corford

22 ms·

1. 241.▲
   by corford 7y ago

   You're conflating privacy with trust. DNSSEC gives you trust, the VPN gives you "last mile" privacy. DoH is only designed for last mile so useless in encrypting the resolver chain between you and the root servers. Currently t
2. 242.▲
   by corford 7y ago

   Except, not really. If you're worried about DNS tampering, DNSSEC already exists all the way up to the root servers. If you're worried about ISPs snooping on what sites you visit, they'll continue to be able to do this even w
3. 243.▲
   by corford 7y ago

   If you're worried about your ISP snooping on you and tampering with DNS records, the tools we have today already offer better privacy and trust than DoH, DoT, DNSCurve or DNSCrypt. Just use a DNSSEC capable resolver in combination with
4. 244.▲
   by corford 7y ago

   Frankly, if your ISP is that aggressive, your best bet is a VPN. DoT and DoH will always offer imperfect privacy even with widespread ESNI.
5. 245.▲
   by corford 7y ago

   The discussion should be around improved UX/UI and better protocols rather than treating people like idiots and abusing your power to unilaterally force behaviour changes on web content providers and consumers. The more I think about i
6. 246.▲
   by corford 7y ago

   Isn't it the opposite? With DoH, ISPs now have another incentive not to boost IPv6 adoption.
7. 247.▲
   by corford 7y ago

   Kind of sad when you need a private company to give your citizens the basic privacy they want (doubly so when you have to simply trust said company that the partners they are working with are honest). Maybe the US's privacy laws need a
8. 248.▲
   by corford 7y ago

   I'm getting pretty pissed off the with the arrogance of US internet tech companies sidestepping formal protocol design & industry adoption because it isn't moving "fast enough" for them. Without ESNI, DoH is essentia
9. 249.▲
   by corford 7y ago

   Can't imagine that will last for long. Otherwise what stops Telcos/ISPs blocking this in their resolvers.
10. 250.▲
    by corford 7y ago

    So all DoH does (once ESNI is eventually a thing) is alter this equation. ISPs will simply begin correlating IPs (and CT logs: http://blog.seanmcelroy.com/2019/01/05/ocsp-web-activity-is-... ) instead.
11. 251.▲
    by corford 7y ago

    Not really. It's an argument for the industry moving to something sensible; not "split braining" low level infrastructure by shoehorning some of it into HTTP, apps and a handful of centralised coporations who claim to play a
12. 252.▲
    by corford 7y ago

    I'd strongly recommend having two: Nationwide as your base and a challenger for international wires/multi currency (I use revolut but there are lots of others).
13. 253.▲
    by corford 7y ago

    Yeah but unlike a mortgage (secured against one static asset i.e. a house), the article assumes most of this debt will be issued against the strength and quality of a company's various recurring revenue streams (even speculating that d
14. 254.▲
    by corford 7y ago

    Sky high valuations that limit your options/exits, potentially pushing your company down a path it shouldn't take.
15. 255.▲
    by corford 7y ago

    Can't find it now but I remember reading about a recently launched Seedcamp or Point Nine portfolio company that is doing this for B2C SaaS companies I think. You let them plug into your stripe metrics etc. and they then give you debt
16. 256.▲
    by corford 7y ago

    Speaking of rebinding attacks... does anyone know why cloudflare's 1.1.1.1 resolver doesn't enforce this? It's the only "big" public one I know of that happily resolves RFC1918 IPs.
17. 257.▲
    by corford 7y ago

    I really wish Intel or MS or someone would fund D so it could give Go and Rust a run for their money. It's as fast (or faster), expressive, powerful and, subjectively, easier to pick up and code in than Rust. It just needs some backers
18. 258.▲
    by corford 7y ago

    Prior to SEPA becoming prevalent, I've witnessed it done with an id and credit check together with a decent sized deposit via debit/credit card (~€10K). Balance wired using SWIFT or TARGET2 within 72 hours of driving away. You hav
19. 259.▲
    by corford 7y ago

    What? You go to a car dealer, sign, pay and drive away.
20. 260.▲
    by corford 7y ago

    https://www.digitalocean.com/community/tutorials/how-to-crea...
21. 261.▲
    by corford 7y ago

    Justin Frankel is another name that could go on that list.
22. 262.▲
    by corford 7y ago

    Posting back here in case it helps someone else. In the end I went with: https://dnsimple.com
23. 263.▲
    by corford 7y ago

    I think you've misunderstood my comment. LDAP gives you an extremely well supported back end from which to easily extend to virtually any form of authZ, including oauth.
24. 264.▲
    by corford 7y ago

    Another solution is OpenLDAP (or JumpCloud) at the root and then supporting software: OpenLDAP ├── PrivacyIDEA (TOTP/MFA with LDAP auth backend) ├──---└── SAML iDp (e.g. SimpleSAMLphp or Shibboleth) for SSO: AWS, Google,
25. 265.▲
    by corford 7y ago

    Nice find. archive.is stopped working for me recently and I just assumed it had disappeared. Now I know its because I happened to change my router's resolver from 8.8.8.8 to 1.1.1.1. Edit: Would be cool if archive.is implemented this c
26. 266.▲
    by corford 7y ago

    I have two FF windows open with a total of ~300 tabs and its currently consuming 2.1GB (Windows 10).
27. 267.▲
    by corford 7y ago

    They used to be very good if you wanted a non-scammy registrar with a huge selection of TLDs and ccTLDs. However, in recent years, success seems to have gone to their head and the service is nothing like it used to be (plus their latest con
28. 268.▲
    by corford 7y ago

    Thanks. They look exactly like what I want.
29. 269.▲
    by corford 7y ago

    Thanks! I'll check these out.
30. 270.▲
    by corford 7y ago

    ZFS by the looks of the status updates: >we have a problem to import zfs pool on the unit storage. Our engineers are still working on it.