Hacker News Reader

Comment by jcranmer | Hacker News Reader

WebPKI is derived from X.509, but I don't think X.509 lives on anymore. X.500 was stripped down to form LDAP, which is still in very heavy use today. There's still some X.400 systems in existence. I think some of the early cellphone generations may have used the ITU standards in the physical layer?

Of course, the biggest--and weirdest--success of the ITU standards is that the OSI model is still frequently the way networking stacks are described in educational materials, despite the fact that it bears no relation to how any of the networking stack was developed or is used. If you really dig into how the OSI model is supposed to work, one of the layers described only matters for teletypes--which were are a dying, if not dead, technology when the model was developed in the first place.

View on HN

There's an entire book devoted to ripping up the OSI model: https://docs.google.com/document/d/1iL0fYmMmariFoSvLd9U5nPVH...

The OSI model and its consequences have been a disaster for the networking race.

What an interesting read. Thank you for posting it.

Everyone who knows what the OSI model is should read at least some of this book.

X.509 absolutely lives on -- https://www.itu.int/rec/t-rec-x.509 last update was October 2024. However WebPKI uses PKIX which is fairly stubbornly stuck on RFC5280.

On the ITU side, they have made improvements including allowing a plain fully qualified domain name as the subject of a certificate, as an alternative to sequence of set of attributes.

  X.500 was stripped down to form LDAP

No, LDAP was a student project from UMich that somehow gained mindshare because (a) it wasn't ISO, and (b) it cleverly had an 'L' in front of it. It's now more complex and heavyweight than the original DAP, but people think it isn't because of that original clever bit of marketing.

It's still lightweight. I implemented a working implementation on a literal weekend.

That's certainly possible, you can get a basic implementation that uses it as a database lookup, "search" with baseObject/scope fixed, filter is your search string, return the attribute you want, done without too much effort. In fact a number of early LDAP databases were actually DBMSes underneath, so you take your SQL-style query (select emailAddress where name = "John Doe"), convert it into baseObject/scope/filter/attributes and send it over the wire, the other side converts it back into an SQL query and queries the Ingres database that's doing the actual work, and everyone gets to pat themselves on the back over how well "a bunch of networking types reinventing 1960s database technology" (Marshall Rose, I think) works.

However when you need to implement the whole HDAP protocol, that's when you wish you'd taken up some easier job, like maintaining the bank's COBOL accounting code.

Well, it started off simpler, but, yes.

If you mean the presentation layer, hard disagree. Not thinking about presentation creates problems. For example, Go treating ASCII headers as UTF-8 caused trouble. Only slightly not worrying about an HTTP/2 vs HTTP/1.1 mismatch caused trouble for reverse proxies.

Now I'm young enough not to have seen teletypes in an actual production use setting, but I've never heard anyone suggesting the presentation layer was for teletypes. That's just Google-level FUD.

No, it was the session layer.

TLS is our session layer.

Reply on news.ycombinator.com