Oddbean new post about login | logout They’re moaning about people having to make sure their site works with TLS? Seems like a weird complaint. My issue is that TLS is an overcomplicated beast of a protocol (okay somewhat better with 1.3, but even still), which is the enemy of security, we have like 100 “roots of trust” in the form of CAs, most of which have a long history of being terrible, it relies on too many pieces of an increasingly huge stack, etc….
"They" is the inventor of http
They is a political standards organization that is the successor to the people who invented http :)
Unsure why you think that. HTTP was invented by one person, though it was developed by more later. Header of the article: "Tim Berners-Lee Date: 2015-02-15, last change: $Date: 2015/03/28 20:46:47 $ Status: personal view only. This is not a formal W3C director view, nor view of the TAG or the Consortium as a whole" It's a long story, but HTTPS (or SHTTP) should not have been a new scheme, they should have made http secure, instead. Doing it the way they did, broke the web.
Ah, I missed the header/author, sorry! I don’t disagree with his conclusions, but my point was rather different :)
Yes, you're right. So it's a long story. Basically DNS was a small project by Jon Postel added on to HTTP in the early days. They didnt know it would grow and grow. And when things grow alot then politics and centralization comes into play. In the end DNS and HTTP bring alot to each other, and both can be useful alone. HTTP->HTTPS had its own share of politics too. DNS can work standalone and you cut out a lot of the complexity.
Bitcoin must be much worse still.
Bitcoin is comparatively simple! Lightning maybe less so 😅
Surprising to hear that considering all the different components that can be attacked and abused... - Peer discovery - mempool - utxo set db - bitcoin script - pinning attacks Etc.
Have you ever taken a serious look at TLS/X.509/Certificate Authorities/DNS Poisoning/BGP Hijacking……..? :)
No, but it feels intuitive that something that serves one purpose (AFAIK) would have less attack vectors than one that has many endpoints.