[Lammy]

Ironically, the inability to cache TLS on the edge of my network makes the Internet more surveillable since everything has to pass through the Room 641As of the world and subjects us all to more network behavior analysis. The TLS-everything world leaks so much more metadata. It's more secure but less private.

[kragen]

Yes, that's a real problem. Probably moving to a content-centric networking or named-data networking system would help with it, while also creating difficulties for censorship, and IPFS and Filecoin seem to be deploying such a thing in real life as an overlay network over the internet.

[globular-toast]

You can do it if you're happy to deploy your CA to your network, can't you? Deploying CA certs sucks, though. I wish it was easier.

[Lammy]

It's one of those things that may be technically possible but that doesn't matter unless a large enough percentage of other people are doing it too. Now that everything is geared to be realtime, anything most people will want to do on a computer will have those kind of traffic patterns. Even our popular application platforms are set up to encourage this pattern. Electron being a browser engine is geared around making network connections first and foremost.

[globular-toast]

Maybe I misunderstood your point. Why do you need everybody to be doing it?

[Lammy]

Concrete example: if my friends only use Discord and I want to talk to my friends, I have to use Discord whether or not I think it's bad for me.

[kragen]

That's true of Discord, but it's not really true of deploying your own CA certs.