mercora

10 ms·

61.
by mercora 5y ago
> IP spoofing is also a thing. IP spoofing is pretty hard to do with 2-way communication channels like TCP and a lot harder with TLS too. usually IP spoofing only works meaningfully with UDP and protocols that allow for transactions were
62.
by mercora 5y ago
ive seen DKIM signed mails that did not have their key in DNS fail verification without being marked as spam by google. and i have (not) received mails because of failing spf validation made delivery fail silently so i think you are quite r
63.
by mercora 5y ago
how easy is it to test for these antibodies for a layman? could people actually easily get tested prior to considering a vaccination?
64.
by mercora 5y ago
it is just a different record entirely. there is a special zone for reverse lookup on ip addresses for ip4 and ip6 respectively. the address gets transformed into DNS labels to make the lookup. i.e to do a lookup for the ip address "19
65.
by mercora 5y ago
> There's a free tier, so I'd imagine almost all iPhones are using some tier of it. i was quite surprised to see this was the default or at least was setup unknowingly to me.
66.
by mercora 5y ago
its in the article, i had overlooked it too though...
67.
by mercora 5y ago
that's interesting i will investigate how to make use of that, thanks :) EDIT: its really pretty easy to do apparently[0] although only unconditionally as it seems... [0] https://cbonte.github.io/haproxy-dconv/2.4&
68.
by mercora 5y ago
what i do is somewhat like you suggest. if haproxy cant determine which hostname it should serve it responds with a "503 Service Unavailable". However, if i expect someone to be able to actually receive that i still need to presen
69.
by mercora 5y ago
while it is easy to see the desired hostname for an SSL connection that makes use of SNI it is also very easy to simply connect to the address someone is communicating with and see what certificate is presented to you. it probably even work
70.
by mercora 5y ago
it sounds a lot like this would need some kind of delegation mechanism where you could point to a different URL in-time before abandoning the place. or maybe some kind of sealing using a cryptographic function that lets you proof your are t
71.
by mercora 5y ago
> what is so difficult about pricing that you cannot write a one liner saying XXX dollars per YY nodes per ZZ period? i always suspect the pricing is dependent on your budget and they want to figure out the amount of your budget before g
72.
by mercora 5y ago
i could not unsee it anymore after it got pointed out to me in "therapists" and sometimes giggle childishly when i encounter it
73.
by mercora 5y ago
i wonder how much information is gained about me if a close relative decides this is a good idea to do...
74.
by mercora 5y ago
its often not at all exactly as said... also you might miss a lot of the performance if you are not able to see how things are expressed...
75.
by mercora 5y ago
i would think the only ones using this would be people who don't want to be tracked so setting this globally would be be great for them. However, what incentives would the products people see to have this implemented? i guess the same
76.
by mercora 5y ago
i fear a little that it might mean doing this is just not legal no matter if its still possible to do yourself.
77.
by mercora 5y ago
huh, for some reason i did not know about this utility but it really looks like a better approach. i feel a bit unsure if running in a new user namespace could break things in subtle ways somehow though. however, it works without user names
78.
by mercora 5y ago
it might be a bit offtopic but there is a somewhat easy solution to isolate networking for some applications if needed; sudo ip netns add lonly sudo ip netns exec lonly sudo -u $USER -i this should start an interactive shell sessio
79.
by mercora 5y ago
> Another theory is that this should report 50% CPU usage, because even though that CPU-intensive program is causing the CPU to consume all of its available cycles, it is not consuming all off the cycles that are potentially available. i
80.
by mercora 5y ago
later on they also had the need for it to be honest, albeit only for a very specific external service that required us to have a fixed public IP address to connect from. The only solution deemed scaleable was using such an AWS provided NAT
81.
by mercora 5y ago
when i evaluated using a NAT setup using AWS NAT gateways it appeared to be quite expensive. we settled for strict VPC rules using only SecurityGroups in order to restrict communication. the instances did have public ip but nothing but inte
82.
by mercora 5y ago
note that if the containers are bridged the iptables FORWARD table wont affect packet forwarding between containers either. you would need to use ebtables for layer 2 firewalling i am almost certain. Edit: apparently there is a sysctl se
83.
by mercora 5y ago
i feel the same way, systemd also has some comprehensive sandboxing capabilities built-in.... i have my gripe with systemd too though. mostly with journald because it is slow, likely due to its on disk format, really could have used sqlite
84.
by mercora 5y ago
CodeDeploy fails in horrible ways and the maintainers are somewhat unresponsive. I don't use it anymore but am still subscribed to some issues which apparently weren't fixed for years...
85.
by mercora 5y ago
... even if you handcraft your rules, docker will still, by default, add its own rulesets... ive helped people bitten by this on occasions mostly because it changes the default forward policy to drop... its also really hard to manage this c
86.
by mercora 5y ago
is "illegal termination" when you funnel calls via VoIP to some local mobile network operators using sim cards usually provided to customers? like lets say to avoid billing it like a call into another network?
87.
by mercora 5y ago
i was told once some of the emergency lines on elevators in Germany could be called into once you uncovered their number and expected to read about something similar here but no. Still quite interesting of course. i wonder if these machine
88.
by mercora 5y ago
if that is true disks should come with a very visible note stating this... seriously, 3 months would be nothing. i doubt it is true because 3 months is a time frame which should be surpassed quite often making this more known.
89.
by mercora 5y ago
the official wireguard implementations only do unicast afaict.
90.
by mercora 5y ago
unless they do do something funky only unicast packets are routed in wireguard. bonjour/zerconf/mdns all use multicast or broadcasts for discovery. integrating some kind of service discovery relay would be possible though.

More ›