cpach

7 ms·

91.
by cpach 9mo ago
One can also use the DNS-01 challenge in that scenario.
92.
by cpach 9mo ago
A public CA won’t give you a cert for 10.0.0.1
93.
by cpach 9mo ago
“Are they a single point of failure in that regard?” It depends. If the ACME client is configured to only use Let’s Encrypt, then the answer is yes. But the client could fall-back to Google’s CA, ZeroSSL, etc. And then there is no singl
94.
by cpach 9mo ago
One can also use a private CA for that scenario.
95.
by cpach 9mo ago
Then one needs to launch it. Not sure if there are any lancher UIs out there, or if one has to write custom code for that.
96.
by cpach 9mo ago
Good point. The naming of those frameworks is sooo confusing. IMHO, nearly impossible to not mix them up.
97.
by cpach 9mo ago
Ah. Thanks!
98.
by cpach 9mo ago
Huh?
99.
by cpach 9mo ago
Nit-pick: The year before :)
100.
by cpach 9mo ago
For recurring and future tasks that are not automated and is not tracked by any other process I have a page in Confluence Cloud. It contains a table where one column has the due date and the other column a short description of the task. The
101.
Lessons Learned from 20 Years and Why You Should Blog(adamcaudill.com)
2 points by cpach 9mo ago|0 comments
102.
by cpach 10mo ago
This makes me curious. This bit of information – knowing whether the memory range was previously used or not – how could it be exploited?
103.
by cpach 10mo ago
Those people should perhaps ponder if it’s a reasonable thing to insist on using this broken standard/tool in 2025.
104.
by cpach 10mo ago
Ah. I meant in the de facto sense.
105.
by cpach 10mo ago
GPG is indeed deprecated. Most people have never heard of it and never used it.
106.
by cpach 10mo ago
To be frank, at this point, GPG has been a lost cause for basically decades. People who are serious about security use newer, better tools that replace GPG. But keep in mind, there’s no “one ring to rule them all”.
107.
by cpach 10mo ago
So, you will need a CA that are trusted by all parties involved, and one that is not tied to the Web PKI ecosystem. One option is to build your own PKI with it’s own root certificate, and then tell all involved parties to import that into
108.
by cpach 10mo ago
Haven’t tried it myself, but this one looks interesting: https://certifytheweb.com/
109.
by cpach 10mo ago
What would the benefit be?
110.
by cpach 10mo ago
FWIW, there are ways to use DNS-01 without an API key that can control your entire domain. https://hsm.tunnel53.net/article/dns-for-acme-challenges/
111.
by cpach 10mo ago
Yes.
112.
by cpach 10mo ago
Good question. On their website they list 3550 Lenox Road, NE Atlanta, Georgia 30326 as their address. But no info about the company name, CEO or anything like that.
113.
by cpach 10mo ago
s6 (perhaps with s6-rc) is another interesting option. One could say it’s less opinionated than systemd. Or perhaps it’s more correct to say it has another set of opinions.
114.
by cpach 10mo ago
I mean what you run is still machine code anyway, right?
115.
by cpach 10mo ago
I’m afraid I don’t follow. Would you mind to elaborate a bit?
116.
by cpach 10mo ago
I know that many feel strongly that the web’s trust system should somehow move into DNS. I think the first questions to ponder are: What is it that is wrong with the current WebPKI? (As it is in 2025, not as it was in 1999.) What would actu
117.
by cpach 10mo ago
These are two good articles regarding why DNSSEC is not a good alternative to the webPKI. https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2016
118.
by cpach 10mo ago
“is anyone really writing code from scratch” Oh yeah, lots of people do. I have friends that hate AI and refuse to use it at all. However, I guess it depends on what you mean with “from scratch”. In a corporate context, I would say most c
119.
by cpach 10mo ago
Ah. Cool!
120.
by cpach 11mo ago
A while ago I compiled Ghostty from HEAD, because it had a bug fix I cared for. It was a very stable and pleasant experience. No hassle whatsoever.

More ›