Hacker News Reader

Comment by superkuh | Hacker News Reader

Ah yes, QUIC, the protocol that is infeasible to use to connect to people you don't know without getting continued approval from a corporate CA. Imagine if you couldn't use TCP without getting re-approved by a third party corporation every ~90 days. I suppose that's fine for corporate for-profit use but it makes things extremely brittle in both the technical and social senses.

View on HN

QUIC supports self-signed certs if LetsEncrypt is too corporate for you. WebTransport lets you specify the certificate fingerprint (sha256) much like WebRTC, although it does enforce that the certificate is valid for <14 days so it will need to be ephemeral.

> the protocol that is infeasible to use to connect to people you don't know without getting continued approval from a corporate CA.

What do you mean? Are you saying you can't serve content via QUIC with a certificate issued by lets say letsencrypt certbot?

Self-signed certs in general are a pain in the ass with Chrome. It's only a matter of time before they're disallowed entirely. With QUIC requiring TLS self-signed certificates will only get more difficult to use if not impossible.

You can use tools like certbot to get a working cert without "approval from a corporate CA". It isn't a selfsigned cert.

Can you elaborate on this? This doesn't seem like a fundamental issue with QUIC

They’re probably referring to the fact that QUIC always performs TLS1.3 negotiation as part of its transport handshake, there’s simply no unencrypted version of it. However WebTransport actually supports providing a certificate hash at connection time on the client and ignoring the normal Web PKI altogether. But I doubt that will stop anyone who instinctively hates it because it came out of Google from continuing to do so.

Ah, I see. Well I use self signed TLS certificates just fine with QUIC. I also wouldn't log into a livestream without using a CA trusted TLS connection (unless you're ok on a free anonymous account with adverts I guess).

Reply on news.ycombinator.com