certs too?
It perpetuates that problem of ICANN DNS becoming a "business" instead of solving it. (ICANN DNS domain names were originally free.) The potential for censorship is only one problem of ICANN DNS.
Also, this project introduces a new problem of wasting energy on mining tokens.
This is a major problem that the project has made a sincere attempt to address. Through scarcity certain sybil protections are afforded, which has been inherently architected into the consensus protocol [1]. Additionally, an airdrop to many internet pioneers and open source developers was built in as well, giving everyone similar resources to participate in the auction system which, in turn, affords everyone more equality in participation. Finally, the top 100k names as per alexa were pre-reserved for the holders in the alexa list, and these sites are incentivized to properly setup DNSSEC, as that's the only way they can claim their name on handshake.
This is a win for internet security and internet users. It's absolutely a big win for freedom of speech.
> the owners are ... selling the DNS naming hierarchy
The blockchain is providing names in a global namespace owned by the commons.
I cannot understand why you have been harassing and stalking this project with troll-like behavior and rude, snarky comments. Let's try to be constructive and provide value to society and the future. The next generation reads these threads, and they look up to you. There's no reason for you to change that. And with that respect, not to sound all Uncle Ben on you, does come responsibility.
Either way, love you tptacek and appreciate your contributions to HN. I can honestly say myself, that I've learned a lot by simply being audience to your conversation.
Cheers.
Where you lose me, like, all the way across the horizon is where the people who start that infrastructure do it with a traded coin that they've premined, allocated huge chunks of to themselves, and then "airdropped" to a set of developers they collected in 2018.
Why would anybody sign up for this? I genuinely have a hard time understanding why anybody would take this seriously. It's a plan to replace the DNS roots with... some company? That just decided they should be the ones to own it?
Actually, almost everything happened that way in the history of mankind, right? xD
> the people who start that infrastructure do it with a traded coin
All the names could be registered by one monopolistic player on the public blockchain. That's why a cost function is required.
> that they've premined, allocated huge chunks of to themselves
A huge chunk was not allocated to anyone other than FOSS developers. Please review the paper [1] for specific allocations.
> "airdropped" to a set of developers they collected in 2018.
To be clear, this set consists of any developer on github who had 15 or more followers in 2019, the PGP web of trust strong set, and anyone on HN who had a keybase account in their profile.
> Why would anybody sign up for this? I genuinely have a hard time understanding why anybody would take this seriously.
I don't think there is anything to sign up for? Secondly, you absolutely don't need to use the new internet if you don't want to - just like nobody forces you to use anything else in this world. You have a choice. That said, we'll miss you. :(
> It's a plan to replace the DNS roots with... some company? That just decided they should be the ones to own it?
So actually, the DNS root is owned by some company [2] that is under the jurisdiction of California law. It used to be, and still basically is, owned by the US Department of Commerce. Internet users are replacing it with a public blockchain owned by the commons.
Historically, revolutions happen all the time. Now it's the time for democratization of naming. Is there any good reason why we shouldn't own our own names? I think that the name might even be more valuable than money. What is anything without a name?
Could you clarify a bit for me? I checked both of those boxes. Does that mean I have some of this premined crypto somewhere? How would I get to it? The paper you linked to is very long, but I am intrigued so will likely check it out.
I love the idea here. Decentralized web is sorely needed. If we can make it usable, that would be amazing.
I agree with you! Recent times have shown how much we need the decentralized web than ever before.
Yeah, no, that's not how this works. People don't want your "new internet". People want the Network, and in our era it so happens that's the Internet (previously it was the Public Switched Telephone Network, and before that the Universal Postal Union). But it isn't your "new internet" of a few enthusiasts who are sure it'll work this time even though it hasn't worked the previous times it was tried.
> Is there any good reason why we shouldn't own our own names?
A name is what something is called. In London there is a famous river crossing which was officially named after an equally famous politician. William Pitt (the Elder). But people didn't call it "William Pitt Bridge" or even "Pitt Bridge". People called it "Blackfriars" because that's the district of London it is in. Nobody you ask in London will know where "Pitt Bridge" is. There is no "Pitt Bridge" you want "Blackfriars".
Perhaps you've never visited London. Lots of HN folks are from Silicon Valley. San Francisco has a bridge that joins the city to Oakland, I happen to believe it should be named after the Emperor, "Norton Bridge" seems like a good name. But is that what it's named? No, because even if a few agree with me, on the whole people call it the "Bay bridge" and a name is what something is called.
This seems to be a hard concept for some people to manage, but it's mandatory, so there isn't anything I can do about that.
> Historically, revolutions happen all the time.
Historically most attempted revolutions fail. In hindsight it is often clear they could never have succeeded. I think Americans have a fairly recent memory of what failed revolution looks like.
> So actually, the DNS root is owned by some company that is under the jurisdiction of California law.
In practice (and perhaps this will annoy tptacek but too bad) this isn't usefully true. ICANN's control of the DNS root is by consent, the same way that say, the English Parliament is sovereign by consent, so just because California law says they can do something does not in fact mean it will have the effect envisioned in California law.
You're absolutely right in that it changes.
> Historically most attempted revolutions fail.
Yet, my statement still stands: Historically, revolutions happen all the time. Risk of failure is not a reason not to proceed. As they say, "give me liberty or give me death!"
> ICANN's control of the DNS root is by consent
I agree with you completely. Let's see for how much longer the people will consent to their rule vs a democratic rule by the commons!
Successful namespace hijacks rely on overwhelming numbers. You need to have so many people using your hijacked namespace that you've got way more people who do not even know that it's a hijack but are using it anyway than the existing administrators had total engagement so that it's pointless to argue with you.
Handshake can't get there from here, most of the world now uses the DNS hierarchy. This was a fool's errand. Carving themselves out a niche might have been possible, if they had been content with a niche but it's clear that their financial motives dictated they try for the impossible instead.
Like all things in the world, the namespace will be democratized. The people do deserve to own their own namespace, and even if you wish or hope for democracy to fail, I'm confident either this project or another will one day succeed. Everyone in the community is selflessly working towards this goal for you and everyone else in this world's benefit. It's a quiet space without accolade or reward.
If they are fools, then I hope to be the biggest fool.
Finally, nothing in life is forever just like nothing is impossible my friend. As a hacker and developer, we always find a way.
Here is a different idea. The intent is not "world-takeover" or "winning" any imaginary popularity contest but just a different kind of DNS service, because, well who needs a reason. Because we feel like it, how's that. The idea is: Start a registry that only allows djb-designed per-packet encrypted DNS to be used. That is, all persons running authoritative nameservers must follow some rules. They must publish public keys in subdomains of the nameserver's domain. For an example of how this looks, do an NS query to ianix.com. All authoritative nameservers in this imaginary registry would be required to offer per-packet encypted DNS. It would not be that difficult to start something like this at least on a small scale. People running authoritative nameservers simply need to run a CurveDNS forwarder in front of their preferred authoritative nameserver implementation. The CurveDNS forwarder is a small piece of free, open-source software. This type of encryption is different from DNSSEC, so this is not a "replacement" or even an "alternative" to that movement. It is something totally different. The purpose is not to address risk associated with shared DNS caches (e.g., poisoning and other tricks) as DNSSEC is intended to address, it is not to distinguish an "approved" domainname versus an "unapproved" one by creating some "chain of trust" to a "root". The purpose is just to encyrpt DNS packets. The focus is authoritative DNS, the folks that actually own the web resource, not recursive DNS, third party DNS cache providers, etc. There are couple of reference implementations of the DNSCurve-enabled cache and one of a dig-like client users would run on their home/own networks to send encypted queries and decrypt responses. This whole system for encrypting DNS has been around for over a decade and IMHO is easily as "battle-tested" as anything DNSSEC. Does that mean everyone should use it. No. But it means anyone could use it. For no other reason that because they feel like it.
The main problem something like Handshake is purportedly aimed at solving, namely centralisation of who controls "the" DNS, is IMO caused by the commercialisation and making a "market" for names. There is no way anyone is going to solve the centralisation problem by offering a commercial alternative that replays the "Gold Rush" of the first DNS (not to mention all the corruption that followed, culminating in "new gTLDs" for $185,000+). If we want to level the DNS playing field, then IMO we would have to take the money out of it. That might mean "vanity" names are not as important. Who knows, public keys might play a more important role. I am thinking of those Facebook workers who "brute-forced/mined" some .onion name they thought was more recognisable. Silly. "Decentralised" would seem to imply more equality across the namespace, not "I snagged the best names before everyone else" (using x kilowatts in the process) or "That name sucks."
Just an opinion. Good luck with the blockchain.
Already available:
These days sometimes the same entities provide both SSL certificates and DNS, but they are different services.
> Handshake is “is effectively a decentralized domain name server,” Roquerre said. Instead of using the web-standard certificate authority to authenticate user connections to a server, Handshake stores references to the IP address of the websites registered in its system. Namebase is a platform that offers users access to the Handshake network
That makes no sense at all. But it sounds like handshake is simply an alternate DNS protocol? Or does it also serve as a certificate authority somehow? Is it actually more decentralized than DNS (which is already of course decentralized in one axis, but not the relevant one for keeping a lookup available if the entity hosting DNS decides to remove it).
Very confusing.
It seems like tor .onion address would be an actually mature solution to this problem, instead of this thing that seems like press release babble?