Hacker News Reader

Comment by superkuh | Hacker News Reader

QUIC is for corporations. Integrating TLS into a fundemental protocol means that cert authorities are integrated. Cert authorities mean that individual human people cannot communicate with each other over the protocol unless a corporation allows it on their whim.

If QUIC is widely adopted it will do much to improve the performance video streaming from corporate services, but it will absolutely destroy the decentralization of the internet and provide single points of technical and political failure.

View on HN

The idea of certificates is built in to QUIC, but certificate authorities are the client software's responsibility. Client software can ignore certificate authorities entirely, just like with HTTPS.

How exactly does widespread adoption of QUIC destroy decentralization?

Is it any different from widespread adoption of HTTPS, e.g. with browsers becoming increasingly discouraging towards unencrypted HTTP?

Is it any different from widespread adoption of HTTPS, e.g. with browsers becoming increasingly discouraging towards unencrypted HTTP?

I'm not the one you're asking, but I think it's not, and I have the same concerns with HTTPS too.

The internet hasn't been decentralized since pretty much it's inception. ICANN very much introduces a single point of failure that could wipe out the internet if it were disrupted.

It could be replaced, but it would take years. In many ways, cert authorities are more decentralized than ICANN.

This isn't to say we shouldn't worry about these single points of failure, rather, I think it's just an exaggeration of QUIC's impacts on decentralization.

It's worth trying to reduce the amount of centralization, and make baby steps to improving the situation.

Nothing is stopping you from starting your own CA and distributing your own web browser that trusts the certificates. What underlying transport protocol is used doesn't change the complexity of removing corporate influence from the Internet. There is one root DNS namespace. Certificates prove that the stream your user agent receives from example.com is the example.com that is pointed to by the DNS system. That's it. No part of the Internet requires DNS or trusted-by-default CAs. It's just a convenience.

Before widespread TLS adoption, your ISP could (and did!) inject ads into arbitrary websites. Now they can't. That's a good thing. It is actually amazing how little power your ISP has to tamper with your network traffic -- all they can do it shut it off completely.

> distributing your own web browser

network effects

That's the underlying issue, I think -- "nobody else wants to do my unusual thing". Most people are happy with the corporate internet, or at least indifferent. If you want to change that, you have to add some major value. (And, people have added such value; there are users of Tor, after all.)

My point is, switching from HTTP/1.1 to QUIC doesn't really make a difference here. The battle against centralized control of parts of the Internet has been lost and no protocol spec is going to change that outcome. Instead, there needs to be major innovation from the camp that wants to fundamentally change the world.

I think the network effect is much weaker here. While interacting with a website without certificate (or with an invalid one) adds friction, it's still wholly possible, at least for now.

It's not like switching from WhatsApp to Telegram, where you have to go from one hermetic silo to another.

I don't quite follow your argument, I could s/QUIC/HTTPS/ and s/will do much to improve the performance video streaming from corporate services/will do much to improve the security of corporate applications/

Can you elaborate on to why QUIC different from HTTPS-only in that regard?

We can hope that initiatives like LetsEncrypt will continue to exist so there's an alternative to paying for certs. LetsEncrypt does rely on a private company for it's certs, but at least it exists.

TLS, and thus QUIC, doesn't care what the certificate is. It's just an opaque bag of bytes as far as the protocol is concerned. If servers and clients for some particular protocol or service agreed it should be a 16 color GIF of any prime numbered XKCD comic that would work with no changes to QUIC or TLS.

So the reason you want certificates from the Web PKI for public facing servers is only that those are widely trusted for identity, whereas that "XKCD comic" idea is clearly untrustworthy and doesn't identify much of anything.

Reply on news.ycombinator.com