You can pin in software you distribute. If you're big enough (top 100 websites mostly), you can ask browsers to pin certs and they may included it in their preloads.
> And what happens when you want to switch?
You have to update your pins and then wait long enough that you don't mind losing users who never update their software. When it's just in software you distribute, you can change hostnames in new versions and use the new CA for new versions and the old CA for old versions...
For web browsers, there's not a reasonable way to make a nicer transition. You have to serve old certs for old pins, and TLS handshakes from browsers don't include enough information to know if the client has an old pin or a new pin; or at least, mostly they don't --- if you get your pins changed and the browser TLS stack changes so the handshake changes after that, maybe you can use that... when sha1 certs were phased out, it was somewhat popular on high volume sites to look at the TLS Client Hello to decide to serve a sha256 cert or a sha1 cert.
DNS CAA only pins issuance, not acceptance; clients can not check if the CA that issued a cert was listed in DNS CAA at the time of issuance, and they do not check if it's listed at time of presentation. I'm pretty sure issuing a cert contrary to a CAA record is a mississuance and would result in sanctions from the CA/Browser forum, but clients would still accept the cert until it's revoked.
There was briefly browser support for site initiated pin on first user (HTTP Public Key Pinning), but it got dropped as mostly no one was using it and it was easy to get wrong and break your site.
https://kagi.com/search?q=dns+CAA CAA is one way, but you can also pin the actual certificate or certificate chain (which has its downsides, mind you).
CAA is a hint to honest CAs to ignore requests to issue certificates for your domain (unless they are explicitly allowed). It does absolutely nothing about dishonest actors with access to trusted keys.
Willing to bet that after all the Meta glasses backlash companies are going to start releasing AI devices that have cameras but don't store photos or videos.
Haha, "RAM-only camera!". We'd lose the candid moments with the babies but a small price to pay to have the intelligence available at a moment's notice.
Even worse because rigging professional sports is illegal, but similar manipulation in any other betting category is perfectly fine. Kalshi and co. are being used pretty openly by insiders. Trump's own family are major stakeholders and advisors of both Kalshi and Polymarket.
Sports gambling is the perfect counter to everyone who says "people are going to do xyz anyways so it's better to legalize and tax it". Yes some people will gamble regardless of the legality, but putting the experience in an app in your hand, gamifying it to maximize addiction, blasting ads 24x7, including in the broadcast itself, having all your favorite athletes and celebrities endorse it, getting VC/PE and big corporate involved and giving it wide social acceptance increases the problem 100000x. It's perfectly fine for such vices to be left in society's underbelly rather than shoved in everyone's faces.
I agree, although I think it goes beyond that in a way. What you said also shows that it's not just a matter of whether the base activity is legal, but what kind of apparatus grows up around it. The tricks you mention (gamifying, ads, endorsements, VC, etc.) have also been applied to all kinds of other markets (food, cosmetics, music, cars, "wellness", etc.), and they are all worse for it. It's true that when you combine something inherently destructive like gambling with these amplifying factors, you get a particularly toxic result. But I think that, for instance, we would be a lot better off if 90% of current ads, VC, and big corporations were themselves banned.
