iiinova — where your digital self keeps evolving

Eric Rescorla

@rtfm.com

Eric Rescorla @rtfm.com · 07/03/2026

Some real map/territory confusion in this report by the LA Marathon to give people medals if they drop out after 18 miles (because it's hot). The finisher's medal commemorates that you finished, but it doesn't make you a finisher. www.nytimes.com/2026/03/07/u...

100

Eric Rescorla @rtfm.com · 15/12/2023

Finally, when you go to the Web server, it proves that it's certificate matches the summary. What this means technically is that it gives you a Merkle inclusion proof that goes back to the root.

110

Eric Rescorla @rtfm.com · 15/12/2023

The standard solution here is what's called a consensus system. Effectively, you compute a summary of all the published certificates (typically by assembling them into a Merkle hash tree).

100

Eric Rescorla @rtfm.com · 15/12/2023

For instance, if the CA has it on their web site and sends it to clients but not to sites when they check, then the system breaks down.

100

Eric Rescorla @rtfm.com · 15/12/2023

The first step is to have the client (i.e., the browser) check that the certificate was published, thus hopefully forcing the CA to publish it. But now we have to confront the definition of "publish". How do we know the CA published to everyone?

100