mholt

28 ms·

421.
by mholt 3y ago
> This is not engaging in good faith. Sorry, come again? Why so combative?
422.
by mholt 3y ago
You said: > Caddy served broken certificates So yes, that would be news to me. I'm asking for more information. If Caddy did not serve broken certificates, then I would appreciate clarification there so I know where to spend my ener
423.
by mholt 3y ago
> That means Caddy served broken certificates for almost 4 days longer than necessary. This would be news to me. Do you have a source for Caddy serving any of the affected certificates? I'd like as much info as possible. > Are th
424.
by mholt 3y ago
> What is the correct tool to properly merge a large set of tar.gz files for which may have an enormous overlap of similar files, and some that have been altered just slightly? Can you elaborate on this? My understanding is that they sho
425.
by mholt 3y ago
It's called Timelinize (might rename it?), and you can follow it here: https://twitter.com/timelinize (Click "Media" on the Twitter account to view a few screenshots for a preview. More to come!) (There'
426.
by mholt 3y ago
This appears to be NEITHER your "Archive" NOR your albums in Google Photos. This is basically a collection of media you uploaded to Blogger, Hangouts, and Picasa Web Albums. Still, doesn't hurt to Takeout your Google Photos e
427.
by mholt 3y ago
Because it's distracting, honestly. Anyone could say "Caddy does this" and they would objectively be correct. The point is about ACME client features and giving an objectively true example.
428.
by mholt 3y ago
It's good to be wary. You can trust the ACME CAs listed on this site: https://www.acmeisuptime.com/ (Although, I think that list could use some updating. I'll ping the author.) Personally I would use Let's En
429.
by mholt 3y ago
I would love to read a blog of yours with more information.
430.
by mholt 3y ago
Ah, that makes sense! I wonder if we should be doing some basic sanity checks on newly obtained certificates in Caddy, and treat this as a failure, and try the next configured CA instead. (Obviously SCT signatures will require some external
431.
by mholt 3y ago
> I'm just 1. slightly frustrated that caddy's author never seems to miss a chance for self-promotion (at least he's started alluding to the fact that it's his project), Sorry that I happen to be the author. It's
432.
by mholt 3y ago
Is this because the certs were revoked? (Revocation is broken ;P) Caddy staples Valid OCSP responses to all certificates that have an OCSP responder, so if browsers aren't accepting that, then arguably the clients are broken, because t
433.
by mholt 3y ago
There are others that do it. While we're on the topic, I will say that Caddy has independently and repeatedly been cited as the gold standard of ACME clients, "the best client experience," and "we hope to see other serve
434.
by mholt 3y ago
This is true, if you manually configure a CAA limited to just one CA, then you lose that benefit of redundancy. I recommend trusting multiple CAs (but not too many): https://matt.life/writing/the-acme-protocol-in-practi
435.
by mholt 3y ago
Regular reminder that the best ACME clients will fall back to other CAs if one is down. For example caddy does this. (Disclosure yada yada)
436.
by mholt 3y ago
Thanks for your sponsorship. It really does matter, and I hope you get more than your money's worth!
437.
by mholt 3y ago
If the executed script transmits the key, then yes. (But the script we observed does not.)
438.
by mholt 3y ago
Yes, but with serious consequences (it would go into public transparency logs, at least for CAs in most public root stores). If the CA can access your private key, then it can reuse (or worse, redistribute) it without anyone knowing.
439.
by mholt 3y ago
I honestly don't think anyone else knew about the RCE until yesterday.
440.
by mholt 3y ago
I still wish for this on almost a daily basis. Maybe Android still has it, but no one uses it anymore except me :(
441.
by mholt 3y ago
caddy file-server does this, but more production-ready, honors cache headers, sets Etag, etc. Also: caddy respond can be used to hard-code specific responses if you're testing an HTTP client. It can even spin up on a
442.
by mholt 3y ago
> "Error establishing database connection" Well, that's ironic. ... Anyone have an archive.org link of the page?
443.
by mholt 3y ago
It is a little ironic that a new HTTP method called "QUERY" is being created largely to be able to remove the query from the URL.
444.
by mholt 3y ago
Apparently the 6.3 kernel made significant changes to some relevant APIs -- I noticed OpenZFS is not released for 6.3 yet. https://github.com/openzfs/zfs/issues/14622
445.
by mholt 3y ago
Great story. Brian Shul died just a few days ago. :( https://en.wikipedia.org/wiki/Brian_Shul
446.
by mholt 3y ago
How can we fix this without repeating the Concepts page on every page of our docs? Maybe we should just un-index all docs pages except the intro pages.
447.
by mholt 3y ago
What is the problem here, that is any different from allowing untrusted code on your machine? Yes, if you don't trust your other users you need to lock down your system. That's not new or unique to Caddy, and indeed you can lock d
448.
by mholt 3y ago
Yes -- hugely underrated. Memory safety vulnerabilities are the cause of 60-70% of exploits [0] including the infamous Heartbleed. Caddy is not susceptible to these types of vulnerabilities. That we continue to deploy C code to the edge --
449.
by mholt 3y ago
Making decisions based on demonstration of practical attacks is "bad bad bad"?
450.
by mholt 3y ago
Have you demonstrated SSRF on a server that is not running insecure or untrusted code (i.e. is not already compromised)? We have yet to see this, but if we do see a practical demonstration, we're happy to reconsider.

More ›