Domain name/identity and key pinning has always been the only useful use of NFTs that I can think of.
Today, to encrypt your communications with people, you use something like PGP or Signal which rely on "trust on first use (TOFU) but verify", in practice people don't really verify so it's more like TOFU. This means that if someone compromised the session at the moment where it was created (or re-created), then your communication are being snooped on.
Today, to encrypt your communication to websites, you use HTTPS which rely on a vast network of certificate authorities. Any of these actors misbehaving leads to potential attacks. Because of that, the Certificate Transparency project was created to _potentially_ catch bad actors, that is if you check for your own domains regularly.
Using a consensus-based registry, you can prevent (better than detect) attacks in both of these scenarios. Let people register their identity or domain name, and associate a public key to it that can be used to encrypt communications with the identity/domain, as long as the number of dishonest actors remain under a threshold no attacks are possible.
The only (albeit not small) downside is that by taking middle men out of the picture, the naive approach prevents account recovery from happening. So to be practical, you need to find the right middle ground.
I think this just shifts the responsibility and point of attack onto the owner (which is true for all decentralized crypto). An attack is still possible and worse yet, it is completely irreversible.
That said, the option of taking personal custody and responsibility is important and I think it should always be an option.
> I think this just shifts the responsibility and point of attack onto the owner
The owner is always a target, it doesn't change that, it just removes a bunch of single points of failure and middle men.
> An attack is still possible and worse yet, it is completely irreversible
Attacks are always possible, but depending on your threat model you do end up eliminating a number of them. As I said, with a naive implementation you make an attack irreversible, but it's not impossible to imagine an optional, committee base KYC-based account recovery mechanism.
> Today, to encrypt your communication to websites, you use HTTPS which rely on a vast network of certificate authorities.
This fact has been irritating me for a long time. Because no one should believe that every single certificate authority is tolerant to any attempts to steal the private keys. But that is exactly the underlying assumption behind HTTPS being the only way to use HTTP in a more secure manner than exchanging in plaintext.
Let's think about this scenario: Suppose that I built a web service for my personal use and hosted it in public cloud. I don't trust any certificate authorities, so I created my own TLS certificate without using them. I installed my own certificates on the machine from which to connect to my web service. Now the server for my web service is serving in HTTPS using my own certificate. Am I safe? No. Because any entity with access to the private key of any of the certificate authorities trusted by my machine, is capable of intercepting the communication between my machine and my server, simply by MITM.
The problem of being forced to trust certificate authorities can be solved by adding the feature to embed a public key in a url. For example, it would be wonderful to have a url like httpsecure://rsa:PUBLICKEY/example.com/ to make sure example.com always responds using the key PUBLICKEY. IIRC, the Tor onion services is an instance of this -- the .onion domains include public keys.
> Am I safe? No. Because any entity with access to the private key of any of the certificate authorities trusted by my machine, is capable of intercepting the communication between my machine and my server, simply by MITM.
You're probably more safe than you'd think. Certificate Transparency is now required for Chrome, Firefox, or Safari or you'll get an error message during the TLS connection, before any private data is sent to the (potentially MITM'd) site.
Given that all certificates are logged, site operators can use some of the many CT alert websites to let them know if and when a new certificate is issued for their domain, so if some random authority they haven't heard of before issues a cert or it's done at a time they know they didn't need to renew their certs, it'd be time to raise major alarms about the occurrence and thus would mean instant loss of all business for that authority; plus, shockwaves would be sent across the internet as this would be a huge event, especially if it's against a company worth burning a CT for (eg. Google which houses so many fortune 500
companies' secrets).
> the .onion domains include public keys.
The .onion domain is, in itself, a public key. The side effects of your proposed solution are:
A) it would mean you HAVE to trust whoever sent you a link
A) 1) for web-based referrals, this would mean you trust your (possibly state-sponsored) search engine to never MITM you (this is currently mitigated by CT which would expose Google's GTS issuing a random domain's cert)
A) 2) for IRL events, this would mean you have to trust that the business themselves put up a certain QR code with the public key and not some malicious actor
B) This would mean site.com could never rotate their private key without changing all of their backlinks to one with the correct public key.
These are all problems Tor already faces - you have no idea if the onion site you're linked to is actually the site it says it is if it perfectly mimics it and/or reverse proxies the real site. You're currently always advised to get URLs from a trusted source once then only use bookmarks to access them to prevent reverse engineering. And you can't rotate your private key without doing this domain change.
Can't you pin the cert (http pinning)? Can we pin a CA cert of one CA? Can we add to dns which CA is allowed to issue certs for this domain like which ip is allowed to send emails?
Web browsers no longer offer key pinning because it's both a foot gun and subject to ransom attacks.
So what that means if, maybe the person in charge of the web site "cleverly" enables key pinning, then loses the keys, you fire them for incompetence but too bad your site is now unreachable for a long period, hope it wasn't important. But worse, maybe everybody you employ is smart or careful or both, but unfortunately bad guys break in, and they set up key pinning, then deliberately remove the keys. Now your site is unreachable... unless you pay them a ransom for the keys.
For non-browsers (e.g. a phone app) pinning is still very much possible, and I would say judging from what we see on community.letsencrypt.org that it does indeed function as a footgun - e.g. we had an outfit that does industrial IoT stuff and their things all believed they needed to see certificates from Let's Encrypt X3, which is a shame because X3 was retired in favour of R3 and so those things just broke until a human could reach them to perform a manual firmware update.
A DNS record to indicate which CAs may issue for a DNS name exists today, it's called CAA, and you are welcome to go set it up. However, CAA is about preventing a different issue than the one your parent was ranting about. CAA tells a trustworthy CA that you don't want them issuing, for example because their processes aren't suitable. But it does not prevent them from doing so, it would be a misissuance (policy forbids, they did anyway, that's a policy violation), but it wouldn't be impossible and is deliberately not detected by software like web browsers.
Let me give two examples, one where CAA fixes it and one where it's not applicable at all
1. [Yes this really happened] Facebook has a deal with a CA where Facebook pays them money and they have a bespoke process to issue certificates which includes ensuring the Facebook security team is happy. However, Facebook did not set CAA, and so when a contractor who didn't know any better just created a new web server something.something.fb.com and asked Let's Encrypt for a certificate, they got one. Facebook freaked out. Setting CAA would have prevented this, Let's Encrypt would say "Cannot issue, prohibited by CAA for fb.com" and the contractor asks his contact at FB, who then checks with security first and they either say "No" or get a certificate from their preferred CA. Today Facebook sets CAA.
2. Someone buys a domain example.com, and they're annoyed that the previous owner has a valid certificate for example.com which is still valid, from Entrust. So, they blacklist Entrust in CAA. This has no effect on that existing certificate, it only means the new owner can't get new certificates for that name from Entrust. The correct fix they should have done was to show Entrust that they, as the new owner, want this certificate revoked, in most cases that's just a matter of sending an email and doing what the reply says although the details vary by CA.
Lose your key? Lose your domain, forever, for everyone, irreversible by any legal intervention.
Yea, fuck that.
Also, as with 99% of "smart contracts". The main contract which allows for updating the smart contract, and thus is ultimately in control of everything, is controlled by 1 private key. Nice "trustless". Just gotta trust this one entity never to make a mistake.
Also, this has literally already been done at least 5 other times already before the "NFT" acronym was invented. Remember namecoin, anyone?
If I lose my ssh key I lose access to any data on my server, too with no recourse and we are fine with that.
It's a trade-off but some people can take care of their keys and prefer that risk which they've covered over a risk that a third party can take control which they can't cover. It's fine if you are not one of those people but not everyone has your needs.
> Yes, my friend! It will because you can easily build your own decentralized website and simplify your cross wallet crypto payments, share music and photos (not just of my kids), start a business, secure and verify your identity “on chain”, or showcase your brilliant NFT art gallery.
Why on earth do you want to decentralize personal belongings? I absolutely want my possessions centralized, in storage locations I own. That is the much more obvious solution than putting personal possessions on a blockchain. If you want to store digital tokens for your kids that you can be reasonably assured will still be there when they become adults, use thumb drives. Keep them in a fireproof safe if you're really worried. Somehow, my mom has managed to keep all the videos and photos of key events in my childhood safe and intact for 40 years without having to put them on a public distributed ledger. When betamax went obsolete, she transferred to VHS. When that went away, to DVD.
I really don't understand what this woman thinks she is buying. I guess this is a better storage medium for precious moments and collectibles than sending copies of everything to gmail, but so is almost any other way of storing something.
> my mom has managed to keep all the videos and photos of key events in my childhood safe and intact for 40 years without having to put them on a public distributed ledger
No offense, but in all likelihood no one is attempting to counterfeit or pirate your Mom's videos and photos of your childhood, and ownership/p2p ownership transfers are not material.
There are almost infinite real world examples were ownership records are benefited by blockchain technologies over centralized services. Take property deeds, usually kept and recorded at the County level, there is almost endless fraud with people filing forged quitclaim deeds on a daily basis. That would be an example of a public record, but their are private record keeping examples such as stock certificates. Usually the "Dole" case is the most famous example, where you have a publicly traded company with all the benefits of corporate record keeping, stock trusts and banks, and centralized stock exchanges, but when the buyer went to take it private low and behold the public company with all the centralized safe guards in the world should have had a total capitalization of 36M shared but somehow had about 49M share issued, it only ended up in $150M in damages, but this could not have happened using blockchain and most agree nearly every publicly traded company likely would have the same inconsistencies.
> Usually the "Dole" case is the most famous example, where you have a publicly traded company with all the benefits of corporate record keeping, stock trusts and banks, and centralized stock exchanges, but when the buyer went to take it private low and behold the public company with all the centralized safe guards in the world should have had a total capitalization of 36M shared but somehow had about 49M share issued, it only ended up in $150M in damages, but this could not have happened using blockchain and most agree nearly every publicly traded company likely would have the same inconsistencies.
This sounds like a technology problem for which a public blockchain is but one possible solution. Surely other append-only log data structures exist which could step in to fill this void.
AFAICT the main issue with crypto equities — and all other similar constructs — is what happens when a court of law overrides them. If a court says your ex owns half of the shares in $WALLET, but the blockchain doesn’t, and $COMPANY which issued the shares is also subject to the whims of the court, then what are we to do about this?
OTOH maybe this rabbit hole really just never ends until courts are also somehow replaced by a public blockchain, likely at the behest of the very biased investors who stand to disproportionately profit from this game.
>This sounds like a technology problem for which a public blockchain is but one possible solution.
I don't disagree, and "blockchain" as used sort of is misleading because at this point their are many solutions within the blockchain technologies and it is still rapidly evolving.
>If a court says your ex owns half of the shares in $WALLET, but the blockchain doesn’t, and $COMPANY which issued the shares is also subject to the whims of the court, then what are we to do about this?
You could hold a non-complying party in jail/contempt of court for one, this happens with real world assets that do not get turned over now.
But again there are implementation of blockchain solutions, where say the Company that issued shares did so on a smart contract and with a Court order they could burn half the tokens/stock in the wallet mint that same number and transfer them to the wife per the Court order.
> You could hold a non-complying party in jail/contempt of court for one, this happens with real world assets that do not get turned over now.
This doesn’t appear to resolve the issue of the blockchain reflecting a different reality than that decided by a court.
> But again there are implementation of blockchain solutions, where say the Company that issued shares did so on a smart contract and with a Court order they could burn half the tokens/stock in the wallet mint that same number and transfer them to the wife per the Court order.
How would this hypothetical court order be verified without the involvement of trusted third parties? Presumably judges in many places could be bribed or coerced into rubber stamping such an order.
You proposed the hypothetical starting with the Court. If you want blockchain to preempt any court involvement your hypothetical needs to start at that point.
I think it is possible through the prisoners dilemma. Have husband and wife have a joint wallet from the beginning governed by smart contract with agreed upon prenuptial terms. Marital assets could go in and then upon divorce they be equally split, the husband and wife could be required signatures, but if only 1 signs the funds/assets are locked until both sign. Maybe in rare instance you get one partner willing to lockup the funds and sacrifice their own finances, but that the entire point of blockchain/miners and the prisoner's dilemma.
What about people being sued for damages, or creditors laying claim to the assets? There are endless cases where a court can unilaterally decide your assets are not your assets any longer.
Also, your hypothetical solution to the blockchain not reflecting court orders in the narrow case of divorce law is to ensure every married buyer of a crypto equity has a prenuptual agreement in place in their crypto wallet. Can you think of any problems with that plan?
I can think of a problem when someone poses a hypothetical with a given set of facts, you propose one of many potential solutions, then they change the facts of the hypothetical. For example, someone asking about a dissolution of marriage and then complaining the solution was limited to "narrow case of divorce law" and adding in addition 3rd party creditors. Its well beyond the scope of any limited good-faith discussion on this forum but the court does not have jurisdiction and is not concerned about 3rd party creditor rights in a dissolution of marriage action, they may consider the debts themselves, but not the actual interest of the creditors vis-a-vis the marital assets. Though, at least in the US, there are 50 states with 50 different legal standards governing. I am a lawyer, but I am not your lawyer, good luck.
If the blockchain manipulates balances according to the whims of a court, then manipulating the court becomes a potential source of revenue for anyone able to game the system.
But if the blockchain doesn’t manipulate balances according to the court, and the court decides half of your crypto equities in $WALLET now belong to someone else, then at that moment in time the blockchain’s account balances become inaccurate. These types of events happen not infrequently, which creates a problem.
Perhaps blockchain property titles will make my point easier for you to understand. Say you own the house at 187 Blue Kodiak Drive, and the title is an “NFT” recorded on the blockchain. The NFT must be respected (!). Then a court steps in and assigns ownership of 187 Blue Kodiak to a bank, because it turns out you haven’t been paying your mortgage. But wait, the blockchain still says you own the home at 187 Blue Kodiak Drive (!). However, you don’t own it anymore — not legally, not physically.
Now pretend the blockchain on which the 187 Blue Kodiak Drive house title is recorded dutifully obeys the commands of the court which in our previous example allowed the bank to repossess it. In our previous example, that’d be just fine — after all, you haven’t been paying your mortgage. But now the issue changes: The Pink Panther slides his way into the court one day, and one way or another convinces an decision-making authority there that you’ve sold him the home at 187. The Pink Panther is now in possession of the title, and you’re out of luck.
Ultimately, this criticism of smart property has been around for many years now. It wasn’t my intent to “surprise” you with it. However, people invested in tangentially related crypto systems tend to really struggle with this. That’s because public blockchains were never designed to track non-bearer assets which exist in in the real world. Unlike companies built by humans or real estate, the (public) blockchain exists only in cyberspace, and therefore any ownership data of company shares or real estate recorded on the blockchain can only ever be an approximation of the truth. Permissioned blockchains — or simple databases for that matter — tend to be a better fit for situations such as this. The issue with them is they don’t take investors.
I should walk back any negative tone, for the most part I can tell you are interested in a genuine conversation and discussing the merits.
Your issue is with the Court, all the way up to bribery, which would exist with or without blockchain. Your concern is not without merit I suppose, but in my opinion is an extreme edge case against blockchain to suggest the legacy system is a better solution, when the very edge case you describe exists in the legacy system. Thus, it over looks the benefits the blockchain solution would have.
Again "blockchain" is a bit of a misnomer in the sense it suggests blockchain is a single tech solution, when there are many existing implementations from multi-party signatures to smart contracts - yes controlled by a 3rd party - when say an NFT ownership record could be burned and/or reminted.
I am also not entirely sure about this point:
>The issue with them is they don’t take investors.
Almost every legacy system I am aware of that is utilized by the Courts are money making machines that have investors and/or are publicly traded companies. I am sure you could find one or a database that doesn't have investors, but the money is certainly there for software solutions used by the Courts.
What happens when the blockchain does not reflect the actual legal situation of ownership? For example, assuming a classic blockchain model where my property deed is given to me as a private key, and I have to sign the transaction to transfer the property, what happens when I lose the key and yet the city has expropriated my lot to build a park? This seems to require the authorities to have some kind of master key or ability to retroactively edit the blockchain. Which negates much of the security advantage of a blockchain model?
I suppose the answer to that would be to treat blockchain as the record of truth.
Kind of how if you have properly motorized property papers (I have no idea how this works in US), and find your land was inappropriately allocated by county without your knowledge you get to sue them, just with block chain record instead of paper.
This is a great idea until you get hit by a bus and now your private keys are gone and your family can no longer recover your estate(house and investments).
Should a mechanism exist in your system wherein-by your family can reclaim ownership without your keys, means that whoever the chain says owns something clearly doesn't actually matter anyways.
Recovery mechanisms can be implemented as smart contracts. For example, you can set up your wallet so that with Key-A can be used to transfer funds/NFTs freely, but Key-B can only transfer to a specific recovery account. Transfers from the recovery account can either be made with Key-B after a certain amount of time has passed, or immediately with Key-A. You keep Key-A, your family gets Key-B. If something happens to you they can get the assets out after a set time using Key-B. If someone tries to abuse Key-B to take the assets while you're still around you just use Key-A to transfer everything to a different account before the waiting period expires.
The unrecoverable private key is just one implementation of blockchain technology, there are various way to implement a blockchain solution to various use cases.
BTW current centralized solutions to estate planning issues are not exactly that great anyway. it is not unusual for family not to know a will, insurance, pensions, and bank accounts even exist for deceased. Just look at the current unclaimed assets for deceased I think its around $2T.
The "Dole" case you're talking about was not actually how you describe it. This will shock no-one who is used to "blockchain" fans trying to bamboozle them.
[Edited to add: The court case that makes this happen isn't related to the share records, it's just the routine shadiness of business owners trying to pay less than something is worth, the discrepancy is noted after the court case is done when trying to reconcile the people who have proof they owned shares, and thus are entitled to a settlement versus how many shares existed]
The record keeping worked exactly as intended but it isn't how people tend to imagine, and this is the difference you've tried to portray as somehow being solved by a blockchain when in fact it would not be.
Specifically, those millions of "extra" shares are because of short selling.
Some of the people who had good reason to believe they'd owned Dole shares, had in fact bought from short sellers who'd sold shares they didn't yet have. If Dole had not gone private, the short seller buys those shares (maybe for a lot more but they hope for a lot less) and passes them on. But it did go private, so the short seller is responsible for paying up what the private buyer agreed to pay for these shares. This part all worked, all those shareholders got their money.
But the court case changes how much money they were entitled to, years later - and since the court isn't in the business of doing complicated financial paperwork it just told the businesses which implement all this it's their problem and wished them luck. Most of these owners will be huge institutions and will have an existing relationship with an equally huge broker and that relationship will have likely determined what happened next (e.g. this loss from hard-to-trace shorts isn't worth it, just give them their money in full and write it off).
The blockchain could have exactly reproduced this outcome, but it would not have improved upon it at all.
Brasil solves the problem of land titles with a central land ownership database feed by private local notaries under jurisdiction of the department of justice. In some remote locations there are still fraud, but because the local notaries are corrupt. Not a problem that a distributed database would solve. A blockchain only gives a certain guarantee that the records haven’t been altered, but not that the information was input correctly in the first place.
It doesn't sound much different from the US, but we don't feed the local recordings to a national database (I would like that). As it is each local government can have different systems, not even all of them have digital systems yet, some are still all hard copies. So uniformity at the local levels would also be nice, or at least some minimal standards.
We suffer from the same problem where nothing stops errors in the recorded documents. But most of the intentional fraud is as simple as: You own Property A and I file a Quit Claim Deed transferring Property A from You (the lawful owner) to myself. As far as I know all the local levels do require these documents to be notarized, but we too suffer from bribery or just simply corruption where a notary may either be part of the fraud or just helping a friend/family member commit the fraud.
If the transfer required signature by private key it would help curb this type of fraud, but there would need to be additional safeguards and there are many other types of fraud and unintentional errors that exist. A system like Git might actually help with some of the errors as it would highlight changes from a current recording to a past records and even incorporate the official land records of the local governments.
Why couldn't this happen on blockchain? It really assumes everyone is using that same blockchain network, which is not a guarantee. Were the stock certificates released on Ethereum? On WAX? Are you sure you checked all of the networks?
...so they claim to be a consensus based registry, yet they block existing trademarked domains and are the only entity receiving money? How does that even hold up with their core argument that DNS is too centralized?
Hi, i read your comment from January 2020, where you said you had a t440p working with 32gb, ram, i wanted to ask you how did you were able to do that since t440p is for default blocked at 16gb. thanks
If you want me to help you do reverse engineering work, or order my services as a consultant on matters of how to patch coreboot - please use my website to contact me.
Otherwise I'd recommend you to try the checkra1n or ivyra1n discords if you want to try to patch the mrc.bin yourself.
This isn't quite the same thing, but Brave has had support for IPFS[1] for a while, which I think is a pretty cool alternative to the ICANN-controlled TLD system.
Not sure about others, but I've paid thousands of dollars for ICANN renewal fees over the last decade... love the idea of "owning" real estate on the internet vs. merely renting it (and having prices go up every few years).
From the docs it seems like you can "hardcode" IPs or...a traditional dns cname.
At $40/domain, if you update your DNS records once every two years, you're really only just breaking even.
Also, from the FAQ:
> Trademark holders with proof of ownership can apply to claim ownership of trademarked names. If a trademark name has already been sold, then it will be refunded. Note - this process ends once domains have been distributed. Unstoppable Domains does not have the ability to move a domain once distribution has occurred.
Seems like a less-than-agreeable policy for most folks. Unless you're a scalper.
You shouldn't have to pay much though, it's should simply be a transaction on the Ethereum network. If whoever set up that contract wants to take a fee, then it's up to people to use another contract.
The average ethereum transaction fee right now is more expensive than a domain renewal fee for many common TLDs.
Right now, the original purchase price of one of these domains is ~4 years of fees on a traditional registrar. Let's round the transaction fee down to $10 for the sake of simplicity. If you update your configuration every two years (which seems generous), you'll break even in...six years? And that's assuming whoever made the contract doesn't take a fee.
This assumes Ethereum fees don't change. Proof of stake might affect transaction cost, but the trend right now is up and to the right: in one year the average transaction cost has increased two orders of magnitude.
If we assume the rate of growth of the average transaction fee slows dramatically to one order of magnitude every two years for the next few years, that means the cost of your domain will probably never break even (over a traditional domain) in your lifetime. Even if it only doubles every two years, you'll likely never break even.
More fragmentation. I use Nextdns for my router's DNS, which theoretically allows me to access any domains on the competing Handshake crypto protocol, but I've never actually some across any so far.
I like the "speed dial" feature of mobile opera. I can't find a comparable function for mobile FF or Chrome. How do you guys switch between your list visited 10ish site on those browsers?
I don't believe keeping your favorite 30 website open in tabs is comparable. You would have to switch to tabview, scroll to your site and refresh the page. Speeddail lets you get there in 2 clicks, I love the feature. Firefox and Chrome don't have anything like it.
No really, you should check out the 'speed dial' on Opera. It's the only reason to use it. You can get to your top 30 websites in 2 clicks. I don't think mobile chrome or firefox let me organize bookmarks like that.
> Remember when the world wide web began? Many thought static pages were not that exciting (what the heck am I going to do with this?), and no one could have predicted all the use cases that followed! Purchasing clothes on your phone, real-time traffic updates, scuba diving weather forecasts, locating your ‘tweens around town. As we enter Web3, the same excitement exists…where will Web3 advancements and integrations take us?
Take me back to the boring, reliable, niche internet and keep the use cases.
Where is this money going? How are these prices set? I looked up a four letter .com I have and it’s $2400. Why?
Other domains aren’t available yet.
NFTs for names is a really good idea but it seems like the novelty is in getting acceptance and trust. Not sure why a random org should get really substantial fees for names. For ICANN we’re forced to. But for a good blockchain solution the prices should be equitable.
I understand that reselling goes to the owner, but this seems like a cash grab.
That and many domains like common first names aren’t available yet.
I agree that the prices seem arbitrary and high, but since there's no central authority competition could drive the prices down. Eventually I think we'll get to a Let's Encrypt level of service and all of this will be free, as I don't see a technical reason anyone should pay more than the transaction costs.
The high cost does prevent abuse though, as squatting would be a bigger nuisance than it is with traditional DNS if registration were cheap/free.
There are only so many viable combinations of 4-letter domain names... $2400 seems pretty fair compared to what .com's of the same length are going for (50K-$1m+ for random 4 letter combinations)
Fair compared to what? Why should the price for one be greater than another? The price of generating an NFT is the same no matter how many combinations.
As a user, I would not want willingly join in a new name system that benefits an arbitrary company so much. ICANN forces use of domain registrars so I have no choice. A future system should be better, I think.
I'm not a blockchain fan but "somebody tried this once and it didn't work" is hardly a dismissal of an entire class of ideas. Beanz didn't catch on but bitcoin seems to have.
Not just 'somebody', but like a dozen different somebodies with many different methodologies. Getting an 'alternate root' DNS system trusted in any appreciable percentage of popular operating systems and web browsers, in a default out-of-the-box configuration, is a very hard problem to solve.
Yes, it is a very hard problem to solve. This is primarily because a 30 year old DNS system is entrenched into the infrastructure of the internet, it was not built to change and so implementing changes fights the network effect.
The only solution to this problem is brute force. The problem is a brick wall. The only way to get past it is to keep creating newer, adaptable naming systems and supporting them. Every attempt to create a domain registry system that is not centrally controlled I will support, even though most of them will fail.
Blockchain technology only became popular in the last decade and, as much as it has become a meme at this point, DNS is actually one of the best use cases for it. The current DNS is distributed, but highly centralized, and paying renewal fees for keeping a record in a file and a server running feels like extortion. An immutable, consistent and decentralized storage system solves those issues, and I can pay once and technically own that record for life. (Though Unstoppable Domains' prices seem arbitrarily high...)
So I'm hopeful that some of this new tech can disrupt the current system, which we know is inherently flawed.[1]
While I'm not going to use Opera anytime soon, we should celebrate this news and push for other browsers to do the same.
That's a fair point, and I don't have an answer. Presumably there would be enough TLDs to ensure a unique name is not as important, as it's just a short label anyway. Maybe there could be an expiration or some kind of override mechanism built into the protocol, though I'm not familiar with NFTs to know if this is feasible.
I'm not saying there wouldn't be challenges with this approach, but it seems worth a try if it means replacing an outdated and vulnerable system.
The ENS (Ethereum Name Service) technically loans out the domain names and they are put up again on the market if the owner of the domain doesn't renew it before expiry.
What annoys me is that there is no easy way to change DNS servers. Try on IOS, or Android and you'll find it such a hassle being hidden within other scary network settings. Windows you need to click through five different features and not forgetting that DNS is an alien word to most. Try and explain it in the simplest of ways such as "a phone book for computers" you've just bored the subject to death
I use OpenNIC and know how to navigate around my router. However for my mother, that's a whole different story.
This is no joke. Changing the DNS server on Android is difficult for anyone that hasn't hacked android since it's early days. And it is getting more difficult. The fact that it is not an easily accessible setting is an indication that it is designed deliberately to disempower people.
Then configure her router's DHCP to set DNS to the OpenNIC servers or to the router itself which forwards to OpenNIC. That has worked for all my devices, and would be a pain to configure otherwise.
I've been using Mozilla, or Phoenix, for as long as I can remember but there was a period during 2004-2005 that Firefox used too much RAM on my 256MB laptop and I had to use Opera.
At that time they had ads inside of the UI of the browser so I had to make a firewall rule to block those, but other than that it was a great browser in the pre-noscript days.
But I've also heard some insider info from a Norwegian pal and apparently it's a disaster in that company. Only reason they're still alive today is all the embedded work.
I was just looking at registering my name on https://ens.domains that give you a "decentralized" .eth address. The registration fee was like $10, but the gas cost was like $80. So I didn't do it.
Ethereum needs to move to Proof of Stake ASAP.
Edit: Also, it looks like this deal doesn't include ENS. I thought "unstoppable" was just being used as an adjective at first, but it's a company.
I am not sure I understand the technology, but personally I like the idea of an immutable/unstoppable Internet as it is sold here. I am guessing that those with deeper technical expertise will be able to show that this is all just marketing and things are still ultimately, "stoppable", but the goals seem right.
I try to register more than 10 domains, all with protection, but these domains are not copyright related, upstoppable domain use a sneaky word matching system to prevent you register a good name, oh thanks for this but no.
Dunno why, but IPFS seems such a kludge. Just share your static files in the distributed hash table and access those resources via their hash ID. Like... it's not much.
This news is interesting as I wonder what happens if .crypto does become a TLD?
Opera is beyond rescue. As someone who spent a decade working there it saddens me to say so, but please don't use it.
Actual, executive day-to-day control over the browser tech has progressed sort of like this:
1995: Oslo, Norway
2008: Linköping, Sweden
2014: Wrocław, Poland
2020: Beijing, PRC (the sale happened in 2016, but they were hands-off for quite some time; I think they were being busy with shady fintech stuff in Africa enabled by the Opera Mini work we did mostly in Sweden a decade earlier: https://www.engadget.com/2020-01-19-opera-accused-of-predato...)
Opera in the late 90s / early 00s was such a great browser though. It was one of the first to adopt tabs, had a very responsive and slick UI compared to the competition, and the rendering engine was fast and fluid, though sadly not well supported or compatible. Even the built-in email client was decent, and much better than the one in Netscape Communicator from what I remember. Being share/adware was always a problem, but it was my main browser for a couple of years back then. Opera Mini was also excellent on pre-iPhone devices.
Nowadays I wouldn't come near it, mostly because it's proprietary software owned by a company with shady business practices.
Still, this is great news and should be applauded FWIW.
I dunno, if Google was sold to a Chinese company (so, essentially controlled by the CCP), would that in your mind be grounds to avoid using their services, or just another case of "China bad"?
I'm guessing you're perhaps conflating criticism of China/CCP with recent idiotic attacks on random asian people in the US?
I agree with you in principle, but I also disagree with your example.
No doubt, China uses this kind of opportunity to spy on users, which I think is plenty good a reason to stop using Opera. OTOH, Google's also spying on its users for profit (at the very least).
Please consider using Firefox. They're currently a very competent browser, and their principles are still rock-solid.
If you still prefer Chrome but want to support what Firefox stands for, think about donating to the Mozilla Foundation: https://donate.mozilla.org/en-CA/?source=donate_redirect. They do some very good work in the online privacy and digital rights space, and even though they're not the top dog in the browser space, they've got plenty of weight to throw around.
> Changing these dangerous dynamics requires more than just the temporary silencing or permanent removal of bad actors from social media platforms.
> Additional precise and specific actions must also be taken:
> Reveal who is paying for advertisements, how much they are paying and who is being targeted.
> Commit to meaningful transparency of platform algorithms so we know how and what content is being amplified, to whom, and the associated impact.
>Turn on by default the tools to amplify factual voices over disinformation.
> Work with independent researchers to facilitate in-depth studies of the platforms’ impact on people and our societies, and what we can do to improve things.
The basis they use to justify their stance is irrelevant. Good crises have always been used as a way to legitimize future abuse. I want a browser, not a tool meant to manipulate what I'm allowed to say and to see while posing themselves as arbiter of truth.
If you want to donate your hard earned money, the EFF are really the most effective, ethical and sane organization that I know so far. GNU is alright but are way too deep into ideology over practicality to my taste.
> Mozilla has openly gone pro deplatforming recently
The article you've linked does not specifically advocate deplatforming as I read it.
It begins by questioning when platforms should make the decision to deplatform, and who should have the power to do so:
> When should platforms make these decisions? Is that decision-making power theirs alone?
It implies that deplatforming is ineffectual, as there's no single voice which could be silenced to prevent hate:
> [...] the rampant use of the internet to foment violence and hate, and reinforce white supremacy is about more than any one personality
And it suggests solutions, which you have included in your post, which do not involve deplatforming, they involve transparency. It says, "Changing these dangerous dynamics requires more than just the temporary silencing or permanent removal", which I suppose you could read as advocating deplatforming as well as their proposals if you approach the article with the intent to find that view, but given the context of the rest of the article suggesting that deplatforming doesn't work, it seems more like the author is suggesting that deplatforming be replaced.
It's a pretty wishy-washy article overall, and I think its suggestions are a bit hollow without more specific steps to take, but it appears to go to great lengths to not specifically endorse deplatforming. Reading what they have said as a call for such action, rather than advocating alternative solutions to the issues faced by social media comes off as disingenuous IMO.
The article explicitly calls fore more, implying in addition of. Mozilla's only reason of existing is Firefox and therefore their only way to enforce this kind of measures.
I didn't know about that, thanks for the link! I do agree with some of their points though: transparency in advertising and how algorithms pick content for users, as well as facilitating disinformation/misinformation research would be (in my mind) a pretty big win these days. Deplatforming's more dangerous in general, though.
What are you afraid of a Chinese company doing with your data? Giving it to government agencies? Google already does that. If I had to choose personally I would much rather the CCP have my data than US three letter agencies. If you live in the US then the US government can do a lot more to you than China can.
If you miss the old Opera UI/UX then Otter may be a decent replacement. If you want what would have been the actual continuation of the old Opera then go for Vivaldi (made by some of the old Opera team members).
I didn't know they had a built in email client, they didn't have it last time I tried Vivaldi and that's why I eventually stopped using it. Thanks for that info.
On Linux, there is a white line on top of all fullscreen pages (YouTube) [1], Downloads page doesn't work, video glitches out and the entire browser is unusably slow when you have many entries in your browsing history.
I still think that was a necessary decision. Jon Von Tetzchner (one of the two Opera founders, and a previous long time CEO) strongly disagreed, then from the outside, but later did the exact same thing with Vivaldi. (Jon is a fantastic mensch, btw. One of the best CEOs I've ever had.)
Google had very purposely raised the bar by putting like 5x-8x more competent engineers than the Opera core (non-platform/UI-specific stuff) team had, working on inventing and implementing random new web standards that they then promptly started using on google.com properties. Think e.g. 500-800 engineers compared to 100. We simply couldn't do the same. Then this ratio started growing until it was obvious that it would eventually become an existential threat.
They used their financial success in one business area (search ads) to become dominant in another area (browsers) in a clever and perhaps not entirely legal way.
The irony was how ages ago everyone was waiting for a browser to come along and unseat IE, which was not a good browser.
Now Chrome works well enough as a browser and has so much market share that it exerts too much control over its users and the Web, and it's unlikely that anything will be capable of obsoleting it in the near future.
I think the trick might be to make a browser that supports a reasonable subset of html/css/js + some killer feature. (Much easier said than done, though: but some kind of mobile app platform like WeChat might be a good way to get a foothold)
Or just fork webkit/blink and aggressively refactor.
The killer feature could be a file type named after the kinds of websites people make. Say .blog or .forum or .store or .social perhaps even .aggregator or .hn (lol) each would work like a straight jacket or like a website on a platform (.blog like blogger, .store like shopify etc) it could be distributed and insanely fast. Every other link just opens in the normal browser.
It's interesting to think about this sort of thing: interactive forms generated from OpenAPI specs? Some way to plug-in handlers for specific mime-types? etc.
This is the dream, honestly. Dynamic form creation from specs. PowerShell has something like it (for a function it will create you a ugly form that you can render), but if you could deliver a OpenAPI spec and have Bootstrap (or whatever) UI on the frontend automatically generated.
The Swagger UI[0] is more a documentation/exploration tool for APIs, but it shows enough of what you can do that I don't think it'd be all that difficult to generate something that you'd want to put on your own website.
The main reason I disliked it was it wasn't standards compliant for the parts it did implement: you couldn't write code to-spec and expect it to work on both IE6 and Firefox, without testing each browser separately.
There's a form of regulatory capture where big companies benefit from having more stringent regulations because they are the only entities with enough resources to comply.
It certainly feels like Google is using the same playbook for web standards. They've created enough churn that no one else can ever hope to catch up in implementing those standards.
When Google products stop working on some competitors browser they can simply say "it's just web standards" and feign ignorance.
I would very much like to use a browser that didn't support all the random new web standards (like, I don't know, WebUSB) and rendered most "content" sites good enough. You could still just embed a WebKit/Blink window in order to run web apps.
I really liked old Opera and even Edge for their engines that made the web pages feel snappy and somewhat different than the WebKit monoculture.
Shouldn't a company in a country with these[1] practices rightfully be met with distrust in these contexts? Spoiler alert: I'm not a culture (or politics) relativist.
It seems a little weird that you'd trust a web browser developed by a company that resides in a country famous for massive, systemic internet censorship, as well as habitual government interference in and control over domestic companies' operations.
That doesn't mean that today's Opera is definitely an untrustworthy piece of software, but it does raise the probability quite a bit.
Not by Chinese people, by the CCP. Which it becomes as effect of being controlled by a legal entity in PRC. This has nothing to do with ethnicity or culture and everything to do with the current political situation in China.
Opera died to me after version 12 (the moment it essentially became Chrome with a different skin).
I was their user since version 5 or 6 (this was before everyone started the crazy version system, back them they released a major version about once a year).
The biggest things that I loved about the browser you couldn't get by extension, they could do many things because they could directly update the engine.
Now learning that they are owned by PRC there's even less reasons for me to use it.
Opera could have done a lot of good if they would open sourced their old browser (kind of line what Netscape did). Someone leaked the original source code, but because it was leaked and not officially published, no one wants to touch it. Anyway now it's too late, because it's way behind the current browsers.
The Chinese government cannot be trusted. PRC-based companies are required to cooperate with the state intelligence apparatus. Not that much different in the US and the US-aligned world, but at least there is more transparency, open discussion, and defiance.
All the reasons (privacy/spying, government unaccountability, etc.) that would make basing a tech company in the US bad are worse in China.
It does seem, though, many are (seemingly in bad faith) increasingly conflating criticism and scepticism of the Chinese government with racial or ethnic animosity. It is almost identical to how discussions surrounding the Israeli government are conflated (seemingly in bad faith) with anti-Semitism.
They don't have to be fully operated by a govt in order to exert operational control in certain areas of interest.
We have seen this with Zoom: China-Based Executive at U.S. Telecommunications Company Charged with Disrupting Video Meetings Commemorating Tiananmen Square Massacre
Uyghur genocide, the Dalai Lama, Tibet, Hong Kong, Inner Mongolia, West Philippine Sea, Spratly Islands, Taiwan, Galwan Valley, Mekong River, Nepal, Laos, social credit, pervasive surveillance, Falun Gong persecution and organ harvesting (debated?), stealing tech, economic protectionism, ...
America does bad too, but we can't act like this state is any better. Some of the things they're doing to play catch up are appalling.
Yeah I'm kinda confused as to why he went through all the effort of setting up email addresses rather than throwing them in a folder and backing it up to as many off-site storage providers as needed to make him comfortable.
I get that sending an email might be easy but so is uploading to Dropbox or Nextcloud if it must be self-hosted. And you don't have any storage limits.
Plus having blockchain domain names does nothing for the storage. IPFS is great but he still have to keep seeding it or it will go offline eventually. He still needs backups!
Today, to encrypt your communications with people, you use something like PGP or Signal which rely on "trust on first use (TOFU) but verify", in practice people don't really verify so it's more like TOFU. This means that if someone compromised the session at the moment where it was created (or re-created), then your communication are being snooped on.
Today, to encrypt your communication to websites, you use HTTPS which rely on a vast network of certificate authorities. Any of these actors misbehaving leads to potential attacks. Because of that, the Certificate Transparency project was created to _potentially_ catch bad actors, that is if you check for your own domains regularly.
Using a consensus-based registry, you can prevent (better than detect) attacks in both of these scenarios. Let people register their identity or domain name, and associate a public key to it that can be used to encrypt communications with the identity/domain, as long as the number of dishonest actors remain under a threshold no attacks are possible.
The only (albeit not small) downside is that by taking middle men out of the picture, the naive approach prevents account recovery from happening. So to be practical, you need to find the right middle ground.