akerl_

13 ms·

331.
by akerl_ 7mo ago
If your child routinely wandered into my yard and messed with the animals there, I would also have a problem with that, yes.
332.
by akerl_ 7mo ago
It’s not fine for the cat. Or for the outdoors. There’s the whole parallel thread about that. But also keep your cat inside so they’re not roaming into my yard. It’s wild that outdoor cat “owners” are so willing to co-opt everybody else’s p
333.
by akerl_ 7mo ago
> The risks come with the territory To be clear here, the “territory” here is letting your pet free roam off of your property and expecting everybody else to be cool with that?
334.
by akerl_ 7mo ago
I think you may be caught in the distortion field.
335.
by akerl_ 7mo ago
> Steve Jobs was all about fun By every account I’ve seen, Steve Jobs cared that the users of the product were having fun. He did not care at all how much fun the people building the product had.
336.
by akerl_ 7mo ago
It’s fine for what it is: some light guardrails that attempt to nudge you towards answering “is this all just a house of cards that will obviously collapse under a light breeze”. Getting a SOC2 doesn’t mean you’re amazing or secure or stabl
337.
by akerl_ 7mo ago
Also a quick search suggests that Switzerland has made Internet providers in-country block DNS results in the past.
338.
by akerl_ 7mo ago
Are there any examples of 1.1.1.1 or 8.8.8.8 not being neutral?
339.
by akerl_ 7mo ago
If you said that they served you cold food because the US government made them do it, yea, I’d think you were nuts.
340.
by akerl_ 7mo ago
I don’t keep DNS logs at all. But I also don’t show up 7 years later trash talking a company or product based on guesswork and fear.
341.
by akerl_ 7mo ago
Your claim was that 1.1.1.1 was blocking sites. Are you saying now you just had issues with the quality of service? Or do you want to provide more details to substantiate the claim that they were blocking sites?
342.
by akerl_ 7mo ago
How does that differ from Quad9? You’re subject to Swiss laws, so there’s still a government involved? And you’re now hosted in an area where the US government has far fewer limitations on what they can attempt.
343.
by akerl_ 7mo ago
So… why not use 1.1.1.1, cloudflare’s resolver that does not block resolution? 1.1.1.2 and .3 are explicitly offered with filtered responses.
344.
by akerl_ 7mo ago
1. As noted in prior comments, Cloudflare wasn’t blocking this site previously. The site operator chose to make their site unresolvable by Cloudflare. 2. 1.1.1.2, the resolver being discussed in this post, is explicitly Cloudflare’s malware
345.
by akerl_ 7mo ago
Have they? The thing I remember previously was archive.is, and it wasn’t a block, archive.is was serving intentionally wrong responses to queries from cloudflare’s resolvers. This is notably not a change to how 1.1.1.1 works, it’s specifica
346.
by akerl_ 7mo ago
Yea, this looks like a lingering auto-moderation on the Github repo URL prefix due to past spam attempts.
347.
Trivy Compromised by Supply Chain Attack(wiz.io)
4 points by akerl_ 7mo ago|1 comments
348.
by akerl_ 7mo ago
This feels like a weird response to a comment recommending how to approach getting a SOC2, that links to a blog post about Fly.io's SOC2. The pitch isn't "don't get a SOC2", or "convince big paying customers th
349.
by akerl_ 7mo ago
I'd say that a this point, if your job involves computers and you aren't at least familiar with how you can leverage AI tools, you're basically admitting that you really enjoy the art of working with one hand tied behind your
350.
by akerl_ 7mo ago
Given the large amount of sites, including popular sites, that do not have DNSSEC today, I'd expect that if this was a real risk we'd see a decent number of instances where it occurred. And yet I see zero. Is it possible that give
351.
by akerl_ 7mo ago
Sure. I guess by that logic this attack also could have been prevented by flossing, as long as you combined flossing with setting a CAA record.
352.
by akerl_ 7mo ago
The attacker did not fake any DNS records. They re-routed traffic to the legitimate IP addresses.
353.
by akerl_ 7mo ago
I’ve asked elsewhere what threat models DNSSEC is solving for me. Where are all the attacks happening targeting sites that don’t use DNSSEC?
354.
by akerl_ 7mo ago
I touched on this in the parallel comment where you linked this, but worth noting that DNSSEC does not solve this threat model, because re-routing the destination of legitimate IP addresses does not rely on modifying DNS responses.
355.
by akerl_ 7mo ago
I don't see any indication that DNSSEC would have been relevant there? Their assessment was that that interception (and certificate issuance) were completed by redirecting traffic for the legitimate IPs to another destination. The DNS
356.
by akerl_ 7mo ago
Does it? I run a bunch of websites personally. I have ACME-issued TLS certificates from LetsEncrypt. I monitor the Certificate Transparency logs, and have CAA records set. What's the threat model that should worry me, where DNSSEC is t
357.
by akerl_ 7mo ago
So why are we not constantly seeing real world compromises of major sites that don't use DNSSEC?
358.
by akerl_ 7mo ago
HTTPS solved a bunch of real world threat models that were causing massive security issues. So we collectively put a bunch of engineering time into making it performant so that we could deploy it everywhere with minimal impact on UX and per
359.
by akerl_ 7mo ago
Did he try and you disagree about the standards of evidence that the courts use? Courts determine things that can’t be absolutely proven every day, by a variety of different standards. You’re likely most familiar with “beyond a reasonable d
360.
by akerl_ 7mo ago
Not sure what you’re trying to say here. Contempt charges like this are an established part of judicial process for when a participant is not cooperating with the process. A core way to appeal a civil contempt is on the grounds that you can

More ›