apitman

49 ms·

931.
by apitman 2y ago
I've heard good things about Nix's dependency management. Does it seamlessly handle the case where you have 3 different apps that all require 3 different version of python with different python dependencies? Also, does it offer an
932.
by apitman 2y ago
Depends how much you value your time. I think most self hosters do it for reasons other than money.
933.
by apitman 2y ago
Thanks for the writeup. Very interesting. > Many mail servers (e.g. Gmail) require you to have reverse DNS that matches your forward DNS What does this look like on a technical level, ie records and whatnot? I'm not super familiar w
934.
by apitman 2y ago
Big providers have more resources than anyone when it comes to having their servers close to users and optimizing performance. They can afford things like AnyCast networks and custom DNS servers for things like Geo routing. Just because the
935.
by apitman 2y ago
I'm not sure we're talking about the same thing. Basically I'm saying that generally the URL bar and logs are considered more vulnerable than variables in memory. However, I think I would trust a value that's been transm
936.
by apitman 2y ago
This guy OAuths. Trust me.
937.
by apitman 2y ago
You don't have to violate anything in RFC6749, so technically yes. As I said it's not widely adopted, but it's also not difficult to implement. Generally OAuth2 client libraries require you to enter the client_id which you ge
938.
by apitman 2y ago
> most major websites Is this true? Do you know of any major ones offhand? That would be surprising to me. Thanks for sharing [0]. I found its discussion of shared subdomain cookies useful. However, I believe all the vulnerabilities in t
939.
by apitman 2y ago
The only thing I'm really tempted to defend here is the multi-domain thing, because I'm not aware of another way to set cookies for multiple domains in a single flow, but maybe consolidate your services under a single domain like
940.
by apitman 2y ago
Build it yourself. Then throw away your implementation and use a battle-tested library.
941.
by apitman 2y ago
Mint was the same way back in the day. I think Chase still doesn't support hardware tokens or authenticator apps. It's insane that banks are somehow the furthest behind in many security best practices.
942.
by apitman 2y ago
Umbrel[0] maybe? I posted a list of related services here[1] as well, though most of them are cloud based. [0]: https://umbrel.com/ [1]: https://forum.indiebits.io/t/open-identities/500/12
943.
by apitman 2y ago
One thing I strongly agree with you here is being open to the cloud. Self hosting strongly favors running on your own hardware, but indie hosting focuses more about the tangible benefits, ie data ownership, mobility which breeds competition
944.
by apitman 2y ago
Wheels should be reinvented once in a while, just to make sure there's not a better way to do it. They just shouldn't be reinvented by everyone all the time when there are perfectly good solutions available.
945.
by apitman 2y ago
DPoP would top my list, but honestly I'm glad they stuck to the core stuff.
946.
by apitman 2y ago
Sounds like a bad implementation. There's nothing inherent to OAuth2 that makes it slow (thought the redirects to create a latency floor). If you want a good experience try logging in to my website https://takingnames.io&#x2
947.
by apitman 2y ago
That's an interesting question, but what exactly is the threat model here? A rogue extension somehow reading the token? Is it stored anywhere? AFAIK generally the concern with access tokens is that they get gleaned from logs or MITM, n
948.
by apitman 2y ago
This is fantastic. I've implemented OAuth2 4-5 times over the past few years. It seams overly complicated at first, but over time I've come to understand more of the vulnerabilities each piece of complexity exists to mitigate. Eve
949.
by apitman 2y ago
I think we'll see some stratification in the self hosting community over the next few years. The current community, centered around /r/selfhosted and /r/homelab, is all about articles like this. The complexity and l
950.
WhatsApp and the Domestication of Users (2021)(seirdy.one)
2 points by apitman 2y ago|1 comments
951.
Explaining the Backlash to the SSO Tax(blog.1password.com)
2 points by apitman 2y ago|0 comments
952.
SSO Tax(ssotax.org)
3 points by apitman 2y ago|3 comments
953.
by apitman 2y ago
Honestly I thought it was too, and I mostly write Go.
954.
by apitman 2y ago
If you want hosted S3-compatible storage, you should be able to combine Backblaze B2, Wasabi, or Cloudflare R2 with any VPS provider from the bandwidth alliance: https://www.cloudflare.com/bandwidth-alliance/ That shou
955.
by apitman 2y ago
I would guess GP was referring to self-hosting minio.
956.
by apitman 2y ago
Note that if you saturate that 1Gbps link they will almost certainly ask you to stop. Lots of VPS offer "unlimited" but it's really not. It's only unlimited within their "fair use" restrictions, ie only as long
957.
WebSocat – Like Netcat for WebSockets(github.com)
5 points by apitman 2y ago|1 comments
958.
by apitman 2y ago
CORS exists to keep us humble. The first time you think you understand it, your journey has only just begun.
959.
by apitman 2y ago
JWTs are orthogonal to OAuth2. Tokens in OAuth2 are opaque to the client applications. JWTs are one way to do it, though with significant tradeoffs.
960.
by apitman 2y ago
I don't think there's any reason to draw such a hard distinction between API keys and OAuth2 tokens. Either can be a subset of the other. In a well-designed OAuth2 flow, the user should be able to select fine-grained permissions i

More ›