prdonahue

20 ms·

241.
by prdonahue 11y ago
Not even sure where to start on this comment, but I'll try: > In a startup, the whole endeavor rides on secrets. ... In a large company, execution dominates. Have you ever worked for a startup? Most likely at least 10 other companie
242.
by prdonahue 11y ago
Don't have time to go through the docs just yet, but great to see mentions of cashless exercise included. A more generous post-termination exercise window would have been a nicer default, but I get that's still the norm in many YC
243.
by prdonahue 11y ago
Random question unrelated to article content: is it just me or does Lithub seem to be everywhere (on HN) as of very recently?
244.
by prdonahue 11y ago
I'm the person designing this UX and yes, we plan to make quite clear/explicit the option of putting your private key in China. By default, keys will remain outside the country. Re your comments on user education: if you'd
245.
by prdonahue 11y ago
Wait, people still use SourceForge?
246.
by prdonahue 11y ago
It's very rare that they patch SChannel outside of just shipping newer versions in subsequent Windows releases. Too many things that can go wrong (see the prior update where they broke something and had to pull back/re-patch).
247.
by prdonahue 11y ago
Depends on which Microsoft OS and user agent. If, e.g., you're using an unpatched Windows 8.1 with IE11, you'll still be able to connect initially but will get disconnected the first time the key is rotated (max of 1 hour). Upon d
248.
by prdonahue 11y ago
Does anyone else know who rotates their session ticket keys? I'm aware of Twitter (jsha's post here: https://blog.twitter.com/2013/forward-secrecy-at-twitter-0 ), but not really any others..
249.
Ask HN: Examples of good project structure for non-trivial Python RESTful APIs?
3 points by prdonahue 11y ago|1 comments
250.
by prdonahue 11y ago
At least until TLS 1.3.
251.
by prdonahue 11y ago
Not to mention the fact that they're probably installing their own root certs on the endpoints and then just MITM'ing everything with their own certs.
252.
Ask HN: Would you use login notifications (different IP/location) as a service?
3 points by prdonahue 11y ago|2 comments
253.
by prdonahue 11y ago
Umm, you know how short sales work right? You're borrowing shares to sell them at current prices and then have to return the shares later. If the price rises, you are out the difference between what you sold at and what you repurchas
254.
by prdonahue 11y ago
Were you told why they were removed from the front page? That's more interesting to me/the community than the fact he reinstated.
255.
by prdonahue 11y ago
Unfortunately, the browser does not "know it". This is IE6 on Windows XP SP2. That browser is quite old and wasn't build with SHA-2 support, hence the inability to validate the certificate presented by Google.
256.
by prdonahue 11y ago
How do you define "extremely expensive"? CloudFlare's Business Plan ($200/mo) includes advanced DDoS mitigation: https://www.cloudflare.com/ddos/ . Also, due to caching of assets in PoPs close to end
257.
by prdonahue 11y ago
See my point below about ALPN. You need to advertise support for HTTP/2 in the TLS ClientHello and this logic is contained (on a Microsoft platform) in schannel.dll. Microsoft first added ALPN to SChannel in 8.1 and RARELY updates this
258.
by prdonahue 11y ago
Nor do they like updating schannel.dll (the underling SSL/TLS stack) unless there's an extremely serious vulnerability in it. And even then, they bungle it more often than not ( http://www.infoworld.com/article&#x2F
259.
by prdonahue 11y ago
That listed was originally created based on minimum requirements for SNI. I've gone through recently and documented where versions need to be adjusted "up" based on requirement for ECDSA support. These changes will be posted
260.
by prdonahue 11y ago
You can use a Page Rule to override this host header with whatever you like: https://support.cloudflare.com/hc/en-us/articles/206652947-U... .
261.
by prdonahue 11y ago
There's nothing "paid" about specifying how we connect to your origin (i.e., with HTTPS or HTTP). This setting is available to all plans, free or otherwise. During onboarding we attempt to establish a connection to your origi
262.
by prdonahue 11y ago
While we often make announcements there, Twitter isn't an official support channel. Requests should be filed at https://support.cloudflare.com where they can be tracked and responded to directly.
263.
by prdonahue 11y ago
"Several hundred other domains" is factually inaccurate. At most, there are ~40 other zones on the certificate (typically, far fewer). The challenge here is IPv4 address space; we don't require SNI for paid plans -- cert will
264.
by prdonahue 11y ago
This is a relic of the CA/B Forum ( https://cabforum.org/ ) delegating review of brand/trademark checks to the CAs. We (CloudFlare) send hostnames to the CA for issuance and they check against internal lists, holdin
265.
by prdonahue 11y ago
Unfortunately, the CAs have their policies and we must adhere to those. We're working, however, on ways to better (and automatically) communicate with them when we encounter false positives. In this particular case, yes, some have very
266.
by prdonahue 11y ago
"After some rather unpleasant experiences with angular.js we ended up rewriting the entire UI in ClojureScript / Om." What specifically did you not like about AngularJS? And which version did you use?