Conversation

Notices

1. thunfisch (thunfisch@chaos.social)'s status on Tuesday, 24-Apr-2018 01:24:50 EDT thunfisch

   Hm, apparently #letsencrypt now provides mor than 50% of the web certificates.

   On one hand: FUCKING AWESOME.

   On the other: Shit. They're getting very powerful and we are centralizing our trust. I think we could reallu use 2-3 new orgs like Letsencrypt, with similar technology and mission statement, but entirely independent.

   Are there any out there yet?

   1. clacke (clacke@social.heldscal.la)'s status on Tuesday, 24-Apr-2018 06:57:04 EDT clacke

      in reply to
      @thunfisch @michcioperz @ebel @edsu @pettter @bortzmeyer I wish #httpy had become a thing. I'm pretty sure that's what it was called, but I can't find a reference now.
      
      Linker-certified certs:
      
      httpy://<fingerprint of self-signing CA>:example.com/blah/blah
      
      Failing the existance of this, what we should do for most public data is just more content-addressed stuff.
      1. clacke (clacke@social.heldscal.la)'s status on Tuesday, 24-Apr-2018 07:23:00 EDT clacke

         in reply to
         I found https://marc.info/?l=e-lang&m=97564104720495&w=4 . Apologies for marc.info's horrible styling.
         
         I'm pretty sure I read about it on a proper web site, but this seems to be the same proposal.
         
         Apparently it wasn't exactly what I said above, it was fingerprint only, and then some centralized service (ugh) would look up which fingerprint goes to which IP.
         
         Later on in https://marc.info/?l=e-lang&m=98577007410712&w=4 an IP number is mentioned, but that's the IP number of a lookup server, not the http+tls server.
         1. clacke (clacke@social.heldscal.la)'s status on Tuesday, 24-Apr-2018 07:44:36 EDT clacke

            in reply to
            Here's a friendlier presentation of the thread.
            
            http://e-lang.mail.eros-os.narkive.com/XZ1xqgMt/httpy
   2. thurloat 📌 (thurloat@mastodon.club)'s status on Tuesday, 24-Apr-2018 09:42:34 EDT thurloat 📌

      in reply to

      @thunfisch you can spin up your own entire letsencrypt stack, the only problem will be getting people to accept the certs you sign.