francislavoie

7 ms·

61.
by francislavoie 1y ago
As we repeat every time this comes up, this was literally 8 years ago when the project was in its infancy and the project author was in the middle of exams, and it has not been true since. Caddy has been rewritten from the ground up since t
62.
by francislavoie 1y ago
Because that's not automated, it's a manual command and uses caddyserver.com resources (relatively low powered cloud VMs) with no uptime guarantees. It _should not_ be used in automation scenarios, only for quick manual personal u
63.
by francislavoie 1y ago
No, you have to build Caddy with plugins. We provide xcaddy to make it easy. Sign up for notifications on github for releases, and just write yourself a tiny bash script to build the binary with xcaddy, and restart the service. You could po
64.
by francislavoie 1y ago
Actually, you can set the permissions for log files now. See https://caddyserver.com/docs/caddyfile/directives/log#file
65.
by francislavoie 1y ago
A very in-depth article on the topic: https://adam-p.ca/blog/2022/03/x-forwarded-for/ I implemented those recommendations in Caddy to enable a "trusted proxies" system which informs the proxy,
66.
by francislavoie 1y ago
Typically a boolean issue like this is a cause for escalation if you use it in combination with some auth handler, like "if has session cookie then serve protected files" and since the condition always passes then it could bypass
67.
by francislavoie 1y ago
See the README, this results in only changed layers being sent instead of _everything_ which can save a lot of time.
68.
by francislavoie 1y ago
If you read the README, you'll see that replacing the "save | upload | load" workflow is the whole point of this, to drastically reduce the amount of data to upload by only sending new layers instead of everything, and you ca
69.
by francislavoie 1y ago
No, it's because TS adds information. Pure JS doesn't know what variable "foo" is (is it a potato? is it an array? can it be null?), but if you assign it a type like Map<string> then now it knows what kind of data
70.
by francislavoie 1y ago
He's involved with https://grayjay.app/ btw. Of all people to criticize for using YouTube as a platform, he's the last.
71.
by francislavoie 1y ago
Very cool, but CLI tools with a JVM language? :( I'd be much quicker to try this out with a static binary.
72.
by francislavoie 1y ago
There is one, there's a toggle for it on the right
73.
by francislavoie 1y ago
The spec is fundamentally flawed. The fixed spec would be a different spec, i.e. something like PASETO.
74.
by francislavoie 1y ago
It's not about the curves being cracked. https://auth0.com/blog/critical-vulnerability-in-json-web-en...
75.
by francislavoie 1y ago
Yes it allows Ed25519, but it doesn't disallow other curves. That's the whole point. If you allow primitives that have potential issues, it's risky to use.
76.
by francislavoie 1y ago
The point is that the JWT spec leaves it open to the implementer which primitives to use, which invites bad implementations to be insecure. PASETO requires a small subset of known secure primitives, preventing that problem altogether. It&#x
77.
by francislavoie 1y ago
I don't like it much, using JSON as the transport has some problems if encoded in a URL as required by many auth flows. Paseto encodes the whole version+payload+signature to make it easier to transport. Of course you could just base64
78.
by francislavoie 1y ago
As others have said, JWT, in practice, is effectively forced by the extensions/OIDC, I was just being short. It shouldn't be about demand. It's about solving the danger of these poorly designed APIs to improve overall web sec
79.
by francislavoie 1y ago
Watch the talk at the bottom of the page. JWT/JOSE are chock full of dangerous footguns that aren't just theoretical, they have repeatedly been shown to be poorly designed and too risky to implement correctly as written. Using few
80.
by francislavoie 1y ago
Paseto is better https://paseto.io/ , but unfortunately OAuth forces the usage of JWT.
81.
by francislavoie 2y ago
But isn't using LLM for that really expensive? Seems wasteful.
82.
by francislavoie 2y ago
I use xplorer2, works pretty well. I don't do anything fancy with it, but I like the two-panel layout and the "scrap" panel for quick links
83.
by francislavoie 2y ago
Production ready, 10 year old project. It's not new, it's older than Kubernetes even.
84.
by francislavoie 2y ago
Logs are just written out to stderr by default, and when you use systemd it ingests it automatically. If you run it with alpine, it's up to you to wire that up.
85.
by francislavoie 2y ago
You can shorten it: @oldPath path_regexp ^/old/([\w-]+) rewrite @oldPath /new/{re.oldPath.1}.php Having matching and handling be separate steps are a huge benefit to composability of config, you can have plu
86.
by francislavoie 2y ago
Yeah, tech debt sucks a lot.
87.
by francislavoie 2y ago
Caddy v0/1 was just built up naturally bit by bit, never had a proper design/structure around its config. Caddy v2 was a complete rewrite from the ground up, including thinking a lot more about config design, so it had to be a bre
88.
by francislavoie 2y ago
Yes, it has events on cert issuance/renewal you can hook into with Go plugins (which can trigger your python script). But generally you want all Caddy instances to share storage via storage modules (e.g. Redis or Consul or a DB, or syn
89.
by francislavoie 2y ago
Yes, stable and production ready
90.
by francislavoie 2y ago
Hahaha, this is basically some clever clickbait. Tl;dr Paul is retiring and Jack is taking sole ownership of Fathom. Nothing really changes.

More ›