cpach

I think the first questions to ponder are: What is it that is wrong with the current WebPKI? (As it is in 2025, not as it was in 1999.) What would actually become better if we tried to move all of this into DNS?

Ponder this: Why do we place the “trust handling” in the application layer? (HTTP with TLS.) Why not in the IP layer?

https://sockpuppet.org/blog/2015/01/15/against-dnssec/

https://sockpuppet.org/blog/2016/10/27/14-dns-nerds-dont-con...

Oh yeah, lots of people do. I have friends that hate AI and refuse to use it at all.

However, I guess it depends on what you mean with “from scratch”. In a corporate context, I would say most code-writing is fixing bugs or adding features to an existing project.

“Am I wasting time doing these exercises when they can easily be done with LLM within one or two shots?”

Depends on what your goal is. If you want to get better at programming, how would you get better if you don’t let your neurons form new pathways? However, perhaps you are more interested in the output and not in the process. But some day, you might need to debug your code, and then those pathways in your brain might come handy.

“One quantitative benefit is that the maximum lifetime of certificates sets a bound on the size of certificate revocation lists. John Schanck has done heroic work on CRLite at Mozilla to compress CRLs, and the reduction from 398 days to 47 days further shrinks them by a factor of more than 8. For Let’s Encrypt the current limit is 90, so a more modest but still useful factor of 2.”

https://lobste.rs/s/r2bamx/decreasing_certificate_lifetimes_...

You could also run a simple program that checks each site and tells you the remaining lifetime of the cert used, to verify that you didn’t miss any cert.

It all depends on the scale of your operations, of course.

You might want to consider force-renewing all your certs a few days before your vacation. Then you can go away for over 40 days. (Unless something else breaks…)

There are other CAs that offer certs via ACME. For example, Google Trust Services.

The best solution I’ve found so far was to implement a custom cert manager using the formidable acmez library.

Gray backgrounds where also popular, with bright blue for unvisited links and purple for visited links. IIRC this was inspired by the default colors of Netscape Navigator 2.