5 ms·

I would recommend getting certificate which includes root domain and wildcard subdomains to cover all bases.

jffry 5y ago
The cert I am seeing [1] does include both the wildcard subdomain AND the apex domain [1] https://crt.sh/?id=6125359537 https://crt.sh/?id=6125359537
- seszett 5y ago
  That's not the certificate I get served though (this one is from 5 february, the one served is from 25 january) do you actually get this certificate on https://marginalia.nu https://marginalia.nu?
  - jffry 5y ago
    I misunderstood what URL we were talking about. What I am seeing: https://marginalia.nu https://marginalia.nu = https://crt.sh/?id=6046506678 https://crt.sh/?id=6046506678 (includes wildcard but NOT apex) https://search.marginalia.nu https://search.marginalia.nu = https://crt.sh/?id=6125359537 https://crt.sh/?id=6125359537 (includes both wildcard and apex)
    - marginalia_nu 5y ago
      Ah, I see what's happening. search.marginalia.nu goes through cloudflare which does its creepy MITM thing and re-encrypts on its end; the others do not.
      - wizzwizz4 5y ago
        Why does marginalia.nu use Cloudflare? Have you been hit by DDOSs? I can't think how a search engine would benefit from Cloudflare caching things.
        marginalia_nu 5y ago
        Yeah, It's 100% about bot mitigation. I got hit pretty bad by some botnet a while back, saw 10-15 searches/second. Can't have nice things on the Internet I guess. Don't really understand their motive either. Maybe they thought I was cloud hosted or used some expensive API to do searches and were attempting to rack up big bills or something.
        wizzwizz4 5y ago
        :-| I wish I had a good solution to this. Cloudflare to mitigate DDOS attacks has somewhat of a “baby with the bathwater” vibe (considering how much of a pain it is if you can't pass the CAPTCHA, or if you're on Tor), but I can't think of an alternative.
        marginalia_nu 5y ago
        :-| indeed. I've considered having a naked endpoint with a rate limiter that, when it hits some ceiling (dunno, sustained load of 2 RPS or so), offers the alternatives of going through an unlimited cloudflared domain, or waiting until the bots give up. But that might be annoying too.
        wizzwizz4 5y ago
        You could try to push forward the frontier of accessible CAPTCHAs. You just need some tasks that basically all humans can do, but barely and bots can, that don't rely on vision, hearing, emotional response or cultural knowledge. Should be easy, right?

The cert I am seeing [1] does include both the wildcard subdomain AND the apex domain [1] https://crt.sh/?id=6125359537 https://crt.sh/?id=6125359537

seszett 5y ago
That's not the certificate I get served though (this one is from 5 february, the one served is from 25 january) do you actually get this certificate on https://marginalia.nu https://marginalia.nu?
- jffry 5y ago
  I misunderstood what URL we were talking about. What I am seeing: https://marginalia.nu https://marginalia.nu = https://crt.sh/?id=6046506678 https://crt.sh/?id=6046506678 (includes wildcard but NOT apex) https://search.marginalia.nu https://search.marginalia.nu = https://crt.sh/?id=6125359537 https://crt.sh/?id=6125359537 (includes both wildcard and apex)
  - marginalia_nu 5y ago
    Ah, I see what's happening. search.marginalia.nu goes through cloudflare which does its creepy MITM thing and re-encrypts on its end; the others do not.
    - wizzwizz4 5y ago
      Why does marginalia.nu use Cloudflare? Have you been hit by DDOSs? I can't think how a search engine would benefit from Cloudflare caching things.
      - marginalia_nu 5y ago
        Yeah, It's 100% about bot mitigation. I got hit pretty bad by some botnet a while back, saw 10-15 searches/second. Can't have nice things on the Internet I guess. Don't really understand their motive either. Maybe they thought I was cloud hosted or used some expensive API to do searches and were attempting to rack up big bills or something.
        wizzwizz4 5y ago
        :-| I wish I had a good solution to this. Cloudflare to mitigate DDOS attacks has somewhat of a “baby with the bathwater” vibe (considering how much of a pain it is if you can't pass the CAPTCHA, or if you're on Tor), but I can't think of an alternative.
        marginalia_nu 5y ago
        :-| indeed. I've considered having a naked endpoint with a rate limiter that, when it hits some ceiling (dunno, sustained load of 2 RPS or so), offers the alternatives of going through an unlimited cloudflared domain, or waiting until the bots give up. But that might be annoying too.
        wizzwizz4 5y ago
        You could try to push forward the frontier of accessible CAPTCHAs. You just need some tasks that basically all humans can do, but barely and bots can, that don't rely on vision, hearing, emotional response or cultural knowledge. Should be easy, right?