posted in Selfhosted
Letsencrypt is under US jurisdiction. Is there a free-er alternative?
I know that I can simply make my own private certificate authority that only I and my family trust. But is there some public provider like letsencrypt that is in a free-er part of the world than the US?
Replying to @Sibbo@sopuli.xyz
@Sibbo I do not see any problem with Letsencrypt. Any CA which is widely trusted has to follow the same rules. This rules are set up by the CA Browser Forum. Which metadata does LE collect? My server's IP address, domain and subdomain, mail address. These are logged in the CT logs. Every CA has to log all certificates in a public CT log. Regardless which CA I choose, these data are public. There are not any critical data or metadata that LE can collect.
Replying to @pdl@social.tchncs.de
Letsencrypt can be directly forced to revoke certificates by the US. Organisations outside of the US are less vulnerable against that.
Replying to @Sibbo@sopuli.xyz
And ICAAN can hand your domain over to US law enforcement regardless of the TLD and your register.
Is that also part of your decision tree?
Replying to @slazer2au@lemmy.world
Maybe it should be! We need non-fascis-adjacent DNS roots.
Replying to @veniasilente@lemmy.dbzer0.com
There are authorityless blockchain-backed name registration services. In general, it is important whether you can localize a resource. If you can easily find it, the name doesn’t have to human-readable.
Replying to @eleitl@lemmy.zip
if its not human readable, how will people know its the place they want to go to? I don’t think bookmarked onionsites is a particularly good idea
Replying to @WhyJiffie@sh.itjust.works
In order to find content, we used to have webrings, directory services, and then search engines. Most people don’t enter URLs by hand.
Replying to @eleitl@lemmy.zip
The root (haha) of needing better DNSes is because the ones that are are tied to technofascists and their ilk: techbros, nazis, psycopaths. So using something with blockchain sounds quite missing the point.
Replying to @veniasilente@lemmy.dbzer0.com
You do understand that a P2P proof of work backed global store is just infrastructure? And as egalitarian as DNS servers? And it doesn’t have the storage/compute footprint of a full bitcoin node.
The space of human-readable names is quite small, so proof of work is needed to protect it from being flooded. An alternative is to have your servers have names to be or derived from their public keys, or dissolve content from its location. Which brings its own problems.
Replying to @veniasilente@lemmy.dbzer0.com
I worked on the Yeti Project a while ago, which showed that an independent group of operators can run root servers.
Managing the contents of the root zone was out of scope… we used the ICANN root.