Idea: Use .well-known and DNSSEC to host site configs for proofs
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
Maybe adding site configs could be made a bit easier by simply making it so that:
- the config needs to be exposed at https://$somesite/.well-known/keybase-config.json
- the hash of the config can be stored in a TXT entry at the same domain using
keybase-config-hash=<sha512> - that hash can be verified to really belong to that domain using DNSSEC
This way if a site supports DNSSEC and happens to run mastadon (or any other kb-supporting software) things will just work ™️ for them
Possible problem is time (changes being made to config and messing with previous proofs), but this could be solved by simply never changing the way proofs are getting fetched (that way the config only changes the way they are created)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue contains no file, test, or entry point to begin from. First determine where site proof fetching and creation are implemented, then establish how .well-known configuration, DNS TXT records, and DNSSEC verification should interact. Done should include an agreed design and tests for fetching, hashing, and verifying the configuration.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100