Hacker News new | ask | show | jobs
by foxfluff 1653 days ago
LE also forces you to rely on DNS, which is highly centralized..
2 comments
midasuni 1653 days ago
How is DNS centralised?
link
judge2020 1652 days ago
All roads lead to . [0], ie. IANA. Many IANA-approved entities run them[1], but they all only resolve TLDs ICANN authorizes (and those TLD operators control what domains are registered under their TLD, of course).

0: https://dns.google/query?name=.&rr_type=NS&ecs=

1: https://www.iana.org/domains/root/servers

link
im3w1l 1652 days ago
Well on a technical level there are root servers. But DNS is a hierarchy and so if the root servers ever tried to pull a fast one there are second-in-command authorities that could take over: the cctld orgs. People would rather follow their lead than ICANN, so they have the real power. I'm pretty sure this is by design.
link
xxpor 1653 days ago
What CA doesn't?
link
hackmiester 1653 days ago
I don't think it was meant as a criticism, just a statement of the current status quo, which is inherently rooted in the centralized DNS.
link
foxfluff 1652 days ago
There are many CAs that give certs for IPs. LE won't.

Not that it's much better. IPs are still granted to you by someone in a centralized hierarchy.

link