There are very good reasons for not conflating publishing Trust Anchors and publishing security policy.

Show Post

Anyone who knew the DNS business at the time, knew that the registrars sold DNS names at cost hoping to upsell Web hosting. But most of their money came from CA affiliate deals reselling TLS certs. So the DANE proposal effectively killed DNSSEC deployment.

Show Post

What we should have done is to use DNS optionally backed by DNSSEC to publish the security policy (must use TLS, must be via this anchor). Which I tried to do with CAA, then the DANE people insisted on doing it their way and made it undeployable.

Show Post

Certificate pinning ultimately proved largely unworkable on the web, but it is unfortunate and we did try like in HPKP. Pinning is used in many software update mechanisms, however it's spotty.

Show Post

The first guy to discover you can just have sex with men, talking on his podcast: "I just don't see how women come back from this."

Show Post