RE: https://mastodon.social/@tom7/116400371274962195
Whenever I get the chance while talking to #firefox or #chrome people or #http folks in general, I try to emphasise this one thing:
DO NOT BREAK CLEAR HTTP/1.1 (non TLS)
While I am just a simple guy who just only sometimes happens to be lucky to DTRT, mostly out of sheer luck based on experience and principles I adopted during my teenage years, the brilliant @tom7@mastodon.social has the mental and other capacity to explain the reasons much better than I ever could.
Please read the paper.
Heinous Type Tom7 Project Summary:
@tom7@mastodon.social In short, I believe that, as long as TLS (via LE) is basically just proof that the owner of a certificate was able to generate a plain text http response on the IP address which DNS (likely not signed either) pointed to, TLS IS BROKEN.
As long as "everyone" is offloading TLS to CDNs, TLS IS BROKEN.
As long as web sites need to get approval by "the central internet registry" (aka CAs), TLS is broken.
The best idea I ever heard to fix this is #dane https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities