ACachr2·Nov 17, 2016
I mean, I was being a bit facetious, but there are actual proposals for blockchain backed DNS.
[1] https://github.com/okTurtles/dnschain
In The .blog Bait and SwitchokTurtles
dnschain
CoffeeScript2014–2016
okTurtles / dnschain
dnschain
A blockchain-based DNS + HTTP server that fixes HTTPS security, and more!
11Distinct people
48Mentions
1Explicit recommenders
1.7KGitHub stars
What to know before exploring
What it is
A blockchain-based DNS + HTTP server that fixes HTTPS security, and more!
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
I think http://www.blockaid.me/ has been doing this, too, and I believe there were others. Some other approaches I've seen are based on Namecoin somehow. DNSChain for example…
higherpurpose used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year48 dated mentions
Observed mentions: 2014-03-31 19:23:56 UTC to 2016-11-17 21:39:30 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 24 | 1 | 23 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 18 | 0 | 18 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 6 | 2 | 4 |
What Hacker News says
48 sourcesDNSChain – A blockchain-based DNS and HTTP server
92 points · Open discussionDNSChain: secure decentralized alternative compatible with traditional DNS
11 points · Open discussionWell that definitely answers my question. Thank you. What about something like certificate blockchain?
e.g. https://github.com/okTurtles/dnschain
In Microsoft silently adds Amazon root certificates to its CTLAlso, guys, please do research before starting new projects. There are already MULTIPLE identity verification services out there specifically designed to use blockchains. By all means, work on new projects, but if there are formal standards out there, make your implementation 1) interact with those seamlessly, and 2) consider long and hard as to what you're bringing to the table over existing, more mature projects. It's counter-intuitive, but actually developing nothing is better for decentralization than developing a competing project w/r/t user adoption and community fracture.
https://okturtles.com/ is the most successful of them so far. I am not a crypto expert (even less of a blockchain expert) but the code looks pretty good, and the ecosystem is pretty mature.
It has 1) its own aux. DNS service which is tied to your key (somewhat li
Read the rest
ke Tor routing via onion but with acceptable latency), 2) decentralized IdP via block chains, 3) a browser plugin, 4) a whole lot more (see the Github linked below.
https://github.com/okTurtles/dnschain/blob/master/README.md
Whaaaaat. No way man. Especially if this gains critical mass before it's production-ready for whatever reason (who knows why Farmville and GroupOn hit when they did -- right place, right time) it's nothing short of irresponsible especially without a way to effectively declare the system compromised and pull the plug.
Not only that but there are real social implications in having a system that even drops the word "end-to-end encryption" in its phrasing with the whole "Why Johnny can't have crypto" adoption problem. The average engineer rarely reads the docs, my mom would never read the README.md despite the fact that it explicitly says it's not production ready. That bitter taste is left in ones mouth for years (eg. people still associate Microsoft with unstable, insecure junk a la WinME (or unstable junk like Vista RTM [SP1 was fairly sta
Read the rest
ble, but Vista still is a joke]). If this is Johnny's first exposure to crypto and he's using it to Tinder girls on the side, he's never going to trust crypto again.
Push comes to shove rolling your own crypto is completely irresponsible. There are plenty of 'alternative internet' solutions out there that are doing the responsible thing and following the conventional protocols (i.e., using libraries that have been heavily vetted by those with graduate degrees in cryptography, have protocols to revoke/expire your keys in place, WoT's, etc.)
RE: Designing and building the rest -- just like one should use someone else's crypto libs, there are already tons of 'alt-internet' infrastructures that exist which do something similar. It doesn't have the novelty of a mobile app, but most of them do have the cryptographic security to make up for it. Just to name a few-- https://cryptosphere.io/ uses libsodium, https://github.com/okTurtles/dnschain is based on GPG and standard PKI, https://wiki.enigmabox.net/ (I've only audited the cjdns server but it looks real solid, granted my specialty of mathematics is a whole different branch so I'm not even close to an authority, other than I know enough not to roll my own). Then of course there's all of the Moxie-type projects out there which I'll be damned if they've got any holes in there, the dude is of DJB meticulousness
Edit: Yeah basically what Thomas said below me, re: the responsible thing to do is to advertise it as a product with no cryptography in place. Apologies for the knee jerk reaction, but secure communication is something I've felt awfully strongly about, as exhibited by my post history pretty clearly.
The issue at hand matters far less than the issue that the issue at hand is part of, which is the CA system itself. With the CA system, you have a two tier threat model where the mighty and powerful can have all seeing eyes and the consumer is told that all their https communication is secure and private. Certificate Transparency and other proposals may help fix this, but the first thing to do is to acknowledge that there is a problem, and so far the major players have yet to acknowledge the fundamental problems of the current CA system. LetsEncrypt makes it worse by promoting the wider adoption of this flawed system. Certainly won't help keep us secure against the Chinese or anyone with big resource.
Update: Stating that there is no solution without any knowledge of the existing solutions is itself part of the problem. Let's start with t
Read the rest
Stating that there is no solution without any knowledge of the existing solutions is itself part of the problem.
Let's start with this:
https://github.com/okTurtles/dnschain
In Distrust Let's Encrypt Subordinate CertificateThe issue at hand matters far less than the issue that the issue at hand is part of, which is the CA system itself.
With the CA system, you have a two tier threat model where the mighty and powerful can have all seeing eyes and the consumer is told that all their https communication is secure and private. Certificate Transparency and other proposals may help fix this, but the first thing to do is to acknowledge that there is a problem, and so far the major players have yet to acknowledge the fundamental problems of the current CA system. LetsEncrypt makes it worse by promoting the wider adoption of this flawed system. Certainly won't help keep us secure against the Chinese or anyone with big resource.
Update:
Stating that there is no solution without any knowledge of the existing solutions is itself part of the problem.
Let's start with t
Read the rest
> Convergence was the perfect replacement, but it never gained any traction.
It's really not.
https://github.com/okTurtles/dnschain/blob/master/docs/Compa...
In Sustaining Digital Certificate SecurityProbably something like this: https://github.com/okTurtles/dnschain
In Google pulling China CNNIC CA from its products> I don't think DNSChain is a feasible project.
If you want to prevent MITM attacks, it's one of the only options available to you (probably the only realistic option):
https://github.com/okTurtles/dnschain/blob/master/docs/Compa...
> However, we can reduce the scope of the problem, and just focus on forcing certificates to be public. [1]
DNSChain/Blockchains already provide certificate transparency (publicly auditable log of certs issued), and they do a far better job of it than Certificate Transparency.
In Maintaining Digital Certificate SecurityWhen you run out of legitimate arguments resort to personal attacks, got it.
The number of people on Earth who've spent the time studying Certificate Transparency in depth could probably be counted on two hands. You and I are two of them. That leaves ~8 other people (who are probably not reading these threads) to comment.
I'm grateful to everyone who's taken the time to support DNSChain, Namecoin, and related projects by writing about them, podcasting, tweeting, blogging, contributing code, etc.
https://github.com/okTurtles/dnschain#community
This certainly requires community support.
In Google warns of unauthorized TLS certificates trusted by almost all OSes> Certificate Transparency is a solution
CT would not have prevented these attacks.
Google would be exactly where they are right now: knowing who issued cert, and that's it.
Short form: https://github.com/okTurtles/dnschain/blob/master/docs/Compa...
Long form: https://blog.okturtles.com/2014/09/the-trouble-with-certific...
(EDIT: How about an honest discussion instead of a downvote? If you disagree, you are welcome to explain why.)
In Google warns of unauthorized TLS certificates trusted by almost all OSes> It's the golden unsolved, perhaps unsolvable problem in crypto.
I think this problem was solved fairly well by Namecoin back in 2011. Software like DNSChain [1] then makes it possible to securely access blockchains like Namecoin without having to run a full node on your phone or other device.
If you can't run your own DNSChain server (or don't have a friend's you can use), you can query two or more independent servers and make sure the responses match.
Dionysis Zyndros recently came up with a mechanism whereby you can even query a single DNSChain server (that you might not trust), and still be assured of correct replies if you received an accurate key once (we'll be publishing info on this technique soon over at blog.okturtles.com; it's somewhat similar to what you're talking about with ratcheting keys).
We maintain a comparison of vari
Read the rest
ous approaches here:
[1] https://github.com/okTurtles/dnschain/blob/master/docs/Compa...
Showing the 15 most recent of 48 sources. Enable JavaScript to search and browse every indexed mention.