2.5 years ago, I migrated all my services hosted on a cloud provider to a homeserver.

This homeserver is also my workstation/gaming/dev/everything. I use QubesOS (an operating system based on the Xen hypervisor), and wrote some document about it: https://neowutran.ovh/qubes/articles/homeserver.pdf

Basically, I am hosting:

  • DNS
  • Matrix
  • Email
  • Jitsi
  • Mumble
  • Peertube
  • Screego
  • Nextcloud
  • Searxng
  • Tor
  • Wireguard VPN
  • Copy of wikipedia
  • Personal website And others.

And for TLS, to have better security, and to avoid relying on third party company/providers, I am using DANE.

https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities

https://sr.ht/~yukikoo/dane_without_root/

https://github.com/buffrr/letsdane

The “dane_without_root” is one of my projects and I am welcoming review / feedback on it

( I also posted about it on the QubesOS forum: https://forum.qubes-os.org/t/highlighting-neowutrans-technical-doc-about-qubes )

    • neowutran@feddit.orgOPEnglish
      81·
      1 day ago

      Yes, this part is intentional to raise questions and remark :)

      The certificate on my website is not valid using the WebPKI standard, but is valid using the DANE standard. It is related to my comment for this project https://sr.ht/~yukikoo/dane_without_root/ .

      My issue with the WebPKI model is that any government or big company on the planet could do a MITM on your connection, generate a certificate valid for any website, and get a read/write access to all your webpki TLS communications. The DANE model is an improvement over webpki because instead of the “anyone (every ca / intermediate certificate) can generate a certificate valid for anyone” model, it bring a hierarchical trust structure.

      • greyscale@lemmy.grey.oooEnglish
        4·
        18 hours ago

        You missed my point

        It doesn’t work for the user, so it doesn’t work.

        Its about equivalent to the user as installing your own cert.

          • greyscale@lemmy.grey.oooEnglish
            1·
            6 hours ago

            Which means I don’t care because nobody except myself will be able to use it.

            I’d care a lot if Firefox and Chrome supported it OOTB

                • hirihit640@sh.itjust.worksEnglish
                  1·
                  4 hours ago

                  If you’re just pushing for WebPKI without “thinking too hard” about perpretrating a security system with a large number of failure points, then you’re following that windows method.

                  SSL/TLS have very specific benefits. None of which matter that much for reading random articles on the web. So I don’t see the problem with this website doing their own thing to bring attention to the potential issues of the current system.