Well, as a matter of fact I ported most of that info from the old wiki. Note that it was quite an improvement in comparison to the old wiki where there were several DNS servers listed maintained by random people.biolizard89 wrote:Who is "we"? I've never seen that wiki page before. https://bit.namecoin.org is, as far as I know, more official than a wiki page, and it currently lists NMControl and FreeSpeechMe (with a side note at the end that you can use 3rd party DNS, and it discusses the security implications). The disclosure of security properties on the wiki page you linked is near-nonexistent, and it would be irresponsible of us to endorse that wiki page as it currently is written.
At the moment there are virtually no websites and virtually no regular users so there probably are a lot of people who just want to try out .bit resolving and see how it works. What kind of warnings are there for using Google DNS or just an eMail client that includes your IP address in every mail?Bottom line, we can't make assumptions about what our users need in terms of security. In the absence of evidence to the contrary, we should operate under the assumption that our users are not downloading Namecoin solely to "try things", whatever that means; they are downloading Namecoin to use it for browsing websites (some of which may have sensitive content and/or metadata), quite possibly because they've heard that Namecoin has better security/privacy than standard DNS. It is standard practice in the security community to force users to affirmatively demonstrate consent before the software does something unsafe.
Of course we should be more transparent about security and privacy implications but in the end privacy is a user responsibility. No matter how many warnings and confirmations you just can't force people into it. If people use Namecoin software and particularly this experimental branch in potentially dangerous ways it is their very own responsibility to make sure they know what they are doing.
What is necessary to resolve these issues? Tor support and SPV / PoW secured API?
Yes.On a completely different note, I'm a little bit concerned that features in Hyperion aren't being submitted as PR's to NMControl upstream. That will happen, right?
BTW, besides fixing some bugs I already learned at least one other important thing from this: Not having to deal with the blockchain makes things way more comfortable.