Hacker News Reader

Comment by superkuh | Hacker News Reader

I really wish the IETF would change the QUIC spec so that it must allow connections even without CA based TLS. As of right now the implementations from Google do not.

View on HN

Nothing in the QUIC spec mandates the use of well-known CAs, as far as I know. (And QUIC-TLS is a separate spec because the crypto protocol is a natural extension point in QUIC -- experiments for QUIC with Noise already exist.)

QUIC uses TLS1.3. You need a trusted CA on the ends but it doesn’t need to be one you pay for. That’s how any version of TLS works.

Right. Requiring TLS via CAs means that you cannot host a public visitable website on HTTP/3 without the continued permission of an incorporated entity. Just like with (most of) HTTP/2 in practice. But very much unlike HTTP/1.1.

You're not going to be able to host a website without an "incorporated entity" continuously providing you a network connection either. That seems like the much harder bar to clear given the existence of Let's Encrypt.

Lots of people have been deplatformed by their ISP. Even if your CA did try to shut you down you could switch to literally any other CA in the world on a moment's notice. You can't do that with your ISP.

Yep. ISPs should be regulated like phone lines: a utility. There's really no excuse for the way the law fails to protect citizens this late into the internet revolution. Can you link me to some of the incidents of people "deplatformed by their ISP"?

I consider it a bit different because there are far more ISPs than there are CAs. Most human persons currently just use letsencrypt (good, but not good that everyone does).

Reply on news.ycombinator.com