Jess👾JessTheUnstill@infosec.exchange
Oct 23, 2026, 2:42 PMMaybe baking "trusted" certificates into every OS, browser, and programming library out there was a bad way to manage certification.
Replies
Matt Hall401matthall@mastodon.xyzOct 23, 2026, 2:42 PM
Oct 23, 2026, 2:49 PM@JessTheUnstill "It's too hard to interface with the OS trust store. I'll just reinvent the wheel instead."
Epic NullEpic_Null@infosec.exchangeOct 23, 2026, 2:56 PM@JessTheUnstill Yes but you see if we question it the next step is to ask who gets to choose who the authority on Trust is and that raises questions that those who get to choose the authority on trust don't want us askinf
- Epic NullEpic_Null@infosec.exchangeOct 23, 2026, 3:06 PM
@JessTheUnstill (This is also one of the reasons I hate the structure of DNS so much. A single agency should not own Every Domain Name. .RU and .EU and .US should have very different top level ownership)
- Jess👾JessTheUnstill@infosec.exchangeOct 23, 2026, 3:08 PM
@Epic_Null What, are you meaning even ICANN's control of . ?
- Epic NullEpic_Null@infosec.exchangeOct 23, 2026, 3:31 PM
@JessTheUnstill ICANN IS A SINGLE ENTITY WITH TOO MUCH AUTHORITY!! But aside from the principal of the thing, they approved of .zip, and there was another one recently that was a file extension, and that shows some questionable judgement.
This gets finished off with tha fact that it's really concerning that the US could sieze domains belonging to, say, Germany without Germany's say so.
So yes, even Icann's control over TLDs.
- Jess👾JessTheUnstill@infosec.exchangeOct 23, 2026, 3:51 PM
@Epic_Null Correct me if I'm wrong, but I didn't think ICANN could seize an individual domain, they just manage pointing . To .de . So they would have to seize all of .de to fuck with it.
Aaronhosford42@techhub.socialOct 23, 2026, 7:58 PM@JessTheUnstill A federated solution, instead of the standard top-down authoritarian approach?
- Jess👾JessTheUnstill@infosec.exchangeOct 23, 2026, 8:28 PM
@hosford42 At the VERY least, make it so everyone simply respects the OS cert store, and stop embedding their own versions all over the damn place. Then it's just an OS patch.