mholt

35 ms·

1. 451.▲
   by mholt 3y ago

   I think we've improved them a lot since then. A new website is in the works which should improve them even more.
2. 452.▲
   by mholt 3y ago

   Could you elaborate? We'd like to improve where practical.
3. 453.▲
   by mholt 3y ago

   They're not disabled, just off-by-default for now.
4. 454.▲
   by mholt 3y ago

   You can be on a legitimate, trusted web site or be reading a legit, trusted email from a contact and still have a link slip in there. Other commenters like xsmasher have described a benign example, I'll rephrase: > I've attache
5. 455.▲
   by mholt 3y ago

   Hey mom, here's the photos from our last family get-together: familyphotos.zip (go ahead, click it) Depending on platform, this is even more fun with command lines with commands like: `open familyphotos.zip` But the point is, unless yo
6. 456.▲
   by mholt 3y ago

   I'm in the group described halfway down: was on the Internet during PHP 5, lost interest in it, and moved on [to Go]. I haven't written anything in PHP newer than version 5. Even transitioning from 4 to 5 was quite a big deal, I
7. 457.▲
   by mholt 3y ago

   Ah yeah, that's pretty cool. Something like that!!
8. 458.▲
   by mholt 3y ago

   It can be embedded in a program, but it doesn't automatically manage devices on a tailnet; i.e. there's no way to add all users of an app to the same tailnet (they have to explicitly create a Tailscale account and sign in and shar
9. 459.▲
   by mholt 3y ago

   I keep wanting Tailscale to offer a "tailnet API" whereby you can bundle a tailnet into your app, and users can connect to other instances of the app (whether their same account or other people sharing parts of their app/data
10. 460.▲
    by mholt 3y ago

    For my masters thesis, I proposed replacing the security indicator with a risk indicator: "After HTTPS: Indicating Risk Instead of Security" - https://scholarsarchive.byu.edu/etd/7403/ Turns out there ar
11. 461.▲
    by mholt 4y ago

    https://twitter.com/ejcx_/status/1648495019509317633
12. 462.▲
    by mholt 4y ago

    In Caddy we've implemented "dynamic upstream modules" which allow an arbitrary (compiled-in) plugin to give the reverse proxy a list of upstreams that can take the request. A pull-based mechanism could relatively easily be co
13. 463.▲
    by mholt 4y ago

    Very fun. Is there something like this but which can capture the motion from a webcam (without separate motion capture process as described in the readme) and project that onto the drawings?
14. 464.▲
    by mholt 4y ago

    I would buy a good offline TV called "Primitv" in an instant
15. 465.▲
    by mholt 4y ago

    If it can be reproduced, that'd be helpful. We'd need to know what the client was, what the requests were like, etc. Caddy 2.6 works great with videos from our own testing and production experience.
16. 466.▲
    by mholt 4y ago

    Try the latest release. Correct implementation was priority 1, then optimization was recently performed by the authors of quic-go. Still more optimizing under way.
17. 467.▲
    by mholt 4y ago

    But what about the XML half?
18. 468.▲
    by mholt 4y ago

    Aside from technical limitations of HTTP headers, why do you need a header-based solution?
19. 469.▲
    by mholt 4y ago

    It's for HTTP APIs, and it's XML too.
20. 470.▲
    by mholt 4y ago

    ACME (RFC 8555) uses this, so I've implemented the client-side of it. It's alright. I do think it's nice to have some sort of semi-standard structure for error details. The namespace URN stuff feels like ceremony though and s
21. 471.▲
    by mholt 4y ago

    Thanks for the feedback. Congrats on deploying a new feature to production! I'll see about adding ARI to Caddy in the hopes that it will accelerate the transition to shorter-lived certs.
22. 472.▲
    by mholt 4y ago

    When done properly, this is less of an attack vector than you think (certainly much less than a phishing email).
23. 473.▲
    by mholt 4y ago

    That's not the same. That's saying "We issued a 90-day cert but now want it to be less than that." What I'm saying is "Issue 7 day certs."
24. 474.▲
    by mholt 4y ago

    > Short certificate lifetimes (e.g. 1 hour) is not valid-for-a-single-request as the GP asked. I'm aware :) Don't get hung up on the 1 hour figure. All I'm saying is that we already do < 1 hour quite often, and it doesn
25. 475.▲
    by mholt 4y ago

    Yes. We are aiming for that with Caddy. Starting with internal PKI. Caddy already has a built-in CA and ACME server, so it's just a matter of setting the lifetime to be very, very short. However, ultimately this will require TLS client
26. 476.▲
    by mholt 4y ago

    This is why Certbot should only be used temporarily to transition from legacy infrastructure. Ideally cert management (ACME client) needs to be baked into the server, like what Caddy does.
27. 477.▲
    by mholt 4y ago

    This is... fine... but I wish we were pushing for shorter cert lifetimes rather than expanding infrastructure to support longer cert lifetimes and to band-aid revocation, which is broken anyway. goes to make Caddy and CertMagic ACME client
28. 478.▲
    by mholt 4y ago

    > Some existing systems like the Caddy server use OCSP to detect if a cert is revoked and can renew immediately, but ARI allows allows a certificate to be reissued before the old one is revoked. Hi Matthew :) Caddy still serves a perfect
29. 479.▲
    by mholt 4y ago

    > > they make things that are near each other in their domain (inputs) map to things that are far apart in their codomain (outputs). This is describing a specific subset of hash only. *Cryptographic* hash functions map inputs to outpu
30. 480.▲
    by mholt 4y ago

    I just wrote a quick function to compare visual similarity using the thumbhash and just adding up the difference at each byte position seems to work really well! (As long as the images are the same aspect ratio. I want to do more tests.)