I think, ideally, yggdrasil client should create one root certificate and use it to sign peers' self-signed certificates, is it possible to implement it in TLS? Also, do servers need to send the whole trust chain till a root certificate, or is it possible to receive the near-root part from another place (that will run locally in yggdrasil case)?

And peers should send a new packet type (signed, idk whether it needs to be encrypted) that contains the public part of their certificate for their 02xx:.../128 and 03xx:.../64 ranges, that they use to sign all their other certificates

Apparently, it isn't 😭
https://security.stackexchange.com/questions/91368/ip-range-in-ssl-subject-alternative-name

So the clients would probably need to send all their certificates in that way

So there probably should be an address that is same for all devices and is handled by localhost to put it into the AIA field of all certificates
http://www.pkiglobe.org/auth_info_access.html

Probably reserve one of the addreses from yggdrasil range? Like http://[2ff::1]/yggdrasil-local-cacert.crt?

But the authoritative signature probably still needs to be transmitted with the signee, so there should be probably also something like http://[2ff::1]/yggdrasil-remote-<ipv6-address>-cert.crt that yggdrasil client handles by signing a non-signed peer certificate, that the peer uses to sign their leaf certificate.

Is it possible for an authority to sign a third-party certificate without notifying this third party?

Time to delete most of the 4878 tabs from one of firefox windows

🔁︎ Dr. Quadragon ❌
A once young but now not so man stands in his bedroom. Which is also his kitchen and office, and overall the only room he has. It just so happens that at this very date, fifteen long years ago, a webcomic came out that transcended everything he has ever experienced in media, endowed him with many wonderful friendships and transformed his life forever. Though it was so long ago, his memories of times together with his companions, with their joy and fascination with this absolutely phenomenal work of art are still as fresh as spring dew in a newly created world. In fact, one of those beautiful soulmates, by the name of @n0icz stands beside him. Most of others, like @pastecat, @lost_enchanter, @ralsei and @Jack and @ZySoua et al. are scattered around the world, as well as @Chia, @th3rdsergeevich and @vertka, though they are not that far. The man, has been stuck at home. Nevertheless, his eyes are of joyful tears and his feelings are of utmost gratitude. Thank you, #homestuck. Happy #413

Link to post

🔁︎ Vftdan
@aismallard
SIGBOVIK season
Number of funny pdf screenshots has risen dramatically

Link to post

"Mumbo is the Gothamchess of Redstone"
- @deegobooster@youtube.com
src: https://www.youtube.com/watch?v=aroEIQ-uPfY&lc=UgwUrxY8OPM_R-18a2l4AaABAg.A2DJMGu2TYPA2DVh_ATx-7

Link to post

Also, I think these are this year SIGBOVIK submissions:

#paper

Who at telegram android decided that having the "join" button near the OS back, home, app switch buttons is a good idea?

Link to post

🔁︎ Viss
uh, yes please
i would love winamp for mac, ubuntu and android!

Link to post

🔁︎ Vftdan
@mo
COMPUTERS SHOULD PROVIDE LONG-TERM OBJECT PERMANENCE, NOT LACK OF IT

Link to post

🔁︎ Vftdan
@joeyh
> turing complete filenames

oh, this reminded me of how I'm trying to write a #VimScript library that would allow load (and sometimes save) buffers with names like:

archive+zip://[https:%2F%2Fexample.com%2Farchive.zip]/path/inside/archive/file.txt

given two separate plugins for http(s) and for archives on top of it
@whitequark

Link to post

discouraged IT terms
Why complementary to "master" is always "slave"? Why not "apprentice" or "pet"?

Link to post