Subject: [therightkey] First public DNSChain server went online yesterday!

From: Tao Effect <[email-masked]>
Date: Fri, 7 Feb 2014 13:16:16 -0600

Formerly known as DNSNMC, working code was pushed to the GitHub repo at the end of January (as hoped for in the previous email), and yesterday the first public server went online!

Details here:

https://github.com/okTurtles/dnschain

A rely for querying the blockchain without changing your DNS settings is available at dns.dnschain.net. For example, if you'd like to know who "Greg" is, and what his GPG fingerprint is, just ask:

http://dns.dnschain.net/id/greg

Or, "what's the domain info stored in the blockchain for okturtles.bit"?

http://dns.dnschain.net/d/okturtles

If you change your DNS settings to a DNSChain server, you'll be able to use the ".dns" meta-TLD:

http://namecoin.dns/d/okturtles
http://namecoin.dns/id/greg

And you'll be able to access .bit TLDs:

http://okturtles.bit

Cheers!
Greg

--
Please do not email me anything that you are not comfortable also sharing with the NSA.

On Jan 3, 2014, at 11:33 PM, Tao Effect <[email-masked]> wrote:

> I agree with the criticism expressed here. There needs to be code (at the very least) that people can get their hands on and try out, before using the word "deprecated".
> 
> Thanks for pointing that out Phillip!
> 
> I'm working getting said code up on Github ASAP. The holidays and other things slowed me down a bit. It will be put up under this github group soon (this month, I expect/hope): https://github.com/okTurtles
> 
> 
> --
> Please do not email me anything that you are not comfortable also sharing with the NSA.
> 
> On Jan 3, 2014, at 10:57 AM, Phillip Hallam-Baker <[email-masked]> wrote:
> 
>> Part of my trouble with this thread is that the original proposal was presented in the way it was.
>> 
>> It might well be that there is a better way to do PKI than the approach Kohnfelder described in his master's thesis. But I don't think that the person who comes up with it will be describing the existing system as 'deprecated' before a single line of code is deployed.
>> 
>> 
>> I am currently working on podcasts to describe my new approach to a general audience because getting any PKI deployed depends on buy in from people that are far outside this group and the IETF and even the techie community. 
>> 
>> We are not going to get change until we have real people appearing in Apple Stores and Microsoft stores asking how they can get usable secure email to protect them from [The russian mafia/ GRU/ Iran/ China/ NSA]. If Google had physical stores in malls, I would include them in that list.
>> 
>> 
>> But we are not going to get people hassling for deployment until there is a scheme that is really right and not just 'good enough' for a group of highly motivated ideologues like ourselves.
>> 
>> Part of the problem with PGP and S/MIME is that people just want it to work so much that they blind themselves to the obvious defects let alone the less obvious ones. The result looks like a Palm Treo, not an iPhone. You could use the Palm to surf the Web and send email and it kinda worked without crashing more than six times a day. But people at Palm never did understand why that was so much of a problem and they never made much of an effort to make the phone really right because web on your phone is so cool it doesn't really need to be perfect... right?
>> 
>> When someone is so infatuated by their own idea that they describe it as 'deprecating' the existing system before they have even tried it in the real world then I don't think it is going to get very far.
>> 
>> 
>> Anyway, I am thinking we should have international cryptography day sometime in early summer. Give some time to get code wrote.
>> _______________________________________________
>> therightkey mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/therightkey
> 
> _______________________________________________
> therightkey mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/therightkey

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 7 Feb 2014 14:32:12 -0500

> If you change your DNS settings to a DNSChain server, you'll be able to use the ".dns" meta-TLD:

Given that you're basically telling people to use these names in a
context where DNS names are expected to go, I would like to suggest
that you want to do something than make up a string that you think
won't collide in the DNS, for two reasons: (1) these queries will
sometimes leak by accident onto the public DNS, where they're "junk",
and (2) a new TLD applicant of the future could ask for .dns, and
there's no obvious reason why ICANN would have to say no.  This will
represent a security risk to your users.

I would like to suggest some other domain name.  You can register any
available thing you like.  It need not actually resolve in the public
DNS, as long as it is registered so that nobody else can get it.

Over in the DNSOP working group, there's quite a lively discussion
about these issues going on.

Best regards,

A

 -- 
Andrew Sullivan
[email-masked]

---

From: Tao Effect <[email-masked]>
Date: Fri, 7 Feb 2014 19:34:59 -0600

Hi Andrew,

Thanks for the feedback!

> represent a security risk to your users.

This equally applies to GNUnet's DNS system (.gnu?), to Namecoin's .bit, and to Tor's .onion links.

The public DNS is broken and insecure.

ICANN is an old, centralized, and insecure thing, that I personally feel, at this point, is more deserving of the label "junk". ;-)

> DNS, as long as it is registered so that nobody else can get it.

How do I register the .dns TLD?

Does it involve paying money to ICANN? I'd rather not pay them anymore than I'm already begrudgingly paying them.

Is it even possible? I doubt it. :-p

"Hey guys, I'd like to put you out of business and make the whole domain registration thing decentralized, could you please give me .dns?"

XD

-g

---

From: Paul Wouters <[email-masked]>
Date: Fri, 7 Feb 2014 21:02:13 -0500 (EST)

> Thanks for the feedback!

Unfortunately, you did not actually read Andrew's feedback.

> This equally applies to GNUnet's DNS system (.gnu?), to Namecoin's .bit, and to Tor's .onion links.

Which is also seeing quite some resistence (and justly so)

> The public DNS is broken and insecure.

So why do you want a TLD in it? It's broken and insecure. Go somewhere
secure? Oh, you mean it is still useful and secure enough for you? Maybe
it is secure and useful enough for everyone else too?

> ICANN is an old, centralized, and insecure thing, that I personally feel, at this point, is more deserving of the label

https://nohats.ca/wordpress/blog/2012/04/09/you-cant-p2p-the-dns-and-have-it-too/

> How do I register the .dns TLD?

That's not what Andrew asked you. Why can you not register and use icannmustdiediedie.org?

> Does it involve paying money to ICANN? I'd rather not pay them anymore than I'm already begrudgingly paying them.

Yes, pay ICANN $120k

> Is it even possible? I doubt it. :-p

Yes it is. I'm sure you can pay that $120k immediately once you tell
your angel investor about your grand plan on how to save _everyone_ in
the world from their $10/year domain rip-off.

> "Hey guys, I'd like to put you out of business and make the whole domain registration thing decentralized, could you please

How come you _need_ them _and_ will put them out of business? Why not
pretend you succeeded and ICANN and the DNS is dead. So no need for your
.dns TLD anymore, since the root is dead. Why do you want .dns again?

You didn't even address two valid points Andrew brought up:

1) You are going to cause sending junk queries all over the internet.
    What are your plans to preven/reduce that?

2) Why do you need a TLD .dns, and why can't you use a $15/year
    iwillneverrunnameservershere.org

My bet is that you are going to provide some kind of mapping service to
bridge cryptographically secure hashes into memorable names, thus
becoming your own ICANN. See the above link :P

Paul

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 7 Feb 2014 21:23:46 -0500

https://www.mtgox.com/press_release_20140207.html

MtGox is not BitCoin, the system could survive technically without them.

But if the integrity of MtGox was to come under serious doubt it would be
the end of BitCoin in all forms. The bubble would pop and the value of BTC
drop to a few cents.

Of course nobody would imagine that a group of people preaching the value
of self-interest would be anything other than completely honest.

This whole event might well turn out to be an object lesson in why
government regulation is actually a good thing in a payment system.

---

From: Tao Effect <[email-masked]>
Date: Fri, 7 Feb 2014 21:48:42 -0600

Hi Paul,

> it is secure and useful enough for everyone else too?

... oh dear ...

> https://nohats.ca/wordpress/blog/2012/04/09/you-cant-p2p-the-dns-and-have-it-too/

Think that blog post was shot down on metzdowd or randombit, I won't bother repeating the conversation here. Sufficed to say that it's incorrect.

> Yes, pay ICANN $120k

I'd rather not, and there's no need or compelling reason to. They can take their monopoly and slowly disappear with it.

> the world from their $10/year domain rip-off.

Don't need angel investors. Code works, and I have my server. You can use it if you'd like, I won't charge you. :-)

> How come you _need_ them _and_ will put them out of business?

It sounds like you do not understand what DNSChain is.

I don't need them, nor does anyone else. I'm using .dns right now, and .bit, and so are others, and ICANN is not involved in any way.

> Why not pretend you succeeded and ICANN and the DNS is dead. So no need for your

DNS wouldn't be dead if ICANN were gone, it would just be different.

Instead of depending on a centralized authority that charges everyone money, it would be distributed.

The blockchain works. DHT works.

We have the technology. It's here now.

No need to push a centralized authority on anyone.

>   What are your plans to preven/reduce that?

Sorry, I don't understand what the problem is? Could you elaborate?

>   iwillneverrunnameservershere.org

It's a meta-TLD, not a TLD.

Each .dns is owned by just one DNSChain server. Yours, hopefully. :-)

Cheers,
Greg

---

From: Tao Effect <[email-masked]>
Date: Fri, 7 Feb 2014 23:20:12 -0600

Significant improvements to the project's README were just pushed, hopefully this helps clarify what the project does:

---

From: David Conrad <[email-masked]>
Date: Sat, 8 Feb 2014 11:04:08 -0800

> No need to push a centralized authority on anyone.

What happens when someone else decides to use the .dns "meta-TLD" (as you call it) for something other than DNSChain?

> Sorry, I don't understand what the problem is? Could you elaborate?

https://www.icann.org/en/about/staff/security/ssr/name-collision-mitigation-05dec13-en.pdf

> It's a meta-TLD, not a TLD.

You might want to look at RFC 6761.

Regards,
-drc

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 8 Feb 2014 14:00:22 -0800

> It's a meta-TLD, not a TLD.

Say what? If the idea is that I can get a certificate with paulehoffman.dns put in the field reserved for domain names, and have that accepted by TLS servers, it is a TLD. No "meta".

If this TLD gets allocated to someone else, or gets blocked by middleboxes, you have no one to blame but yourself. It would be *trivial* to avoid this problem by buying an SLD and pre-paying for 20 years of registration.

--Paul Hoffman

---

From: Tao Effect <[email-masked]>
Date: Sat, 8 Feb 2014 16:13:23 -0600

Paul,

Your understanding is incorrect.

> If the idea is that I can get a certificate with paulehoffman.dns 

That is not the idea. Docs are on GitHub, and I know you're smart enough to comprehend them.

> If this TLD gets allocated to someone else, or gets blocked by middleboxes

It cannot get allocated by anyone else. It is designed specifically for DNSChain servers, and they will not look that up in the old DNS networks.

You can definitely fork the 120k and own it on the old network. It doesn't matter.

Documentation, that has gone through considerable improvements in the last 24 hours, is still available at the same URL:

Cheers,
Greg

---

From: Tao Effect <[email-masked]>
Date: Sat, 8 Feb 2014 16:29:12 -0600

I think I might be partly responsible for the misunderstanding expressed in this thread.

I had failed to protest the comparison of a meta-TLD like *.dns to *.bit and *.onion.

They are not the same thing at all, and hence the difference in terminology.

I think I was able to state the difference more clearly and succinctly in another list, so hopefully it might help here:

*.dns is a meta-TLD. You cannot register meta-TLDs. You own them already. There is therefore no need to register them. There might exist other terms for this concept, but I wasn't aware of them.

Cheers,
Greg

---

From: Paul Wouters <[email-masked]>
Date: Sat, 8 Feb 2014 17:30:25 -0500 (EST)

> It cannot get allocated by anyone else. It is designed specifically for DNSChain servers, and they will not look that up in

Then why do you care about the "real" .dns TLD?

Paul

---

From: Tao Effect <[email-masked]>
Date: Sat, 8 Feb 2014 16:33:32 -0600

> Then why do you care about the "real" .dns TLD?

Not sure what statements of mine you're referring to... feel free to quote them. I don't want to misunderstand you.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 8 Feb 2014 21:12:08 -0500

On Sat, Feb 8, 2014 at 5:00 PM, Paul Hoffman <[email-masked]> wrote:

> Say what? If the idea is that I can get a certificate with
> paulehoffman.dns put in the field reserved for domain names, and have that
> accepted by TLS servers, it is a TLD. No "meta".
>
> If this TLD gets allocated to someone else, or gets blocked by
> middleboxes, you have no one to blame but yourself. It would be *trivial*
> to avoid this problem by buying an SLD and pre-paying for 20 years of
> registration.
>

Paul,

Why would anyone need a certificate in this system? The binding to a public
key is intrinsic to the whole naming architecture.

Come to that, why would anyone need .dns??? If namecoin is going to replace
the DNS, why make the mistake of upper level hierarchy? Surely the new
system should be the apex of the hierarchy and the legacy DNS subordinated
under .icann.

I do have a solution though. There are some TLDs that are not expletives
that are almost certain to be permanently withheld from issue. I suggest
they consider using .pot or .weed.

-- 
Website: http://hallambaker.com/

---

From: Tao Effect <[email-masked]>
Date: Sun, 9 Feb 2014 19:10:35 -0600

DNSChain 0.0.1 was just released and published to NPM!

You can now use NPM to install it on servers. :-)

https://npmjs.org/package/dnschain

Next up: response signing (and more!).

Cheers!
Greg

---

From: Paul Lambert <[email-masked]>
Date: Mon, 10 Feb 2014 17:47:33 -0800

>Why would anyone need a certificate in this system? The binding to a public key is intrinsic to the whole naming architecture.
Yes!

>Come to that, why would anyone need .dns??? If namecoin is going to replace the DNS,
>why make the mistake of upper level hierarchy? Surely the new system should be the apex
>of the hierarchy and the legacy DNS subordinated under .icann.
>
>I do have a solution though. There are some TLDs that are not expletives that are almost
>certain to be permanently withheld from issue. I suggest they consider using .pot or .weed.

I prefer the forest model ... every key can define a namespace:

paulehoffman.com.73940a8b75ac184ddbe3ca3c2c809c67

Paul

---

From: Paul Wouters <[email-masked]>
Date: Mon, 10 Feb 2014 20:52:51 -0500 (EST)

On Mon, 10 Feb 2014, Paul Lambert wrote:

> I prefer the forest model … every key can define a namespace:
> 

And now to make that memorable or spray paintable on your car, you need
a mapping system like DNS.

Back to the drawing board!

Paul

---

From: Paul Lambert <[email-masked]>
Date: Mon, 10 Feb 2014 18:49:30 -0800

]-----Original Message-----
]From: Paul Wouters [mailto:[email-masked]]
]Sent: Monday, February 10, 2014 5:53 PM
]To: Paul Lambert
]Cc: [email-masked]
]Subject: Re: [therightkey] Forest Model -> was RE: First public DNSChain
]server went online yesterday!
]
]On Mon, 10 Feb 2014, Paul Lambert wrote:
]
]> I prefer the forest model … every key can define a namespace:
]>
]> paulehoffman.com.73940a8b75ac184ddbe3ca3c2c809c67
]
]And now to make that memorable or spray paintable on your car, you need
]a mapping system like DNS.
Yes ... clearly long, only illustrated this way as descriptive tool.
We already in effect associate one or more keys as the authorities for
name spaces   ...

]Back to the drawing board!
Or simply define implicit context of communications to be within a
agreed name space thus making the friendly names shorter.

Paul (yet another)

]
]Paul

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 11 Feb 2014 07:41:37 -0500

> Back to the drawing board!

Compared to the other usability issues involved in using what people call
the 'dark web' this would be the least of their problems.

Since the definition of the dark web is 'so complicated that the people
using it can't understand that they are still visible' usability issues are
inevitable.