From 2ddf196b68cbdc737635abf62e27e7c0ae94609e Mon Sep 17 00:00:00 2001
From: inference
Date: Mon, 18 Mar 2024 03:56:49 +0000
Subject: [PATCH] Update webpage "Blog - #2" from version "9.0.0" to "9.0.1"
---
...sted_the_issue_with_decentralisation.xhtml | 295 ++++++++----------
1 file changed, 137 insertions(+), 158 deletions(-)
diff --git a/blog/untrusted_the_issue_with_decentralisation.xhtml b/blog/untrusted_the_issue_with_decentralisation.xhtml
index add2ee7..df2aaaf 100644
--- a/blog/untrusted_the_issue_with_decentralisation.xhtml
+++ b/blog/untrusted_the_issue_with_decentralisation.xhtml
@@ -1,169 +1,148 @@
-
+
-
+
-
-
-
-
-
- Inferencium - Blog - Untrusted: The Issue with Decentralisation
-
-
-
-
While not the most secure implementation of a root of trust, it is the most
- secure implementation currently available to me. While the domain name registrar
- or virtual private server host could tamper with my domain and data, they are
- the most trustworthy parties available. In its current form, decentralisation
- would make this impossible to implement in any form.
Do not demand anonymity; demand privacy and control of your own data.
- Complete anonymity makes it impossible to have a root of trust, and is typically
- never necessary. It is possible for someone else to hold your keys, without them
- taking control of them and dictating what you can and cannot do (X's
- misinformation policy comes to mind). If a platform is not listening to your or
- other people's concerns about how it is being run, show those platforms that you
- will not stand for it, and move to a different one. This may not be ideal, but
- it's not different to moving from one decentralised platform to another.
- Centralisation is not what is evil, the people in control of the platforms are
- what is potentially evil. Carefully, logically, and tactically, choose who to
- trust. Decentralisation doesn't do much for trust when you must still trust the
- operator of the decentralised platform, and are still subject to the possibly
- draconian policies of that decentralised platform. If government is what you are
- trying to avoid, there is no denying it is feasibly impossible to avoid it; a
- government could always take down the decentralised platform, forcing you to
- move to another, and they could also take down the centralised key storage site
- mentioned earlier in this article. A government is not something you can so
- easily avoid. Decentralisation does not solve the government issue. In order to
- live a happy, fun, and fulfilled life, while protecting yourself against logical
- threats, there are only two words you must live by: Threat model.
I'll cut to the chase; there isn't a definitive solution. The best way to handle this
+ situation is to design your threat model and think about your reasoning for avoiding centralised
+ platforms. Is it lack of trust of a specific company? Is it the possibility of centralised
+ platforms going offline? Only by thinking logically and tactically can you solve both the issue
+ of centralisation and decentralisation. Often, one size fits all is never the correct approach,
+ nor does it typically work.
+
In order to avoid the issue of loss of trust due to lack of root of trust, all users' keys
+ must be stored in a centralised location where all contacts are able to go to in case of
+ compromise or to periodically check the state of keys and to see if they have changed. This
+ centralised location requires some sort of identification to ensure that the user changing their
+ keys is really the same person who initially signed up for the platform, using a
+ trust-on-first-use (TOFU) model, which isn't much different than what today's centralised
+ platforms are already doing; the only difference is who is controlling the location; trust is
+ still present and required.
+
In order to have a root of trust, I have posted my keys to my website, which
+ is protected by multiple layers of security:
+
+
I have provided identification to my domain name registrar, to ensure I can access
+ the website I rightfully own, should it be compromised, by providing identification to
+ the domain name registrar.
+
I have provided identification to my virtual private server host, to ensure I can
+ access the virtual private servers I rightfully rent, should they be compromised, by
+ providing identification to the virtual private server host.
+
I have pinned my website to a globally trusted certificate authority, Let's Encrypt,
+ which is a trusted party to manage TLS certificates and ensure ownership of the domain
+ when connecting to it.
+
I have enabled DNSSEC on my domain, so it is extremely difficult to spoof my domain
+ to make you believe you're connecting to it when you're actually connecting to someone
+ else's.
+
+
While not the most secure implementation of a root of trust, it is the most secure
+ implementation currently available to me. While the domain name registrar or virtual private
+ server host could tamper with my domain and data, they are the most trustworthy parties
+ available. In its current form, decentralisation would make this impossible to implement in any
+ form.
Do not demand anonymity; demand privacy and control of your own data. Complete anonymity
+ makes it impossible to have a root of trust, and is typically never necessary. It is possible
+ for someone else to hold your keys, without them taking control of them and dictating what you
+ can and cannot do (X's misinformation policy comes to mind). If a platform is not listening to
+ your or other people's concerns about how it is being run, show those platforms that you will
+ not stand for it, and move to a different one. This may not be ideal, but it's not different to
+ moving from one decentralised platform to another. Centralisation is not what is evil, the
+ people in control of the platforms are what is potentially evil. Carefully, logically, and
+ tactically, choose who to trust. Decentralisation doesn't do much for trust when you must still
+ trust the operator of the decentralised platform, and are still subject to the possibly
+ draconian policies of that decentralised platform. If government is what you are trying to
+ avoid, there is no denying it is feasibly impossible to avoid it; a government could always take
+ down the decentralised platform, forcing you to move to another, and they could also take down
+ the centralised key storage site mentioned earlier in this article. A government is not
+ something you can so easily avoid. Decentralisation does not solve the government issue. In
+ order to live a happy, fun, and fulfilled life, while protecting yourself against logical
+ threats, there are only two words you must live by: Threat model.