X.509 needs to be replaced with a simple key you get for free during domain registration. Then the blast radius of key compromise is a single domain name and not the whole internet.
The blast radius of that is every subdomain of whoever got compromised. Having only ICANN being capable of breaking the entire internet is a world of difference from what we have today, and may be the best we can do... and we should be using that, but it's not perfect either.
It's not ICANN in that system, it's the TLD operators, and the problem with that is that for many TLDs and all the most important ones, you'd be adopting a system where your keys are directly managed by institutions we already know to have misissued. The most important TLDs are state-controlled, which is why you saw DOJ notices on piracy sites rather than NXDOMAINs.
And those DOJ notices already have valid certificates today, because the CA racket is just a proxy for the real domain name authority delegated by ICANN anyway.
How does a client know what public key to expect for a given domain, then?
If they key is distributed by DNS, then you need to secure DNS, e.g. with DNSSEC. Well, with DNSSEC the TLDs and root basically have the same status as CAs (although it does cut down the huge number of CAs that can issue certs).
At least there is only one DNS root so we can work on securing that (or just pin the certts for the next level for anything that has any update procedure whatsoever).
It does, but you also lose 100% of the accountability. eMudhra is leaving this business because the root programs are about to humiliate them. There are no programs anywhere that can do the same thing to a major TLD operator.
If ICANN decides you no longer operate the TLD, and takes your name servers out of the root server zones and replaces them with somebody else's... you don't run that TLD any more, sorry, go have a good cry and then see if maybe running a hot dog stand is more your speed. DNSSEC is one of the services ICANN considers critical enough to take away your TLD stewardship if you aren't providing that service properly.
Of course we wouldn't want ICANN to do that on a whim, or without having a new operator for the TLD ready to go, but there's already process defined for both planned and emergency transfers of operation of a TLD:
You don't think so? In a scenario where it becomes known the US government is actively subverting Verisign to tamper with DNSSEC integrity (or where Verisign just screwed up badly enough to make their continued stewardship untenable, and I think either case would become known, in pretty short order), I absolutely think ICANN would expatriate .com. If they didn't, they would lose legitimacy with everybody who isn't the US government. That leads to at best an international effort to replace ICANN and at worst the splintering of the DNS root. Nobody wants either of those scenarios -- the least-damaging thing for the Internet and for ICANN as an organization would indeed to be to take .com away and let say, the British run it for awhile. (Maybe you could get your .com domain registrations at Sainsbury's, in the aisle next to the anti-demon plant misters.)
Which is exactly the kind of scenario a lot of people hyperventilated about back when ICANN was formed, for reasons of varying validity, but in this case it would indeed be the least-worst option all around.
> In a scenario where it becomes known the US government is actively subverting Verisign to tamper with DNSSEC integrity (or where Verisign just screwed up badly enough to make their continued stewardship untenable, and I think either case would become known, in pretty short order), I absolutely think ICANN would expatriate .com
ICANN is an organization headquartered in California ... I don't see how they can redelegate .com without approval of the feds.
IMHO, that isn't that compelling of an argument against domain hierarchy certificate issuance. If the feds want to mess with your .com today, they can and then they can get a cert from any CA. Adding a dependency on CAs doesn't remove the dependency on the TLD operator.
If you wanted to stick with x.509 certs and you had an ICANN root that would sign Name Constrained TLD intermediate(s), and the registry would sign name constrained Domain Intermediates, and all those require certificate transparency, then we'd be about where we are with WebPKI, but without trusting any parties you don't already have to trust.
I am 100% confident that .COM will not be rescued from law enforcement and national security surveillance by ICANN, yes.
You can disagree! But then: let's just keep the premises clear. You think DNSSEC makes sense because you also think states will lose control over their registry operators.
Not lose control exactly. But if ICANN is willing to, they have the power to simply make that control irrelevant in any specific case. The government in question would have absolute control of a TLD registry that no one else considers authoritative for that TLD. If you're a hermit kingdom like North Korea anyway, that's probably not a big deal, but for anybody else it's liable to be a very big deal indeed.
I would expect ICANN to use that power very sparingly, preferring to publicize rather than act as a first step, and if they did get heavy-handed, again they would incur a hit to their legitimacy.
The only reason it's considered unthinkable that could happen to .com is that everybody agrees it's unthinkable to do that to .com. But ICANN absolutely could make a credible threat to US control of .com or .us if they felt it warranted to do so. (You could say they're ICANN, not ICANN'T.) They could do the same to .gov, for that matter, but the US government already explicitly owns and controls that whole hierarchy, so there's no real "interference" issue there.
The whole Internet's viability is based to some extent on the collective delusion that everybody agreeing this is how it works, actually makes it how it works. But none of that is set in stone... which is generally a good thing.
We're at a level of counterfactual and divergent premise where there's really not much I can contribute to this arm of the conversation. My response to "ICANN would seize control of .COM adversarially from Verisign" is "ICANN and what army?" and by that I mean literally "what army?"
Can't confirm this "pretty generous", many people with lots of contributions to popular projects got any from OpenAI, not even a response to their request.
What's also annoying is that Claude Code now spams "agents-md: no CLAUDE.md found; AGENTS.md loaded" on every startup. I could just do that silently, no need to inform me that I'm using the superior file.
At that point though, it's like why. Reddit is, well, trash. It's barely worth visiting without an account, and if you're going to make me jump through hoops to visit, it's time to accept the message of "we don't want you here" and go somewhere else.
If you're browsing Reddit for its front page, yes, that's trash. But it can be a great source for getting information on narrow, specific topics on well-moderated subreddits filled with enthusiastic and obsessive people eager to share their knowledge. It's been very helpful for me when researching coffee grinders, refrigerators, solar battery backups, headphones, and other such things.
The reason to use it is that Reddit does provide the occasional answer to questions like "how to get a Samsung SCX 3400 to run on a Raspberry Pi" (etc.).
Now all that's missing is Chatlib, a self-hosted proxy for ChatGPT which makes it possible to a) query the service without leaving a personally identifiable trace and b) separate out the facts from the dreamt-up fiction. Using Redlib I at least get to see the original posts which makes it easier to separate fact from fiction.
I've been making money from reddit, and for about a decade and a half and at this point, why bother? It's basically drained and what remains is of zero value.
The same is and has been true for Reddit for a long time, the difference lies mostly in the ideological sauce flavouring these places, i.e. Little-endians vs. Big-endians. If you're a Reddit-endian you'll despise the Tube-endians and vice versa.
I could use it without an account and know that any comment I clicked into would take me to the thread of posts under it without sponsored ads or posts.
