Today, to encrypt your communications with people, you use something like PGP or Signal which rely on "trust on first use (TOFU) but verify", in practice people don't really verify so it's more like TOFU. This means that if someone compromised the session at the moment where it was created (or re-created), then your communication are being snooped on.
Today, to encrypt your communication to websites, you use HTTPS which rely on a vast network of certificate authorities. Any of these actors misbehaving leads to potential attacks. Because of that, the Certificate Transparency project was created to _potentially_ catch bad actors, that is if you check for your own domains regularly.
Using a consensus-based registry, you can prevent (better than detect) attacks in both of these scenarios. Let people register their identity or domain name, and associate a public key to it that can be used to encrypt communications with the identity/domain, as long as the number of dishonest actors remain under a threshold no attacks are possible.
The only (albeit not small) downside is that by taking middle men out of the picture, the naive approach prevents account recovery from happening. So to be practical, you need to find the right middle ground.
I think this just shifts the responsibility and point of attack onto the owner (which is true for all decentralized crypto). An attack is still possible and worse yet, it is completely irreversible.
That said, the option of taking personal custody and responsibility is important and I think it should always be an option.
Any centralized source of data is very attractive and worth spending a lot of time & effort on and inevitable gets hacked: https://en.wikipedia.org/wiki/List_of_data_breaches
The owner is always a target, it doesn't change that, it just removes a bunch of single points of failure and middle men.
> An attack is still possible and worse yet, it is completely irreversible
Attacks are always possible, but depending on your threat model you do end up eliminating a number of them. As I said, with a naive implementation you make an attack irreversible, but it's not impossible to imagine an optional, committee base KYC-based account recovery mechanism.
This fact has been irritating me for a long time. Because no one should believe that every single certificate authority is tolerant to any attempts to steal the private keys. But that is exactly the underlying assumption behind HTTPS being the only way to use HTTP in a more secure manner than exchanging in plaintext.
Let's think about this scenario: Suppose that I built a web service for my personal use and hosted it in public cloud. I don't trust any certificate authorities, so I created my own TLS certificate without using them. I installed my own certificates on the machine from which to connect to my web service. Now the server for my web service is serving in HTTPS using my own certificate. Am I safe? No. Because any entity with access to the private key of any of the certificate authorities trusted by my machine, is capable of intercepting the communication between my machine and my server, simply by MITM.
The problem of being forced to trust certificate authorities can be solved by adding the feature to embed a public key in a url. For example, it would be wonderful to have a url like httpsecure://rsa:PUBLICKEY/example.com/ to make sure example.com always responds using the key PUBLICKEY. IIRC, the Tor onion services is an instance of this -- the .onion domains include public keys.
You're probably more safe than you'd think. Certificate Transparency is now required for Chrome, Firefox, or Safari or you'll get an error message during the TLS connection, before any private data is sent to the (potentially MITM'd) site.
Given that all certificates are logged, site operators can use some of the many CT alert websites to let them know if and when a new certificate is issued for their domain, so if some random authority they haven't heard of before issues a cert or it's done at a time they know they didn't need to renew their certs, it'd be time to raise major alarms about the occurrence and thus would mean instant loss of all business for that authority; plus, shockwaves would be sent across the internet as this would be a huge event, especially if it's against a company worth burning a CT for (eg. Google which houses so many fortune 500 companies' secrets).
> the .onion domains include public keys.
The .onion domain is, in itself, a public key. The side effects of your proposed solution are:
A) it would mean you HAVE to trust whoever sent you a link
A) 1) for web-based referrals, this would mean you trust your (possibly state-sponsored) search engine to never MITM you (this is currently mitigated by CT which would expose Google's GTS issuing a random domain's cert)
A) 2) for IRL events, this would mean you have to trust that the business themselves put up a certain QR code with the public key and not some malicious actor
B) This would mean site.com could never rotate their private key without changing all of their backlinks to one with the correct public key.
These are all problems Tor already faces - you have no idea if the onion site you're linked to is actually the site it says it is if it perfectly mimics it and/or reverse proxies the real site. You're currently always advised to get URLs from a trusted source once then only use bookmarks to access them to prevent reverse engineering. And you can't rotate your private key without doing this domain change.
Yea, fuck that.
Also, as with 99% of "smart contracts". The main contract which allows for updating the smart contract, and thus is ultimately in control of everything, is controlled by 1 private key. Nice "trustless". Just gotta trust this one entity never to make a mistake.
Also, this has literally already been done at least 5 other times already before the "NFT" acronym was invented. Remember namecoin, anyone?
It's a trade-off but some people can take care of their keys and prefer that risk which they've covered over a risk that a third party can take control which they can't cover. It's fine if you are not one of those people but not everyone has your needs.
Do you? Most hosting setups will have other ways to get to the data.
> Will My Life Change?
> Yes, my friend! It will because you can easily build your own decentralized website and simplify your cross wallet crypto payments, share music and photos (not just of my kids), start a business, secure and verify your identity “on chain”, or showcase your brilliant NFT art gallery.
I really don't understand what this woman thinks she is buying. I guess this is a better storage medium for precious moments and collectibles than sending copies of everything to gmail, but so is almost any other way of storing something.
No offense, but in all likelihood no one is attempting to counterfeit or pirate your Mom's videos and photos of your childhood, and ownership/p2p ownership transfers are not material.
There are almost infinite real world examples were ownership records are benefited by blockchain technologies over centralized services. Take property deeds, usually kept and recorded at the County level, there is almost endless fraud with people filing forged quitclaim deeds on a daily basis. That would be an example of a public record, but their are private record keeping examples such as stock certificates. Usually the "Dole" case is the most famous example, where you have a publicly traded company with all the benefits of corporate record keeping, stock trusts and banks, and centralized stock exchanges, but when the buyer went to take it private low and behold the public company with all the centralized safe guards in the world should have had a total capitalization of 36M shared but somehow had about 49M share issued, it only ended up in $150M in damages, but this could not have happened using blockchain and most agree nearly every publicly traded company likely would have the same inconsistencies.
This sounds like a technology problem for which a public blockchain is but one possible solution. Surely other append-only log data structures exist which could step in to fill this void.
AFAICT the main issue with crypto equities — and all other similar constructs — is what happens when a court of law overrides them. If a court says your ex owns half of the shares in $WALLET, but the blockchain doesn’t, and $COMPANY which issued the shares is also subject to the whims of the court, then what are we to do about this?
OTOH maybe this rabbit hole really just never ends until courts are also somehow replaced by a public blockchain, likely at the behest of the very biased investors who stand to disproportionately profit from this game.
Should a mechanism exist in your system wherein-by your family can reclaim ownership without your keys, means that whoever the chain says owns something clearly doesn't actually matter anyways.
[Edited to add: The court case that makes this happen isn't related to the share records, it's just the routine shadiness of business owners trying to pay less than something is worth, the discrepancy is noted after the court case is done when trying to reconcile the people who have proof they owned shares, and thus are entitled to a settlement versus how many shares existed]
The record keeping worked exactly as intended but it isn't how people tend to imagine, and this is the difference you've tried to portray as somehow being solved by a blockchain when in fact it would not be.
Specifically, those millions of "extra" shares are because of short selling.
Some of the people who had good reason to believe they'd owned Dole shares, had in fact bought from short sellers who'd sold shares they didn't yet have. If Dole had not gone private, the short seller buys those shares (maybe for a lot more but they hope for a lot less) and passes them on. But it did go private, so the short seller is responsible for paying up what the private buyer agreed to pay for these shares. This part all worked, all those shareholders got their money.
But the court case changes how much money they were entitled to, years later - and since the court isn't in the business of doing complicated financial paperwork it just told the businesses which implement all this it's their problem and wished them luck. Most of these owners will be huge institutions and will have an existing relationship with an equally huge broker and that relationship will have likely determined what happened next (e.g. this loss from hard-to-trace shorts isn't worth it, just give them their money in full and write it off).
The blockchain could have exactly reproduced this outcome, but it would not have improved upon it at all.
Why couldn't this happen on blockchain? It really assumes everyone is using that same blockchain network, which is not a guarantee. Were the stock certificates released on Ethereum? On WAX? Are you sure you checked all of the networks?
Link of old comment: https://news.ycombinator.com/item?id=22174009
Otherwise I'd recommend you to try the checkra1n or ivyra1n discords if you want to try to patch the mrc.bin yourself.
It says so on the internet, so it must be true.
[1] https://en.wikipedia.org/wiki/InterPlanetary_File_System
https://docs.unstoppabledomains.com/domain-registry-essentia...
From the docs it seems like you can "hardcode" IPs or...a traditional dns cname.
At $40/domain, if you update your DNS records once every two years, you're really only just breaking even.
Also, from the FAQ:
> Trademark holders with proof of ownership can apply to claim ownership of trademarked names. If a trademark name has already been sold, then it will be refunded. Note - this process ends once domains have been distributed. Unstoppable Domains does not have the ability to move a domain once distribution has occurred.
Seems like a less-than-agreeable policy for most folks. Unless you're a scalper.
Take me back to the boring, reliable, niche internet and keep the use cases.
Other domains aren’t available yet.
NFTs for names is a really good idea but it seems like the novelty is in getting acceptance and trust. Not sure why a random org should get really substantial fees for names. For ICANN we’re forced to. But for a good blockchain solution the prices should be equitable.
I understand that reselling goes to the owner, but this seems like a cash grab.
That and many domains like common first names aren’t available yet.
The high cost does prevent abuse though, as squatting would be a bigger nuisance than it is with traditional DNS if registration were cheap/free.
As a user, I would not want willingly join in a new name system that benefits an arbitrary company so much. ICANN forces use of domain registrars so I have no choice. A future system should be better, I think.
So I'm hopeful that some of this new tech can disrupt the current system, which we know is inherently flawed.[1]
While I'm not going to use Opera anytime soon, we should celebrate this news and push for other browsers to do the same.
I use OpenNIC and know how to navigate around my router. However for my mother, that's a whole different story.
At that time they had ads inside of the UI of the browser so I had to make a firewall rule to block those, but other than that it was a great browser in the pre-noscript days.
But I've also heard some insider info from a Norwegian pal and apparently it's a disaster in that company. Only reason they're still alive today is all the embedded work.
Ethereum needs to move to Proof of Stake ASAP.
Edit: Also, it looks like this deal doesn't include ENS. I thought "unstoppable" was just being used as an adjective at first, but it's a company.
This news is interesting as I wonder what happens if .crypto does become a TLD?
Actual, executive day-to-day control over the browser tech has progressed sort of like this:
1995: Oslo, Norway
2008: Linköping, Sweden
2014: Wrocław, Poland
2020: Beijing, PRC (the sale happened in 2016, but they were hands-off for quite some time; I think they were being busy with shady fintech stuff in Africa enabled by the Opera Mini work we did mostly in Sweden a decade earlier: https://www.engadget.com/2020-01-19-opera-accused-of-predato...)
Nowadays I wouldn't come near it, mostly because it's proprietary software owned by a company with shady business practices.
Still, this is great news and should be applauded FWIW.
I actually just switched this week, being fed up with Firefox. So far so good. I very much like the UI/UX.
I hope this isn't just another case of "China bad".
Edit: Ah, I see the link you added. So the new owners seem shady.
I'm guessing you're perhaps conflating criticism of China/CCP with recent idiotic attacks on random asian people in the US?
[1] https://forums.opera.com/topic/38628/why-is-there-a-white-st...
Google had very purposely raised the bar by putting like 5x-8x more competent engineers than the Opera core (non-platform/UI-specific stuff) team had, working on inventing and implementing random new web standards that they then promptly started using on google.com properties. Think e.g. 500-800 engineers compared to 100. We simply couldn't do the same. Then this ratio started growing until it was obvious that it would eventually become an existential threat.
They used their financial success in one business area (search ads) to become dominant in another area (browsers) in a clever and perhaps not entirely legal way.
I was a huge fan and tried to convert my friends from 2004-2012. It was tough watching them slowly convert to firefox or stay on IE.
It really didn't help that Opera handled transparency so poorly. That made myspace pretty much unusable.
Please people, don't use Opera any more.
You are basically implying that opera is beyond rescue because the governance moved from a country you value to countries you value less?
[1] https://en.wikipedia.org/wiki/Internet_censorship_in_China
That doesn't mean that today's Opera is definitely an untrustworthy piece of software, but it does raise the probability quite a bit.
looks incredibly skeptical at this
My memory of 2009–13 was very much the decisions about Presto being made by people in Oslo.
I was their user since version 5 or 6 (this was before everyone started the crazy version system, back them they released a major version about once a year).
The biggest things that I loved about the browser you couldn't get by extension, they could do many things because they could directly update the engine.
Now learning that they are owned by PRC there's even less reasons for me to use it.
Opera could have done a lot of good if they would open sourced their old browser (kind of line what Netscape did). Someone leaked the original source code, but because it was leaked and not officially published, no one wants to touch it. Anyway now it's too late, because it's way behind the current browsers.
If you want you data to be safe, then host your data yourself and make backups.
Yet another "we had a blockchain and did not know what to do with it" solution that nobody needs.
I think I lost IQ points reading this nonsense.
I get that sending an email might be easy but so is uploading to Dropbox or Nextcloud if it must be self-hosted. And you don't have any storage limits.
Plus having blockchain domain names does nothing for the storage. IPFS is great but he still have to keep seeding it or it will go offline eventually. He still needs backups!
