agwa

29 ms·

391.
by agwa 4y ago
That's extremely frustrating. Unclear if that's the fault of Namecheap or the .love registry (Merchant Law Group LLP[1]), and whether it was intentional deception or just incompetence. In any case, domain registrants deserve bet
392.
by agwa 4y ago
ICANN's standard registry agreement for gTLDs does not allow this, as explained in the article: > This means that Google is only allowed to increase a domain's renewal price if it also increases the renewal price of all other d
393.
by agwa 4y ago
I tried out the test domains mentioned in my blog post and Porkbun does a pretty good job disclosing the renewal price, except for the aftermarket domain where the renewal price is not listed. But at least in this case the renewal price is
394.
by agwa 4y ago
.com is operated by just a single registry, Verisign, which has just as much of a monopoly over .com as Google has over .dev. The difference is that Verisign's registry agreement with ICANN prohibits this kind of pricing shenanigans wh
395.
by agwa 4y ago
Generally it's done by the company running the TLD (called the registry). Registrars like Namecheap generally can't pull these shenanigans and have to keep their markup reasonable because otherwise people will just transfer the d
396.
by agwa 4y ago
Yes, they can pull the shenanigans. Registries (like Google for .dev, Verisign for .com/.net) set the pricing for domains under their TLDs. Registrars like Gandi add just a very slim markup.
397.
by agwa 4y ago
This is an apples to oranges comparison. Every TLD is operated by a registry that has a monopoly over that TLD. .dev's registry is Google. .com and .net's registry is Verisign. GoDaddy is a registrar which resells domains from th
398.
by agwa 4y ago
That is a very good question and I don't know the answer, but if you want to go source code spelunking, you can probably find the answer on https://opensource.apple.com/
399.
by agwa 4y ago
J.C. has already answered for Firefox; for Apple's system (valid.apple.com), if there's a bloom filter hit, the client double checks via OCSP before failing the connection. Source: a WWDC 2017 talk which unfortunately I can't
400.
by agwa 4y ago
Works for me, though the time to first byte is currently rather long.
401.
by agwa 4y ago
Yes, that's exactly what it means.
402.
by agwa 4y ago
I have a cron job that pulls that CSV file once a day. I assure you I am not a BigCo.
403.
by agwa 4y ago
Where does the post say that? If you think it's because the URLs will be disclosed in the CCADB, note that the contents of the CCADB are published here: https://www.ccadb.org/resources Specifically, the CRL URLs can be
404.
by agwa 4y ago
> I don't see how this is so hard: just let us download the CRLs Previously, you couldn't do this, because not all CAs published CRLs. Beginning October 1, you will be able to just download the CRLs, because Apple and Mozilla
405.
by agwa 4y ago
> Rule #1: Domain registrar and DNS should never be the same source. But why? A compromise of either service leads to a domain takeover (although recovering from a DNS compromise is easier than recovering from a registrar compromise) so
406.
by agwa 4y ago
Back in the day, cookies were delicious delicacies: https://i.imgur.com/YeGGd4B.png https://www.squarefree.com/2004/07/24/cookies-are-no-longer-...
407.
by agwa 4y ago
pthread_atfork functions aren't called if the application calls the clone syscall directly. The right solution is MADV_WIPEONFORK on Linux, or MINHERIT_ZERO on OpenBSD: https://www.metzdowd.com/pipermail/cryptogra
408.
by agwa 4y ago
Alternative link: https://nitter.eu/__agwa/status/1521283290396864513
409.
If your SSL certificate was issued in 2020 it may have stopped working in Chrome(twitter.com)
12 points by agwa 4y ago|2 comments
410.
by agwa 4y ago
Greetings, founder here. I got the idea for DNS Helper when doing customer support at SSLMate. One of the most common customer support issues was publishing the DNS record for SSL certificate validation. When helping customers, I learned
411.
Show HN: JavaScript widget to help your customers set up DNS records(dnshelper.com)
4 points by agwa 4y ago|1 comments
412.
by agwa 5y ago
That's an accurate summary of how TLS+ECH would work with snid. More generally, I don't think it's required for a single server to terminate TLS for all hosts. If an SNI proxy server knew the private key necessary for decryp
413.
by agwa 5y ago
An earlier version did the TLS termination in the proxy. It's true you can avoid the HTTP parsing issues, but you lose the ability to do client certs or have backend-specific cipher/TLS version requirements. Also, I really like
414.
by agwa 5y ago
Yup, that would work. Nice idea!
415.
by agwa 5y ago
ECH can't hide which backend the client wants, but if a particular backend handles multiple hostnames, it can hide which of those hostnames the client wants. I went into further detail here: https://news.ycombinator.com&#x2
416.
by agwa 5y ago
Since there are several questions about Encrypted Client Hello (ECH), and I kind of hand waved that section, I thought an example might be useful. Let's say the system is running two web server daemons: a multi-tenant blog hosting plat
417.
by agwa 5y ago
Great questions! > How does this work? snid just makes up an IP address? What socket API calls do you make to do this? Just pick an address and bind, and the kernel is fine with that? And it all gets routed back and forth correctly? Do y
418.
by agwa 5y ago
> like the need to configure certificates in the app itself[0], not at the proxy, which can be (a bit more) troublesome if you are okay with a single WC certificate serving all your subdomains. At this point, certificate management is 10
419.
Using SNI Proxying and IPv6 to Share Port 443 Between Webapps(agwa.name)
16 points by agwa 5y ago|4 comments
420.
by agwa 5y ago
GCP's $300 credit is in addition to letting you run one free e2-micro instance indefinitely: https://cloud.google.com/free/docs/gcp-free-tier/ "Free Tier: All Google Cloud customers can use select

More ›