Hacker News Reader

I think what they meant is that with decentralized DNS, it is possible to replace certificate authorities by using DNSSEC + DANE RFC6698[0], but I agree the way it's mentioned is confusing.

[0] https://tools.ietf.org/html/rfc6698

ok. obviously you can replace cert authorities with those systems on present DNS too, it doesn't require a "(more) decentralized DNS", right?

Replacing cert authorities with something DNS-based (or alternative decentralized DNS based) doesn't actually seem relevant to the problem they are highlighting, of sci-hub's DNS records being removed by private or government actors making it harder to find sci-hub... no?

To answer your first question, with the present DNS, If you use DANE, the trust is centralized since you have to trust the root DNS keys and the registrar (imo still better than trusting a large number of CAs. letsencrypt already relies on DNS to issue certificates).

> with decentralized DNS, it is possible to replace certificate authorities by using DNSSEC

In what sense is DNSSEC decentralized? IMHO signing the root zone is about the most-centralizing thing that has ever happened to the Internet.

It is exactly that.

That's the thing Handshake is trying to address: with the root zone being on the (decentralized) blockchain, each TLD owner has full control over issuing the certificates for that domain using DNSSEC+DANE. The idea was that this would allow us to get rid of both the centralized root zone and CAs.

wouldnt that blockchain grow exponentially ?

Why exponentially? Seems like linear growth to me.

> But it sounds like handshake is simply an alternate DNS protocol?

Handshake [1] is the next generation of DNS, as opposed to the ICANN controlled legacy system. It is more decentralized since a single actor does not control the system. You cannot be de-platformed without the consensus of the community and a fork, as opposed to a decision made by a single or small group of actors.

> Or does it also serve as a certificate authority somehow?

Since you can verify a certificate against a DANE TLSA record which is retrievable from a DNS zone with DS records stored on chain, the CA is no longer required for trust -- only cryptography. Checkout the paper which goes into far more detail [2]. The entire system actually incentivizes the Internet to become more secure -- which is pretty exciting!

> Is it actually more decentralized than DNS

It's more decentralized than DNS in that the root becomes the blockchain instead of ICANN. This project simply finishes the beautiful DNS ecosystem, which was already decentralized, other than the root.

Now we are all root, democratically.

[1] https://www.youtube.com/watch?v=Q3QbXMFjro0

[2] https://handshake.org/files/handshake.txt

The article has a few technical mistakes in it (I've found most publications do that when it comes to a technical subject I'm familiar with...), but in short Handshake is an alternative decentralized DNS root hosted on a blockchain. It aims to replace Certificate Authorities as the root of trust by pinning TLSA keys directly on the blockchain instead of relying on trusted parties for verfication.

So it aims to replace both DNS (a way of looking up IP address for a hostname) as well as certificate authorities (a way of knowing if the SSL cert being used by your connection is 'good')?

Its an alternative DNS, with a method to use that alternative DNS as a way of authorizing ssl certs too?

That's right! Though the infrastructure for HTTPS without CAs on Handshake is still nascent (the community welcomes contributors if you're interested!). This article covers how to set up HTTPS on Handshake using DANE https://medium.com/@ca98am79/how-to-view-dane-tlsa-websites-...

Which blockchain? It's own or will they use Bitcoin's blockchain?

This appears to be just another commercialisation of domain names, trying to create another "Gold Rush" for the most sought after "vanity" names. Winner-take-all. A few profit at the expense of the many.

It perpetuates that problem of ICANN DNS becoming a "business" instead of solving it. (ICANN DNS domain names were originally free.) The potential for censorship is only one problem of ICANN DNS.

Also, this project introduces a new problem of wasting energy on mining tokens.

> This appears to be just another commercialisation of domain names, trying to create another "Gold Rush" for the most sought after names. Winner-take-all. A few profit at the expense of the many.

This is a major problem that the project has made a sincere attempt to address. Through scarcity certain sybil protections are afforded, which has been inherently architected into the consensus protocol [1]. Additionally, an airdrop to many internet pioneers and open source developers was built in as well, giving everyone similar resources to participate in the auction system which, in turn, affords everyone more equality in participation. Finally, the top 100k names as per alexa were pre-reserved for the holders in the alexa list, and these sites are incentivized to properly setup DNSSEC, as that's the only way they can claim their name on handshake.

This is a win for internet security and internet users. It's absolutely a big win for freedom of speech.

[1] https://handshake.org/files/handshake.txt

I feel obliged to point out again that this project appears to be a cryptocurrency scheme in which the owners are, in essence, selling the DNS naming hierarchy, which is genius since they do not in fact own it. Also, once again, I'd like to put out an appeal for anyone who wants to go in with me on a venture to do the same thing with ARP.

For $1000, I’ll let you ARP the EE prefix on my network

With all due respect, this comment reflects a poor understanding of decentralized projects and, particularly, public blockchains.

> the owners are ... selling the DNS naming hierarchy

The blockchain is providing names in a global namespace owned by the commons.

I cannot understand why you have been harassing and stalking this project with troll-like behavior and rude, snarky comments. Let's try to be constructive and provide value to society and the future. The next generation reads these threads, and they look up to you. There's no reason for you to change that. And with that respect, not to sound all Uncle Ben on you, does come responsibility.

Either way, love you tptacek and appreciate your contributions to HN. I can honestly say myself, that I've learned a lot by simply being audience to your conversation.

Cheers.

I can sort of understand the idea of people starting a new parallel naming system as a piece of Internet infrastructure, sort of the same way DNS happened.

Where you lose me, like, all the way across the horizon is where the people who start that infrastructure do it with a traded coin that they've premined, allocated huge chunks of to themselves, and then "airdropped" to a set of developers they collected in 2018.

Why would anybody sign up for this? I genuinely have a hard time understanding why anybody would take this seriously. It's a plan to replace the DNS roots with... some company? That just decided they should be the ones to own it?

> sort of the same way DNS happened.

Actually, almost everything happened that way in the history of mankind, right? xD

> the people who start that infrastructure do it with a traded coin

All the names could be registered by one monopolistic player on the public blockchain. That's why a cost function is required.

> that they've premined, allocated huge chunks of to themselves

A huge chunk was not allocated to anyone other than FOSS developers. Please review the paper [1] for specific allocations.

> "airdropped" to a set of developers they collected in 2018.

To be clear, this set consists of any developer on github who had 15 or more followers in 2019, the PGP web of trust strong set, and anyone on HN who had a keybase account in their profile.

> Why would anybody sign up for this? I genuinely have a hard time understanding why anybody would take this seriously.

I don't think there is anything to sign up for? Secondly, you absolutely don't need to use the new internet if you don't want to - just like nobody forces you to use anything else in this world. You have a choice. That said, we'll miss you. :(

> It's a plan to replace the DNS roots with... some company? That just decided they should be the ones to own it?

So actually, the DNS root is owned by some company [2] that is under the jurisdiction of California law. It used to be, and still basically is, owned by the US Department of Commerce. Internet users are replacing it with a public blockchain owned by the commons.

Historically, revolutions happen all the time. Now it's the time for democratization of naming. Is there any good reason why we shouldn't own our own names? I think that the name might even be more valuable than money. What is anything without a name?

[1] https://handshake.org/files/handshake.txt

[2] https://www.icann.org/

This is probably the one time on the history of this whole website that I'll just refer you to what 'tialaramex said.

> To be clear, this set consists of any developer on github who had 15 or more followers in 2019, the PGP web of trust strong set, and anyone on HN who had a keybase account in their profile.

Could you clarify a bit for me? I checked both of those boxes. Does that mean I have some of this premined crypto somewhere? How would I get to it? The paper you linked to is very long, but I am intrigued so will likely check it out.

I love the idea here. Decentralized web is sorely needed. If we can make it usable, that would be amazing.

Absolutely! There is a page that describes the airdrop and includes a script to claim it [1]. If you have checked those boxes, it very well does mean you may have some premined somewhere. You could also try Bob [2] as well.

I agree with you! Recent times have shown how much we need the decentralized web than ever before.

[1] https://github.com/handshake-org/hs-airdrop

[2] https://github.com/kyokan/bob-wallet

> you absolutely don't need to use the new internet if you don't want to

Yeah, no, that's not how this works. People don't want your "new internet". People want the Network, and in our era it so happens that's the Internet (previously it was the Public Switched Telephone Network, and before that the Universal Postal Union). But it isn't your "new internet" of a few enthusiasts who are sure it'll work this time even though it hasn't worked the previous times it was tried.

> Is there any good reason why we shouldn't own our own names?

A name is what something is called. In London there is a famous river crossing which was officially named after an equally famous politician. William Pitt (the Elder). But people didn't call it "William Pitt Bridge" or even "Pitt Bridge". People called it "Blackfriars" because that's the district of London it is in. Nobody you ask in London will know where "Pitt Bridge" is. There is no "Pitt Bridge" you want "Blackfriars".

Perhaps you've never visited London. Lots of HN folks are from Silicon Valley. San Francisco has a bridge that joins the city to Oakland, I happen to believe it should be named after the Emperor, "Norton Bridge" seems like a good name. But is that what it's named? No, because even if a few agree with me, on the whole people call it the "Bay bridge" and a name is what something is called.

This seems to be a hard concept for some people to manage, but it's mandatory, so there isn't anything I can do about that.

> Historically, revolutions happen all the time.

Historically most attempted revolutions fail. In hindsight it is often clear they could never have succeeded. I think Americans have a fairly recent memory of what failed revolution looks like.

> So actually, the DNS root is owned by some company that is under the jurisdiction of California law.

In practice (and perhaps this will annoy tptacek but too bad) this isn't usefully true. ICANN's control of the DNS root is by consent, the same way that say, the English Parliament is sovereign by consent, so just because California law says they can do something does not in fact mean it will have the effect envisioned in California law.

> People want the Network, and in our era it so happens that's the Internet (previously it was the Public Switched Telephone Network, and before that the Universal Postal Union).

You're absolutely right in that it changes.

> Historically most attempted revolutions fail.

Yet, my statement still stands: Historically, revolutions happen all the time. Risk of failure is not a reason not to proceed. As they say, "give me liberty or give me death!"

> ICANN's control of the DNS root is by consent

I agree with you completely. Let's see for how much longer the people will consent to their rule vs a democratic rule by the commons!

There are quite a few things I don't agree with tptacek about. But this is just the latest of a long series of hijack attempts for this namespace (the Internet's DNS hierarchy) and it's about time people learned that can't work.

Successful namespace hijacks rely on overwhelming numbers. You need to have so many people using your hijacked namespace that you've got way more people who do not even know that it's a hijack but are using it anyway than the existing administrators had total engagement so that it's pointless to argue with you.

Handshake can't get there from here, most of the world now uses the DNS hierarchy. This was a fool's errand. Carving themselves out a niche might have been possible, if they had been content with a niche but it's clear that their financial motives dictated they try for the impossible instead.

Handshake doesn't replace the DNS hierarchy - it simply upgrades the root.

Like all things in the world, the namespace will be democratized. The people do deserve to own their own namespace, and even if you wish or hope for democracy to fail, I'm confident either this project or another will one day succeed. Everyone in the community is selflessly working towards this goal for you and everyone else in this world's benefit. It's a quiet space without accolade or reward.

If they are fools, then I hope to be the biggest fool.

Finally, nothing in life is forever just like nothing is impossible my friend. As a hacker and developer, we always find a way.

To be fair, the "hijacked" namespace reserved all the current TLDs for the current owners. Handshake is trying very hard to be backwards compatible and not to break the internet.

Surely I will be swiftly corrected by DNSSEC experts and I will dare to use less-than-correct terminology but doesn't DNSSEC make DNS more not less centralised. With DNSSEC, as I have seen it used in practice, a "root" must in effect "approve" of each domainname. In other words, cooperation from a root is required in order "certify" a domainname as "authentic". So if hypothetical internet user wants to serve her own RRs from her own nameserver for her own self-hosted own web resources on the internet, then she has to make sure a "root" approves of her source registry and registrar. Without the root's (indirect) blessing, her domainname is not "authentic" and should not be held in any shared cache.

Here is a different idea. The intent is not "world-takeover" or "winning" any imaginary popularity contest but just a different kind of DNS service, because, well who needs a reason. Because we feel like it, how's that. The idea is: Start a registry that only allows djb-designed per-packet encrypted DNS to be used. That is, all persons running authoritative nameservers must follow some rules. They must publish public keys in subdomains of the nameserver's domain. For an example of how this looks, do an NS query to ianix.com. All authoritative nameservers in this imaginary registry would be required to offer per-packet encypted DNS. It would not be that difficult to start something like this at least on a small scale. People running authoritative nameservers simply need to run a CurveDNS forwarder in front of their preferred authoritative nameserver implementation. The CurveDNS forwarder is a small piece of free, open-source software. This type of encryption is different from DNSSEC, so this is not a "replacement" or even an "alternative" to that movement. It is something totally different. The purpose is not to address risk associated with shared DNS caches (e.g., poisoning and other tricks) as DNSSEC is intended to address, it is not to distinguish an "approved" domainname versus an "unapproved" one by creating some "chain of trust" to a "root". The purpose is just to encyrpt DNS packets. The focus is authoritative DNS, the folks that actually own the web resource, not recursive DNS, third party DNS cache providers, etc. There are couple of reference implementations of the DNSCurve-enabled cache and one of a dig-like client users would run on their home/own networks to send encypted queries and decrypt responses. This whole system for encrypting DNS has been around for over a decade and IMHO is easily as "battle-tested" as anything DNSSEC. Does that mean everyone should use it. No. But it means anyone could use it. For no other reason that because they feel like it.

The main problem something like Handshake is purportedly aimed at solving, namely centralisation of who controls "the" DNS, is IMO caused by the commercialisation and making a "market" for names. There is no way anyone is going to solve the centralisation problem by offering a commercial alternative that replays the "Gold Rush" of the first DNS (not to mention all the corruption that followed, culminating in "new gTLDs" for $185,000+). If we want to level the DNS playing field, then IMO we would have to take the money out of it. That might mean "vanity" names are not as important. Who knows, public keys might play a more important role. I am thinking of those Facebook workers who "brute-forced/mined" some .onion name they thought was more recognisable. Silly. "Decentralised" would seem to imply more equality across the namespace, not "I snagged the best names before everyone else" (using x kilowatts in the process) or "That name sucks."

Just an opinion. Good luck with the blockchain.

In the case of Handshake, the root is centralized in something that's decentralized - the blockchain.

https://www.coindesk.com/sci-hub-leaves-handshake-blockchain

>It seems like tor .onion address would be an actually mature solution to this problem

Already available:

https://scihub22266oqcxt.onion

I wonder why wikipedia mentions that it has an .onion address but does not show this address? People do keep the constantly changing URLs for it up-to-date and are even highlighted in the side bar, so a legal reason not to publish the link to it is unlikely the reason.

Probably edit wars.

I agree. I found the article pretty incoherent, and gave up after a few paragraphs.

decentralized in the sense of not under the control of one organization.