News for hackers. Stuff that matters.

A comment on Calling time on DNSSEC: The costs exceed the benefits. Parent comment

Re:Calling time on DNSSEC: The costs exceed the benefits by donttellmypeers on Saturday June 03, 2023 @03:06AM (#36174398)
I don't know how to put this in a more palatable way but you're looking at the world from the confines of a webdevs point of view. Can you really not imagine that there's any other protocol on the internet than HTTP? That there might already be a web server listening at a given name? That the person in control of that webserver isn't you?
[ Parent | on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits by patmcc on Saturday June 03, 2023 @04:09AM (#36174680)
Regardless of protocol, yes only one person/org should be in control of (and able to obtain certs for) a particular domain.

Unless you're suggesting Person A should have port 443 on www.something.com and Person B should have port 444, and each gets their own (valid) www.something.com cert? Because that some very clear problems.

[ Parent | on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits by donttellmypeers on Saturday June 03, 2023 @04:26AM (#36174777)
Generally services not found directly at A/AAAA records for a name are found via another record that contains a hostname (HTTPS/SVCB, SRV, etc) at a leaf node below the name. So `_xmpps-server._tcp.example.net` might contain the hostname `hosted-provider.example.com` in which case `hosted-provider.example.com` will need to respond with a certificate for `example.net`, unless you trust the DNS, in which case it can respond as `hosted-provider.example.com`.
[ Parent | on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits by tptacek on Saturday June 03, 2023 @03:21PM (#36179696)
Hanno Böck is not "looking at the world from the confines of a webdevs point of view".
[ Parent | on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits by donttellmypeers on Saturday June 03, 2023 @04:53PM (#36180439)
Well it looks like they are in this instance and neither they nor you have done anything to suggest otherwise. TLS and WebPKI have great usability for webservers but non-webservers cannot even approach being as smooth as for example Caddy's "Automatic HTTPS" configuration.
[ Parent | on HN ]