XSF Discussion - 2018-07-24

Noob question here, (probably going to start a holy war), why is everybody playing with direct TLS again, is "corporate firewalls" the only reason it was brought back from legacy land, (what I gather from 368)? Please enlighten me :x

pep.: less round trips

Also why did we even switch to starttls by default in the first place

pep.: certs

In multi domain environments you need a way to signal the domain

That role is now played by sni

And also I think people collectively thought starttls was cool

I think people also thought SNI was cool

I'm glad it's finally receiving a lot of attention that it's also unencrypted and doesn't offer much

MattJ: the agencies still try to sabotage encrypted SNI

somebody needs to tell the encrypted SNI folks that it won’t play well with use-cases like XMPP

before that draft advances further

I’d appreciate if that was somebody who has more experience with IETF processes than me though

jonasw: why wouldn't it play well?

the public keys for SNI encryption are in DNS, under _esni.$domain TXT

Sigh.

so if you host both HTTP and XMPP on $domain, both services need to have the same private key

jonasw, guess that is what you wanted to tell the authors?

flow, yes

Ge0rG, tell me a thing the agencies are not trying to sabotage :)

pep.: your mom!

who knows

pep.: your mom!

You sure

🤔

Oh hey, jonasw's sed echo bot is front page of HN all of a sudden: https://news.ycombinator.com/item?id=17601761