Keyoxide: aspe:keyoxide.org:KI5WYVI3WGWSIGMOKOOOGF4JAE (think PGP key but modern and easier to use)

  • 4 Posts
  • 297 Comments
Joined 2 years ago
cake
Cake day: June 18th, 2023

help-circle
  • The entire renewal process is fairly cheap, resource wise. 7 day certificates are already a thing.
    In terms of bandwidth you could easily renew a billion certificates a day over a gigabit connection, and in terms of performance I recon even without specialized hardware a single system could keep up with that, though that also depends on the signature algorithms employed in the future of course.

    The dependence on these servers is the far bigger problem I’d say.
    This shortening of lifetimes is a slow change, so I hope there will be solutions before it becomes an issue. Like keeping multiple copies of certificates alive with different providers, so the one in use can silently fall through when one provider stops working. Currently there are too few providers for my taste, that would have to improve for such a system to be viable.

    Maybe one day you’ll select a bundle of 5 certificate services with similar policies for creating your certificate the way you currently select a single one in certbot or acme.sh












  • As long as you don’t run out of memory, you can actually insert and lookup in O(1) time for a known space of values (that we have). Therefore we do get the quadratic speedup, that when dealing with bits of keysize or entropy means cutting it in half.
    Checking to get a specific uuid takes 128bit, so 2128 draws of a uuid. Putting all previous uuids into a table we expect a collision in 64bit, so 264. We also need about that much storage to contain the table, so some tens of exabytes.





  • I think they mostly are.
    Cache is already in .cache/mozilla, so usually there is no change hence I didn’t mention it. They did move the cache to the XDG_CACHE_HOME by default. And yes they are using the XDG variables including the recommended fallback values.

    The line between data and config has always been blurred, Most data in the browser is “data” until a user overrides it. Even extension files presence is linked with their configured state of being installed.
    For log files I’m not sure anyone follows that. Besides firefox barely has any plain logs, I think having those in the profile is fine.
    Currently it’s all in XDG_CONFIG_HOME