mholt

45 ms·

661.
by mholt 5y ago
Not sure actually... I'd have to look at what the Facebook API makes possible these days. It's been years since I've looked at the Facebook data source (I think it's pretty basic right now, just gets your own posts on yo
662.
by mholt 5y ago
It's easy to add data sources, but they still have to be programmed: it can get data from APIs (which can be scheduled/automated) or file imports. I'm not really sure what you mean by "optimized parts" but I'm
663.
by mholt 5y ago
I could definitely add browser history. That should be a pretty easy one. And thanks! I'll show it off as soon as I can.
664.
by mholt 5y ago
That's fascinating. I do have plans to add context to one's timeline; for example, to optionally overlay the weather on that day, or major world or local events. That might be helpful in understanding your own timeline entries in
665.
by mholt 5y ago
It's a possibility! Haven't got there yet.
666.
by mholt 5y ago
Oh I will, for sure! I will need a lot of feedback.
667.
by mholt 5y ago
This is why I'm building Timelinize [1]. It's a follow-up to my open source Timeliner project [2], which has the potential to download all your digital life onto your own computer locally, and projects it all onto a single timelin
668.
by mholt 5y ago
I also wrote about this in some depth recently (but for maintainers): https://matt.life/writing/the-asymmetry-of-open-source (discussion: https://news.ycombinator.com/item?id=30706650 ) I'm glad Fi
669.
by mholt 5y ago
My masters thesis [1] was about ways browsers can help protect users from risks involving deception. We concluded that we can't stop attackers from imitating or manipulating UI/UX elements, but we can be clever about how we protec
670.
The Asymmetry of Open Source(matt.life)
121 points by mholt 5y ago|43 comments
671.
by mholt 5y ago
Good on him. I wrote fairly comprehensively about boundaries in open source recently: https://matt.life/writing/the-asymmetry-of-open-source A lot of principles are familiar here. Love to see it. Open source is no cake
672.
HTTPS in your VPN: Caddy now uses TLS certificates from Tailscale(caddy.community)
4 points by mholt 5y ago|0 comments
673.
by mholt 5y ago
Interesting! Things for the links/info.
674.
by mholt 5y ago
I love the idea of maddy. (I swear it's inspired by Caddy but I have no proof.) I do kinda wish it was just made into a Caddy module, though.
675.
by mholt 5y ago
Curl-to-Go also understands JSON payloads and will even generate the struct definition for you to fill in, so you aren't working with opaque JSON strings.
676.
by mholt 5y ago
No, because if the adversary is convinced you used a duress password, they'll just keep hitting you with a hammer.
677.
by mholt 5y ago
This is what we've tried to do with the Caddy docs [1]. We get a lot of compliments about how easy they are to navigate and access, and how useful they are. (We also get a lot of feedback about what they're lacking which we are wo
678.
by mholt 5y ago
> especially considering that the Caddy web server does something similar and will go down if 1 out of 10 sites fails to provision the SSL/TLS certificate What? That's not true. From the Caddy docs [1]: > Caddy does its b
679.
by mholt 5y ago
Ha, that's cool. Yeah, we still have the basic for loop that does upstream selection and load balancing, with the same timeout configs, etc. It's come a long way since then like you said, but I still consider Caddy 2's revers
680.
by mholt 5y ago
Caddy is used by large enterprises and is processing hundreds of thousands of dollars of revenue per hour at one company I know of. You can definitely use it for high volume sites.
681.
by mholt 5y ago
Hey, thanks for writing Caddy's advanced reverse proxy code years ago. I still used it as a model for Caddy 2's new reverse proxy.
682.
by mholt 5y ago
What are your side projects? Have you thought about automating this?
683.
by mholt 5y ago
What might be interesting to be notified about is certificate issued but not deployed (i.e. in CT logs, but not presented by web server). What's the compelling reason to use this over, say, Hardenize[1] or Oh Dear[2]? [1]: https:&#x2F
684.
by mholt 5y ago
https://news.ycombinator.com/item?id=30154680
685.
by mholt 5y ago
"Faster" is ambiguous, and there are a lot of factors involved. HTTPS isn't just "add encryption", it's also "do more at once and don't block as much" because HTTP/2 (a faster version of HTT
686.
by mholt 5y ago
The instance you linked to wasn't a security issue, it was a compliance issue: https://news.ycombinator.com/item?id=30085948 > Head of Let’s Encrypt here. This is a compliance issue, there is no security or validat
687.
by mholt 5y ago
> As a client I don't get to choose how the servers interact with are configured. Clients are the ones that cause the privacy leak, not servers. > The issue is the absolute fantasy that HTTPS makes your connection secure. Oh, OK.
688.
by mholt 5y ago
Oh, I did my masters thesis about this [1]! EV certs have long been known to be ineffective at preventing fraud. In fact, they can enhance fraudulent activity with a false sense of trust. And that's if users even notice it and know wha
689.
by mholt 5y ago
Google doesn't penalize redirects from HTTP to HTTPS: https://moz.com/blog/301-redirection-rules-for-seo
690.
by mholt 5y ago
> reporting of browsing information through non-stapled OCSP This is a client bug, IMO. And sensible servers like Caddy (and yes, before people complain about disclosure, I made it) staple OCSP automatically. > here's still major

More ›