Yeah, the more I think about it the more futile this effort starts to look. The industry is investing tons of resources into building and maintaining an open, highly secure PKI ecosystem which allows any server on the public internet to cryptographically prove its identity, and Google wants to try to prevent anyone who's not a web browser from relying on that ecosystem? Seems impossible. The incentives are far too strong.
Google is hoping that after this change other TLS clients will go off and build their own PKI entirely separate from the web PKI, but in reality that would take way too much redundant effort when the web PKI already does 99% of what they want. What will actually happen is clients that want to use web certs for client authentication will just start ignoring the value of the extendedKeyUsage extension. The OP says Prosody already does. I don't see how that's an improvement to the status quo.
Interestingly though, doesn't this threat become less credible the shorter certificate lifetimes get? Back in the day they could just do this and server admins would figure out how to switch to a new CA the next time they got around to renewing their certificate. Now though that's all automated, so killing a CA will likely nuke a bunch of sites.
This is good point. I think it would still be discounted in favour of suggesting another CAs that users can switch to, but you're right, the promise was that cert management would be hands off, and changing CAs is not hands off in any ACME client that I know of. Best Google could do would be to shift the blame to LE/ISRG, because it was ISRG that promised this automation.
In practice this might just mean that applications designed to use web PKI certs start ignoring the value of the extendedKeyUsage extension. OP says Prosody already does this.
Well, if libraries like OpenSSL check extendedKeyUsage by default but provide an option to disable this, then most apps benefit from more stringent security, but ones like Prosody with unusual use cases can continue to make those use cases work. That doesn't sound like the worst thing in the world, necessarily? (I'm not sure how Prosody actually implemented this, though, or whether OpenSSL actually works that way.)
According to Google. Why do they get to dictate this?
Per the current (2.2.2) CAB requirements [1], §7.1.2.10.6, "CA Certificate Extended Key Usage": id-kp-clientAuth is a MAY.
If I was (say) Let's Encrypt I would (optionally?) allow it and dare Google/Chrome to remove my root certificate. Letting bullies get away with this kind of non-sense only encourages them.
> The entire security of the web PKI relies on the hope that if some certificate authority does something bad it'll become known.
Correct, but it's not a vain hope. There are mechanisms like certificate transparency that are explicitly designed to make sure any misbehavior does become known.
When you try to use the law (or the threat of legal action) to force people to "do something" about anonymous, unsupervised kids on the public internet using their free platform, this is the type of solution you're going to get: the cheapest, most scalable one they can get away with.
Previously that was a checkbox or a line in their ToS saying "I'm over 18". Now that lawmakers are pushing to make that no longer sufficient, "AI face scanning" is the next step up.
Which goes to show that lawmakers probably should be working more hand-in-hand with technical experts before making such laws. A regulation that provides a good technical solution would be more useful, especially if lawmakers could have helped work on ways to prove a person's age cohort estimation without say checking an entire physical ID (and all of the identity theft that can enable), or yes relying on "AI detection" that is quite game-able (literally so as reports are Death Stranding's Photo Mode is a reliable workaround for Discord's primary AI scanning vendor k-ID).
That's even worse, because then it's not really a law, it's a license for political persecution of anyone disfavored by whoever happens to be in power.
Every law is like this. Only fools and schoolchildren believe that the rule of law means anything other than selective punishment of those who displease the ruling class.
I agree that is how it currently is in the US, but I don't believe it is universally true or that nothing can be done to change it if enough people resisted.
My statement has nothing to do with contemporary politics and is not unique in the slightest to the US. For an example you are likely sympathetic to, consider the experience of Pavel Durov since late 2024.
"Every law" seems like a huge exaggeration. Assuming for a moment we agree Pavel is a victim of selective prosecution, notice they're not charging him with a clear, straightforward crime like murder, they're charging him with things like[1] failing to prevent illicit activity on Telegram, and "provision of cryptology services [...] without a declaration of conformity". Those laws seem far more prone to abuse as a tool for selective prosecution than most others. (Some of the things he's charged with don't even sound to me like they should be illegal in the first place.)
Every law in the sense of cumulatively, the ‘rule of law’ system has the same property of “Show me the man and I’ll show you the crime” that Beria’s system did.
What makes you so sure? SpaceX already has thousands of 6 kW networking racks flying around in LEO and they dissipate their heat just fine, and are plenty cost-effective. You think they can't do any better than that with a new design specifically optimized for computing rather than networking?
Probably, but they likely can't do better than we can do on Earth. Networking in space offers specific advantages that are not easy to replicate on Earth. Data centers in space don't have clear advantages beyond easily debunked ideas about cooling and power.
I'm not talking about the whole idea, just the heat dissipation part. So many people in this thread seem so sure this is impossible because you can't radiate heat in space, completely ignorant to the fact that SpaceX is already dissipating over 20 MW of solar power in LEO in a reasonably cost-effective manner.
The advantage of 24/7 solar power is clear, obvious, and undeniable, it's just a question of whether that's outweighed by the other disadvantages.
The solar panels on the newest satellites can deliver 6kW but the power that satellite actually uses is less. The satellite is only using 300W[1] during the dark phase of it's orbit when it can use it's entire mass to cool down. Is that limit because of the battery or is it because the satellite needs to radiate all the heat it acquired from the other half of the time in the sun?
Looks like that's a purely speculative assumption the blog author made, not a fact. I'm not sure why he made that assumption given that Starlink doesn't actually stop working at night.
Fair point that in SSO you'd need 2-3x the radiator area (and half the solar panels, and minimal/no batteries). I don't think that invalidates my point though.
If the satellite requires ~3,000 W to work in the light phase (based on solar panel size), then reducing that to 300 W during the dark phase would most definitely require it to "stop working".
The battery math is based on purely speculative assumptions the author made about cycle lifetimes. It's not grounded in any real, concrete information like the solar panel power calculations are.
Essentially yes, different engine companies have used different nomenclature over time. It seems that the "open rotor" terminology is being used to emphasize the improvements which have been made to blade design, noise, and general efficiency.
I was skeptical at first for much the same reason the author of that first article is; there are a lot of obstacles. But the more I think about it the less daunting those obstacles seem.
The author uses the power capacity of the ISS's solar panels as a point of comparison, but SpaceX has already successfully deployed many times that capacity in Starlink satellites[1] without even needing to use Starship, and obviously the heat dissipation problem for those satellites has already been solved so there's little point in hand-wringing about that.
The author also worries about ground communication bandwidth, claiming it is "difficult to get much more than about 1Gbps reliably", which seems completely ignorant of the fact that Starlink already has a capacity much greater than that.
The only unsolved technical challenge I see in that article is radiation tolerance. It's unclear how big of a problem that will actually be in practice. But SpaceX probably has more experience with that than anyone other than perhaps NASA so if they think it can be done I don't see much reason to doubt them.
Ultimately I think this is doable from a technical perspective, it's just a question of whether it will be economical. Traditional wisdom would say no even just due to launch costs, but if SpaceX can get Starship working reliably that could alter the equation a lot. We'll see. This could turn out to be a boondoggle, or it could be the next Starlink. The prospect of 24/7 solar power with no need for battery storage or ground infrastructure does seem tempting.
> The author uses the power capacity of the ISS's solar panels as a point of comparison, but SpaceX has already successfully deployed many times that capacity in Starlink satellites[1] without even needing to use Starship,
Your link here isn't really a fair comparison, and also you're still short a factor of 10x. Starlink has deployed 50x the ISS's solar cap across its entire fleet (admittedly 3 years ago); the author's calcs are 500x the ISS for one datacenter.
> and obviously the heat dissipation problem for those satellites has already been solved so there's little point in hand-wringing about that.
This reasoning doesn't make any sense to me, the heat dissipation issues seem very much unresolved. A single Starlink satellite is using power in the order of watts, a datacenter is hitting like O(1/10) of gigawatts. The heat dissipation problem is literally orders of magnitude more difficult for each DC than for their current fleet. This is like saying that your gaming PC will never overheat because NetGear already solved heat dissipation in their routers.
> The author also worries about ground communication bandwidth, claiming it is "difficult to get much more than about 1Gbps reliably", which seems completely ignorant of the fact that Starlink already has a capacity much greater than that.
Don't their current satellites have like 100Gbps capacity max? Do you have any idea how many 100Gbps routers go into connecting a single datacenter to the WAN? Or to each other (since intrahall model training is table stakes these days). They have at most like O(1)Pbps across their entire fleet (based on O(10K) satellites deployed and assuming they have no failover protection). They would need to entirely abandon their consumer base and use their entire fleet to support up/down + interconnections for just 2 or 3 datacenters. They would basically need to redeploy a sizeable chunk of their entire fleet every time they launched a DC.
> Starlink has deployed 50x the ISS's solar cap across its entire fleet (admittedly 3 years ago); the author's calcs are 500x the ISS for one datacenter.
So 3 years ago they managed to get to 10% of the power budget of one data center by accident, using satellites not explicitly designed for that purpose, using a partially reusable launch platform with 1/10th the payload capacity of Starship. My point is they've already demonstrated they can do this at the scale that's needed.
> A single Starlink satellite is using power in the order of watts
Then why does each satellite have a 6 kW solar array? Re-read that post I linked; the analysis is pretty thorough.
> Don't their current satellites have like 100Gbps capacity max?
Gen 3 is reportedly up to 1 Tbps ground link capacity, for one satellite.[1] There will be thousands.
> Do you have any idea how many 100Gbps routers go into connecting a single datacenter to the WAN? Or to each other (since intrahall model training is table stakes these days).
Intra-satellite connections use the laser links and would not consume any ground link capacity.
You're also ignoring that this is explicitly being pitched as a solution for compute-heavy workloads (AI training and inference) not bandwidth-heavy workloads.
> So 3 years ago they managed to get to 10% of the power budget of one data center by accident, using satellites not explicitly designed for that purpose, using a partially reusable launch platform with 1/10th the payload capacity of Starship. My point is they've already demonstrated they can do this at scale.
How was it by accident? You make it sound like it was easy rather than a total revolution of the space industry? To achieve 1/10th of what they would need for a single DC (and most industry leaders have 5 or 6)? Demonstrating they could generate power at DC scale would be actually standing up a gigawatt of orbital power generation, IMO. And again, this is across thousands of units. They either have to build this capacity all in for a single DC, or somehow consolidate the power from thousands of satellites.
> Then why does each satellite have a 6 kW solar array? Re-read that post I linked; the analysis is pretty thorough.
You're right, my bad. So they're only short like 6 orders of magnitude instead of 9? Still seems massively disingenuous to conclude that they've solved the heat transfer issue.
> Gen 3 is reportedly up to 1 Tbps ground link capacity, for one satellite.[1] There will be thousands.
Okay I'll concede this one, they could probably get the data up and down. What's the latency like?
I say by accident because high power capacity wasn't a design goal of Starlink, merely a side effect of deploying a communications network.
> My bad. So they're only short like 6 orders of magnitude instead of 9?
No, they're 1 order of magnitude off. (22 MW total capacity of the constellation vs your bar of 100 MW for a single DC.) Again, 3 years ago, using an inferior launch platform, without that even being a design goal.
> What's the latency like?
Starlink latency is quite good, about 30ms round trip for real-world customers on the ground connecting through the constellation to another site on the ground. Sun synchronous orbit would add another ms or two for speed of light delay.
AFAIK nobody outside SpaceX has metrics on intra-satilite latency using the laser links but I have no reason to think it would be materially worse than a direct fiber connection provided the satellites aren't spread out too far. (Starlink sats are very spread out, but you obviously wouldn't do that for a data center.)
> No, they're 1 order of magnitude off. (22 MW total capacity of the constellation vs your bar of 100 MW for a single DC.)
Why on earth would you compare their entire fleet to one project? Power generation trivially parallelizes only if you can transmit power between generation sites. Unless they've figure out how to beam power between satellites the appropriate comparison is 6Kw to 100Mw. And again, the generation is the easy side; the heat dissipation absolutely does not parallelize so that also needs to go by 3-5 orders of mag.
And also: radiation. Terrestrial GPUs are going to be substantially more power and heat efficient than space-based ones (as outlined in TFA). All this for what benefits? An additional 1.4x boost in solar power availability? There's simply no way the unit economics of this work out. Satellite communications have fundamental advantages over terrestrial networks if you can get the launch economics right. Orbital DCs have only the solar availability thing; everything else is cheaper and easier on land.
Why wouldn't you compare to the entire fleet? You think they're going to deploy an entire data center in one sat? That'd be as dumb as trying to deploy an entire data center in one rack back on Earth. Of course if you frame the problem that way it seems impossible.
I already gave my thoughts on radiation and economics in my original comment. I agree those could be significant challenges, but ones SpaceX has a plausible path to solving. Starship in particular will be key on the economic side; I find it very unlikely they'll be able to make the math work with just Falcon 9. Even with Starship it might not work out.
And it's not just a 1.4x boost in solar power availability. You also eliminate the need for batteries to maintain power during the night or cloudy days (or cloudy weeks), and the need for ground infrastructure (land, permitting, buildings, fire suppression systems, parking lots, physical security, utility hook-up, etc).
Google is hoping that after this change other TLS clients will go off and build their own PKI entirely separate from the web PKI, but in reality that would take way too much redundant effort when the web PKI already does 99% of what they want. What will actually happen is clients that want to use web certs for client authentication will just start ignoring the value of the extendedKeyUsage extension. The OP says Prosody already does. I don't see how that's an improvement to the status quo.
reply