cpach

7 ms·

121.
by cpach 11mo ago
Very interesting research!
122.
by cpach 11mo ago
Very good question. On e.g. AWS one could probably do something like that with a custom Lambda…? Still, would be very convenient if there was some IAM rule for that.
123.
by cpach 11mo ago
One key difference: A cert is a “pickled” thing, it’s stored and kept until it is successfully renewed. So if you attempt to renew at day 30 and LE is down, then you still have nearly more than two weeks to retrieve a new cert. Hopefully LE
124.
by cpach 11mo ago
For those who want to solve the problem buy throwing money at it, one can probably buy a solution for this. I’m thinking of stuff like AWS IoT Core, I would guess there are other vendors in that space too.
125.
by cpach 11mo ago
PS. Saw this insightful comment over on Lobsters: “One quantitative benefit is that the maximum lifetime of certificates sets a bound on the size of certificate revocation lists. John Schanck has done heroic work on CRLite at Mozilla to co
126.
by cpach 11mo ago
If you forget a cert then you’re no worse off than the case where the automation fails during the vacation. You could also run a simple program that checks each site and tells you the remaining lifetime of the cert used, to verify that you
127.
by cpach 11mo ago
“I really hope they don’t try to make it shorter than this. Because I really don’t want to worry about certificate expiry during a vacation.” You might want to consider force-renewing all your certs a few days before your vacation. Then y
128.
by cpach 11mo ago
There are quite many solutions. For very funky systems, you can use a cert tied to a private CA. Then you can control the cert lifetimes. Or place them behind a reverse proxy that is easier to control.
129.
by cpach 11mo ago
“Aside from all that, what happens if a hacker manages to wreck the let’s encrypt infra so badly they need 2 weeks to get it back online?” There are other CAs that offer certs via ACME. For example, Google Trust Services.
130.
by cpach 11mo ago
Google Trust Services https://pki.goog/
131.
by cpach 11mo ago
The primary reason: Revocation doesn’t work for webscale (OCSP is now obsolete). So instead, shorter cert lifetimes.
132.
by cpach 11mo ago
I hear ya. I’m also not fond of certbot and other existing clients. The best solution I’ve found so far was to implement a custom cert manager using the formidable acmez library.
133.
by cpach 11mo ago
Yep, being able to “redirect” the “challenge record” is very handy in some cases. Did a writeup here with some examples of how it can be arranged: https://hsm.tunnel53.net/article/dns-for-acme-challenges/
134.
by cpach 11mo ago
Main discussion thread over here: https://news.ycombinator.com/item?id=46117126
135.
by cpach 11mo ago
I haven’t tried, but I’m guessing it would be much slower than HN.
136.
by cpach 11mo ago
Interesting question. If you would ask Deming I believe he would say “no”.
137.
by cpach 11mo ago
I am grateful for this: My kids have their health and they have friends and a school within walking distance. Both me and me wife are employed. We have enough to provide for our family. No bombs are falling over our heads. There are lots of
138.
by cpach 11mo ago
Out of curiosity, why do you want this specific version? :)
139.
by cpach 11mo ago
More comments here: https://news.ycombinator.com/item?id=46020596
140.
by cpach 11mo ago
A few comments over here: https://news.ycombinator.com/item?id=46013307
141.
by cpach 11mo ago
Are you referring to NAT?
142.
by cpach 11mo ago
There’s actually a YC startup that tries to address this question: https://tornyol.com/
143.
by cpach 11mo ago
This look with animations and bright text on dark repeated backgrounds was definitely popular for a while in the late 90s. You wouldn’t see it on larger sites like Yahoo or CNN, but it was definitely not unheard of for personal sites. Gray
144.
by cpach 11mo ago
You might want to have a look at TextMate. Not sure if it’s a full replacement for Notepad++, but it’s quite nice.
145.
by cpach 1y ago
I hate to admit it, but it’s like me and my Digitalocean bills (: I don’t want to think about how much money I’ve paid them over the years for VMs I no longer need. A week ago I finally pulled the plug on those servers. Not a moment too soo
146.
by cpach 1y ago
Same here. I have not found any open source option that does all of these: Nice user interface / App for both Mac and iOS / Automatic syncing.
147.
by cpach 1y ago
Previously: https://news.ycombinator.com/item?id=45290245
148.
by cpach 1y ago
Nit-pick: It’s short for catenate (:
149.
by cpach 1y ago
https://archive.ph/fOHhx
150.
by cpach 1y ago
IMHO it’s better to bake this information into the price of the resource and then include the externalities for polluting by using a Pigou tax, or as in the EU, with a cap and trade system (EU ETS). And that’s probably one of the reasons th

More ›