Privacy activists oppose EU plans for a GDPR-compliant Whois v2

Re:Privacy activists oppose EU plans for a GDPR-compliant Wh... by greatgib on Saturday October 16, 2021 @07:41PM (#28892607)

Here you can see a multi-year plan and no one complained when it was possible: - let's force everyone to use https. - but https relies on verified domain names and this comes with a cost... Solution: here is let's encrypt, so https everywhere is justified - last step, use the fact that registrar are centralized to ensure the identity of all domain names holders, anonymous servers without https will not be reachable by normal people!

[ Parent | on HN ]

Re:Privacy activists oppose EU plans for a GDPR-compliant Wh... by walterbell on Saturday October 16, 2021 @08:51PM (#28893002)

There are stakeholders who want Real Name digital signatures for git commits to "critical" open-source software and every dependency. There is already a numerical score for OSS which determines whether bug fixes will be funded by Google and others,

https://openssf.org/press-release/2021/10/13/open-source-sec...

[ Parent | on HN ]

Re:Privacy activists oppose EU plans for a GDPR-compliant Wh... by shadilay on Saturday October 16, 2021 @09:01PM (#28893059)

That sounds like a way to punish malicious committers rather than prevent malicious commits.

[ Parent | on HN ]

Re:Privacy activists oppose EU plans for a GDPR-compliant Wh... by hyproxia on Saturday October 16, 2021 @07:44PM (#28892623)

I'm not a big fan of https, but how is this related to it? Websites that are http-only will be affected as well.

Edit: if you're talking about obtaining certs for bare IPs, it's actually possible to do that. See 1.1.1.1

[ Parent | on HN ]

Re:Privacy activists oppose EU plans for a GDPR-compliant Wh... by greatgib on Sunday October 17, 2021 @06:16AM (#28895333)

Before you could use ips, or alternative name system, or just private/personal DNS.

This will not work anymore as the https will require to have an official/qualified domain name.

Look at the case of the .dev domain names that were used by a lot of persons, and suddenly google bought the top domain and enforced https mandatory for it in chrome to ensure that no one else could use it anymore.

Also, imagine if the next step is to check that only "approved/legitimate" top domains, respecting some Google policies, are allowed for your own safety...

[ Parent | on HN ]

Re:Privacy activists oppose EU plans for a GDPR-compliant Wh... by _hyn3 on Saturday October 16, 2021 @07:53PM (#28892675)

OP said, "let's force everyone to use https."

My guess is that OP's point was that "everyone" includes servers as well as browsers, presumably by shaming via no lock icon and other tactics.

[ Parent | on HN ]

Re:Privacy activists oppose EU plans for a GDPR-compliant Wh... by hyproxia on Saturday October 16, 2021 @08:00PM (#28892709)

I know, but I still don't understand how this is related to the news at hand. You'll have to publish your info regardless of which protocols you're using (if any).

[ Parent | on HN ]

Re:Privacy activists oppose EU plans for a GDPR-compliant Wh... by andrius4669 on Saturday October 16, 2021 @08:00PM (#28892711)

you can connect using bare IPs with http.

[ Parent | on HN ]

Re:Privacy activists oppose EU plans for a GDPR-compliant Wh... by bruce511 on Sunday October 17, 2021 @02:11AM (#28894353)

You can with https as well.

For most of us that means an untrusted cert, and hence a browser warning, but that's equivalent to the browser padlock icon when browsing http (and arguably safer).

Plus, if you are browsing or publishing using plain ip addresses you are already outside the "regular behaviour" so users doing that will be happy to click through.

However this subthread is irrelevant to the main thread. The https/http question is unrelated to the dns question, since dns applies to both equally.

[ Parent | on HN ]

Re:Privacy activists oppose EU plans for a GDPR-compliant Wh... by dathinab on Saturday October 16, 2021 @08:44PM (#28892969)

You are totally overthinking things.

1. This affects http, too. I mean it affects anything using domains names.

2. It's generally a bad argument as there are so many more ways state agencies can mess with you when you use http then when you use https.

3. did you read the article? (I guess no)

4. The problem is DNS and DNS only, everything else is just a side effect from DNS being conceptually broken (wrt. privacy protection and decentralization). Https everywhere is inevitable and good, what isn't is that due to how DNS works we ended up with a (kinda) centralized-only certificate system. Https happens to need certificates, but it doesn't care what system provides them for it. So a complete privacy preserving decentralized certificate (and DNS replacement) could totally work with HTTPS.

[ Parent | on HN ]