Re: [POSH] a POSH-ian play meets the king of DANEmark.

[Michael Richardson <[e-mail]>]

Now, to start a different thread:

>SCENE 2 - Success

INSERT stage direction, showing Alice upgrading her web browser,
       calling IT because it turns out she uses IE6 because
       company-A has IE6 only intranet, and IT logging in
       to her workstation and installing Chrome and/or Firefox.

>ALICE: https://company-a.com/.well-known/posh-foo.json please.
>COMPANY A: Here's the JSON Web Key set you requested.

I don't see how this is any different than doing the same lookup
in DNS with DANE.   The play would go:

HOST: Here, have your DNS provider put this RR in your zone.
COMPANY A: What's in the record?
HOST: It tells Company B about the certificate for the Foo service.
COMPANY A: Isn't this your certificate?
HOST: Yes, but that means I don't need your private key.
COMPANY A: That sounds good. I trust you, but not *that* much.
HOST: Um, OK.

It still requires the web browser and/or some other HTTPS
relying application (IM client, SIP/Skype, ...) to be upgraded.

I hear all sorts of FUD about how the "infrastructure" isn't ready, yet I
don't buy that.  What's keeping an IM client author from having enough of a
recursive (validating if you like) name server library?  Recurse from 8.8.8.8
as fallback if you have to.

While I buy that the hosting providers have an incentive to make things work,
and upgrading their software to do something useful is in their interest, I
don't see why, given that they are clueful hosting providers, they can't use
the specification we already have.

--
Michael Richardson <[e-mail]>, Sandelman Software Works