2026-10-20 21:13 UTC
@silverwizard It was better than the alternative, leaving everyone stuck paying protection rackets or using cleartext. There was no viable movement to replace the CA system until TLS was established as mandatory; the default was just "oh, well CAs suck so don't use TLS".
Replies (2)
-
@khm@hj.9fs.net 2026-10-20 21:15
the alternative was, and still is, admitting that self-signed certs are fine and delegating authentication to the line-encryption layer is idiotic. CC: @silverwizard@convenient.email
-
@dalias@hachyderm.io 2026-10-20 21:15
@silverwizard What we need now is for whatever browser steps up as a viable replacement for Firefox and Chrome to actually use DANE correctly out of the box. Then we can start pressuring Firefox and Chrome to follow, and eventually deprecate the webpki system.