We do not consume energy. We consume goods and services which require energy to produce. This model completely ignores past and future advancments in energy efficieny.
Please don't post ideological boilerplate to Hacker News. It's repetitive, therefore tedious, therefore off topic here.
Also, swipes like "So you dont trust anyone unless gov tells you to" break the site guidelines. Please review https://news.ycombinator.com/newsguidelines.html and follow the rules when posting here.
Businesses did not make buildings safer just because someone told them to. It is naturally considered a bad idea to kill your customers. Businesses would always create an environment that generate more profit. Safer establishments are one of many ways. Businesses would _always_ stay ahead of any bureaucratic recommendations/requirements, because they have the incentives. Rather misguided/outdated laws are real problems, because gov lacks the (strong enough) incentive.
> The cost of low-trust in a modern economy is huge.
So you dont trust anyone unless gov tells you to ?
Businesses did not make buildings safer just because someone told them to.
I disagree, and I believe the evidence supports me. Buildings became fire safe AFTER regulation and enforcement in country after country.
It is naturally considered a bad idea to kill your customers.
Yet in China, the milk powder suppliers killed their customers and now nobody trusts the milk. Likewise various other foods and also medicines in China. Instead, people spend a fortune smuggling safe food across borders. This is just one example amongst many. The same story exists in country after country.
So you dont trust anyone unless gov tells you to?
The gov doesn't have to tell me who to trust. I live in a country with strong protection laws. I live in a country where buildings get inspected and dangerous buildings shut down. I live in a country where I can trust the food I buy. There is not a government approved list of safe food shops. The government doesn't have to tell me which milk powder is safe; the government enforces a system in which I can trust, and in doing so create prosperity and safety together. I trust; I don't need a gov approved list, because I can buy food on the assumption that it's all safe by default. If I was living in a low-trust society, where the government was ineffective, that's when I would need a list of known safe sources.
You are arguing from a libertarian ideology. I don't have an ideology; I only have evidence.
> No. You have to trust all the CAs, and the governments that control the DNS.
Not in DNSSEC. .xxx need only trust dnsroot. yyy.xxx need only trust .yyy and dnsroot.
firefox/chrome/etc with support from important orgs with high value names (google.com/bankofamerica.com/etc) would then make sure that dnsroot/.com/etc do not abuse the trust. They have incentive and methods of punishment. There is no legal authority that clients need to map DNS . to existing root keys. A client can map a.b.c to any key it wants.
The risk of gov overreach is same for both tls and DNSSEC. DNSSEC just trusts fewer entities. The only people who benefit from current system, are CAs who are getting $$$ for nothing.
If browsers start mapping cert trust to something besides the DNS roots... it’s not DNSSEC, it’s something else entirely, it’s “our current system, maybe with some slight tweaks”
I am not suggesting every client do their own mapping, that is not a naming system at all. There has to be very large consenus for a naming system to be effective. I just pointed that out to show that dns is not under any gov control. Its under a control of an entity that can be punished.
However who gets to have dnsroot is just a value of a config in DNSSEC. The value itself should not be used to criticize DNSSEC cause its changeable.
No. You just map .com to another key with an agreement that new .com owner pre signs and map existing .com subs the right way. An unaware xxx.com does not need to do anything. As long as its done publically with a bang and enough consensus, disruption should be minimal.
Again this is unavoidable in any system that need trust. Thats why I like PoW DNS.
Who is "you"? The people we're afraid of manipulating .COM control the DNS. Google can't "map .com to another key". Their option would be to leave .COM; that is the gun DNSSEC would give to the USG to hold against Google's head.
You is firefox/chrome/etc. Yes you can. The ownership of .com is not as exclusive/protected as .xxx or xxx.com. Thus the firefox/chrome/etc can map it to anyone they feel. Considering so many high value .com subnames, .com can be transferred to neutral party or even dnsroot. USG do not own ".com" string. No one does. Just like ".".
Anyone can fork DNS. Its just a (name, key) map. As long as its done with enough consensus, it can be done. Mismanagement of .com is serious enough to demand that kind of change.
Lets say .com gets mismanaged. Community is infurious. firefox/chrome/etc demands that . remap .com to new more trustable entity. If . does not. firefox/chrome/etc then remap . to new more trustable entity, because .com must be as trustable as ., because .com is that important. New . give back ownership of all tlds to their previous owners. Except for .com. .com goes to the more trustable entity as intended. New .com then does again similar import of all good xxx.com.
In this whole incident, no one loses the ownership of their names except for .com and possibly . .
Now no gov can touch *.com. Though its different for cctld. Those are owned by their respective govs. Same goes for gtld. But no one gets to mess with . .com .org .net.
It sounds like what you’re proposing is for browser vendors to, in unison, overthrow IANA and the related organizations and stage a coup where they start running their own DNS root authority. And then claiming that this would happen without impact to end users / owners-of-individual-domains.
Browser vendors (specifically all DNS users) have the option. They can do it, if IANA fails at the job of being a dnsroot. Disruption is inversely proportional to consensus. If everyone do it, there is no disruption. Some disruption is unavoidable. Its fair price to pay for stable and solid global naming system.
Ultimately its about deciding who gets to own "x.y.z" string brand globally/contextlessly. World obviously need a single naming system. Either that or expect to have multiple owners to "google.com".
My suggestions are required otherwise why would someone build a global brand if ownership is not safe or guarnteed enough. Future is way more chaotic. Without crypto, a global naming system is not going to survive.
OK. I don't think we have to debate this any more. We can just leave it here: you think DNSSEC is a workable solution to our problems as long as the browsers can, if they ever need to, create their own alternate DNS for the web.
If you can’t trust them then the whole thing crumbles anyway.
All you need to obtain valid TLS certs for any domain is to make a CA think you control the domain. So the CA’s trust in the DNS root is already functioning as the basis of X.509.
You manifestly can't trust them today, couldn't yesterday, or for the last 30 years, despite the rise of e-commerce and the gradual shift of all applications to the web with its domain-validated WebPKI. Google doesn't DNSSEC sign. Facebook doesn't DNSSEC sign. No major bank I've found DNSSEC signs. AT&T doesn't DNSSEC sign, nor does Verizon. Some part of Comcast does, or did, and the net effect was that DNSSEC errors broke HBO NOW on launch day for Comcast users (and only Comcast users).
Tell me more about how the whole thing crumbles away? Because I'm pretty sure I'm typing into a TEXTAREA on the real HN, and not some facsimile a DNS hacker created to fool me. The Internet seems to be working fine without the government-run PKI you're saying we have to have.
The whole premise of AGL's article is the fact that you can't have pure DANE. Literally, "a hybrid of DANE and CAs" is just a restatement of the sentence "you have to trust all the CAs and the DNS". You haven't said anything in this comment.
Yeah but because they own the TLD they can get X.509 certs issued for any domain under it, because controlling the domain is the only check CAs really perform before issuing a cert for a domain.
The DNS is already acting as the root of trust for X.509. X.509 does not make the scenario of a rogue TLD operator any different.
You have to trust somone under DNS. The only trustless naming system I can think of is over a PoWChain (eg example.btc).
Still you have 3 choices in DNSSEC/DANE,
- get a .xxx, trust dnsroot.
- get a .xxx (when .xxx is as easy to register as xxx.com), trust dnsroot.
- pick one tld out 1000s and get xxx.ttt, and trust ttt and dnsroot.
I’ve got those choices if I use DNSSEC for my trust, correct. Or I use the existing system, where if a CA misbehaves, we boot them out of the browser trust stores and site operators don’t have to change anything.
And yet when attackers want to misissue certs for small sites (for big sites, misissuance is detected automatically and gets CAs killed), they don't exploit vulnerabilities that DNSSEC defends against. Why is that? And given that's the case, why pursue DNSSEC?
And how is any of this, any of it all, relevant in a world where registrars can simply speak RDAP to CAs? If you believe the problem is that the Internet will (to use your turn of phrase upthread) crumble away unless we secure the DNS for domain validation, why should we forklift out the entire DNS to do so, when we can just get a small group of organizations to deploy RDAP, something they're planning on deploying anyways, and then add that to the 10 Blessed Methods?
Because the DNS as it is allows for the potential to do something similar (by getting a CA to accept fraudulent DNS response, leading them to issue a cert,) without someone seizing control of a domain otherwise.
Securing the DNS (a) doesn't fix the underlying problem for TLS (as you can see by the last 2 waves of CA-missuance takeover attacks, neither of which relied on wire-level DNS hijacking) and (b) adds nothing to any secure protocol, which already has to do end-to-end verification today. Despite that, DNSSEC is already the most expensive proposal we have on the table today, requiring every major site and every major piece of software to upgrade or reconfigure.
Deploying RDAP and adding it to the CA/B Forum Blessed Methods gives CA's themselves an end-to-end ability to validate domains, decisively solving the DV problem, and doesn't require any of that expense.
Explain to me again why we should choose the former over the latter?
Except there has to be a crypto proof why Google owns google.com not me. That means we need to secure dns. Then why need CAs at all ? Whats the point ?
Of course they can. There is literally no legal or otherwise difference between Verisign and .com. Chrome can do whatever it want, cause its Google's browser not .com's.
In case when .xxx becomes dishonest, you can just move to your own gtld or .more-trustable tld. In current system, there is no concept of ditching a CA. If a CA decided to missmap a name and you are too small, you are fked.
> it’s actually 1, or 1 AND 2
No you can have DNSSEC without CAs. I have explained that already without changing much of the tls. Basically example.com DNSSEC key become CA for example.com. example.com then would create a tls cert in the usual way. No pain.
“You can just move to your own <other TLD>” isn’t even remotely plausible. Any site with worthwhile traffic isn’t going to just forklift to a new TLD and convince all their users to switch over. Imagine if .com was considered untrustworthy and suddenly every user in the US had to use google.othertld, facebook.othertld, etc.
Again if that's true then the game is up, because the USG obviously controls .COM; they theatrically demonstrate that every time they take down a piracy site. But, spoiler! The game turns out not to be up.
The former, for several reasons, among them the fact that those actually aren’t the options (it’s actually 1, or 1 AND 2), and the fact that Google can’t end .com they way they did Verisign.
But feel free to ask the relevant team at Google, who will give you the same answer.
Obviously the signing of example.com by .com must be secure itself. Otherwise no crypto delegation is secure, including tls signing.
> where DANE replaces X.509 CAs
Much easier migration actually. Just patch all firefox/etc to accept example.com's DNSSEC key as root ca. Then example.com can create its own tls cert. A very simple and minor patch to tls codebase.
Thats the problem here. Computers (smartphone/laptop/server/toaster/etc) are/will continue to hold most intimate and private data about a individual. Do you want all that disclosed on one person's word ? I dont. I dont think there can be any check-and-balance that absolutely prevent any person from giving a malicious order. One bad disclose order can be enough to ruin a life. Is that jurisdiction willing to be liable for the compensation (if compensation is even possible) ?
I believe Internet is a country of its own. Its a virtual world, it has no physical manifestation. There is no need to invade Internet to secure physical world.
That's a nice theory - but computers exist in the real world. I have a sticker on the back of my laptop from our NYI datacentre which says "there is no cloud, it's just somebody else's computer".
There's also no check and balance the absolutely prevents somebody punching me in the face and ruining my life, but I still walk down busy streets.
If you have a problem with the concept of judges as the arbiter of limits on the powers of law enforcement, I am keen to hear your workable alternative that doesn't have worse downsides.
You can recover from a punch. You cant undelete your data once it falls on wrong hands and gets used against you (eg debt/purchase history).
As I said there are already enough physical measures (defence, surveillance etc) that can ensure public safety. However If I were to compromise: We can have multiple judges. An order should be vouched by more than one judge. It would be even better if the user can whitelist/blacklist judges to submit. Less bureaucratic liability for the state if data gets leaked/misused.
I think we're talking past each other here. I was pointing out an example of how there's no absolute guarantees that another human being won't mess up your life, not that you need to look at punchers' phones.
IP and location have no legal relationship. They barely have actual relationship. I used UK vpn on google.com but it thinks I am from HK. If google cannot get a correct ipdb what chances do others have ?
And why would I block EU ? Connection is intiated by user. So its user importing/exporting data from/to server jurisdiction. Why does not EU force their own citizens to not do business with those companies ?
EU resident streaming a movie from netflix. Is netflix doing business in EU ? Or Is it the customer doing business in USA ? For example, it can be argued that its as if the customer went to USA, bought the dvd.
Yes, if you're streaming data to EU and getting money for that from a customer in EU, then you are exporting goods to EU. It's not "as if the customer went to USA, bought the dvd" (in which case it's a local sale and a customer imports their own personal stuff when coming back), it's an international export sale, you bring that "DVD" to Europe. It's as when you ship physical goods through customs, and both the goods and the money flowing through them are subject to EU rules.
If you have zero establishment in EU whatsoever, fines could be taken from all your EU sales revenue (i.e. any funds en route from EU customers to you), and it could be expected that (after they smooth out the process) they also might get a local (e.g. USA) court ruling to enforce that debt on you, there's a lot of international cooperation between the authorities in regards to enforcing trade law. That will take time, though, so until that you're safe unless you want to take money from EU customers or sell the user/advertisement information to EU (or compliant) businesses - in which case, you'll rather want to be compliant.
As a company with a website, there is no obligation for you to serve customers from around the world. Just restrict yourself to customers within a certain region (e.g. by checking where their credit card is registered, or geoblocking based on IP if you don't take payments) that does not include the EU and you don't have to care about EU law.
Actually nobody know who it applies to. Anyway what are you supposed to do if some visiting outside the EU returns to the EU and then demands their data is forgotten?
Netflix are doing business in the EU. I subscribe to the UK Netflix, which is a Dutch company under the name of Netflix International B.V. The films stream from European servers.
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
So GDPR does not say its illegal, just that it will be determined on case by case basis.
For legal experts, is this facebook consent obtaining GDPR compliant ?
By using or accessing Facebook Services, you agree that we can collect and use such content and information in accordance with the Data Policy as amended from time to time.
Simply having a term in the general conditions fails the "a clear affirmative act" part.
Saying "use such content" fails the "informed and specific" part - it needs to detail exactly what uses (explicitly listing each) you're consenting to; and it doesn't list the purpose of the use, which is a key part ("When the processing has multiple purposes, consent should be given for all of them")
If facebook has obtained your consent for one (or hundred and one) use-case, it does not mean that it can use it for something else simply by amending ("from time to time") the Data Policy, it would need to get additional explicit, affirmative (opt-in), informed consent to the new processing need of your information.
One of the oldest forms of writing that we know of, Babylonian tablets, are mostly about goods exchanges and paying taxes. I think that you assessment that taxation is a new thing is blatantly wrong.
Conversely, the concept of taxation is as old as civilization, and private property at current depth and scale is barely as old as the most recent extension of the rights associated with copyright in the DMCA, and already showing cracks.
You are talking to a libertarian and you assumed a right granted by state is a private property. Why ?
The private property I referred is land right, which IS as old as civilisation and have been acceptable by most humans ever.
Since most democracies are less than 200yrs old, the taxation cannot have been as old as civilisation.
When 100 people form a camp, they implement property rights before taxation. Historically taxations have been imposed by distant rulers not socially decided at local level.
> Since most democracies are less than 200yrs old, the taxation cannot have been as old as civilisation.
That would be true if the concept of taxation was dependent on the concept of democracy (and if it was correct that democracy was less than 200 years old, which is off by around an order of magnitude), which it is quite obviously not; taxation long precedes democracy.
> Historically taxations have been imposed by distant rulers
Historically, taxation (until fairly recently, in-kind; money taxes as the primary form is fairly new) has been imposed at every level from small bands to vast empires; it certainly is not correct that they've normally been imposed by distant rulers.
