mholt

68 ms·

931.
by mholt 7y ago
Already posted: https://news.ycombinator.com/item?id=23070567
932.
Show HN: Caddy 2(caddyserver.com)
778 points by mholt 7y ago|240 comments
933.
by mholt 7y ago
> none of my traefik instances in production or else were affected at all It didn't affect every site. But it did affect millions of them. You're lucky!
934.
by mholt 7y ago
We distributed commercial binaries to businesses for a time and considered making various plugins paid-only to fund its development. But the source code has always been open and Apache-licensed, and there was never any requirement that you
935.
by mholt 7y ago
> the source code was not open back in the days The Caddy source code has always been open source (Apache 2.0 licensed) from day one all the way to today, and will continue to be in the future. Beware when using other Let's Encryp
936.
by mholt 7y ago
I agree with you and have upvoted your comments, however, I'll also note that we distinguish between different disciplines in software engineering. "Real-time" has a very spceific definition in embedded systems and OSes, but
937.
by mholt 7y ago
Update from Disney: > The above legal language applies ONLY to replies to this tweet using #MayThe4th and mentioning @DisneyPlus . These replies may appear in something special on May the 4th! https://twitter.com/disneypl
938.
by mholt 7y ago
FYI: Caddy 2 is not released yet. Check back in about a week.
939.
by mholt 7y ago
Really? I did not know that! Small world.
940.
by mholt 7y ago
And from Dubuque!
941.
by mholt 7y ago
-
942.
by mholt 7y ago
I'd actually rather you have my username and password, since I use a password manager and every password is long and unique. I don't want to tie my Google/Apple/<X-Mega-Corp> account to my Tailscale account. This w
943.
by mholt 7y ago
I just rewrote our Caddy v2 Caddyfile formatter this week [1]. It's not as "smart" as a true code formatter, but what I thought would be just a 1 hour task ended up taking all day. And I'm lucky it wasn't longer! Le
944.
NPM Is Joining GitHub(github.blog)
1829 points by mholt 7y ago|557 comments
945.
Best Practices for Acme Client Operations(docs.https.dev)
1 points by mholt 7y ago|0 comments
946.
by mholt 7y ago
FWIW, I believe any Caddy sites will not be affected by this since caddy does not manage multi SAN certificates. Even if it did, Caddy will immediately replace a certificate when it sees a Revoked OCSP response. So, if you're using Cad
947.
by mholt 7y ago
> The next problem that people will run into is that because they can't reliably run multiple "things", they won't have a monitoring stack to tell them that certs aren't renewing. Can you elaborate on this? I&#
948.
by mholt 7y ago
> "What CA's does Caddy support?" From the site: "Any ACME-compatible CA can be used." Relevant config parameter: https://caddyserver.com/docs/json/apps/tls/automation/pol
949.
by mholt 7y ago
Your logic assumes that Caddy's auto-HTTPS cannot be configured and must be self-contained, but that's not accurate. Caddy can be configured with traditional, manually-managed (or externally-managed) TLS certificates just like o
950.
by mholt 7y ago
Er, sorry, I wasn't being condescending. I intended to clarify some relevant facts, please don't take it personally. You had said: > Go's memory safety isn't some kind of automatic security guarantee... But in some ca
951.
by mholt 7y ago
Caddy works with more than just Let's Encrypt though, and we'd like to avoid encouraging a monoculture of automated CAs (as much as I love Let's Encrypt). > That's clearly not always the case otherwise we wouldn'
952.
by mholt 7y ago
Caddy is not the only one, though. Traefik had the same problem: https://github.com/containous/traefik/issues/791 So to say Caddy is "the one" that had that issue is a mis-characterization. See also
953.
by mholt 7y ago
Go does bounds checking and doesn't have dangling pointers, so it's inherently safe from buffer overflows. You don't have to run Caddy as root in production, even to bind to low ports. (None of my sites do.) https:/&#x2
954.
by mholt 7y ago
> An edge web server should carry no knowledge of a concept of a cluster. Caddy doesn't. That's what's so interesting! > It should simply be able to ask something for a cert. It does. > I suggest the following path:
955.
by mholt 7y ago
It's because most people go to our website already knowing they need to use Let's Encrypt, and they've found it by searching for a server that works with Let's Encrypt. Hence, we don't make that detail our front-and
956.
by mholt 7y ago
It's Let's Encrypt. :) https://caddyserver.com/docs/automatic-https
957.
by mholt 7y ago
Oh I understand that, believe me. That's an operational reason, though, and not as much a technical one. By the way, Caddy CAN store certs in a database accessed by multiple servers. It coordinates cert management when configured as a
958.
by mholt 7y ago
That was 3 years ago when ACME was still a new and unstandardized protocol. That was one of the worst days of my life, trying to fix that while finishing my NIPS paper. If you read the issue you'll see that we fixed that and learned fr
959.
by mholt 7y ago
Nope, Caddy issues certs in the background and will retry with exponential backoff for up to 30 days. It reverts to the staging endpoint during retries so it doesn't count against your rate limits. It also has internal throttling to al
960.
by mholt 7y ago
A quick perusal of the Let's Encrypt forums will reveal a few issues. For one, it's easy to misconfigure. There's a lot of surface area it has to cover in the web server and there's a lot that can go wrong. It can also b

More ›