HN user

captncraig

252 karma
Posts1
Comments68
View on HN

This would be great. Then we could reliably use something like vault to store secrets with individual acls per-workflow, and have reasonable confidence that only that single workflow can access them.

While the current administration is turning a blind eye and I wish they wouldn't, the Russian connection here was only discovered after many layers of digging, and is still just conjecture.

After a few more iterations, they will learn how to close the gaps and be more and more untraceable. I don't know how it is possible to combat that.

Kinda frustrating having certs revoked when there have never been CAA records for any names involved. I know they can't know that to be true historically, but I wish they could do some additional filtering.

Security is about being paranoid in imagining what different actors can do with varying levels of access. In this case, MITM is not always easy, but once they have access they can do bad stuff. As a webmaster, an attacker with this access can break your site by messing with your users.

By taking the simple step of using https, you can successfully reduce your attack surface and increase the difficulty of messing with your site.

That makes sense. I wonder if any web servers have smarter decision making for that. Like give a hard 301 to modern browsers, but let older or nonstandard clients get a standard http response.

It is interesting that the main argument against staying http is one of social responsibility. Your static site isn't any more susceptible to attacks with http only, but your users are. A bunch of MITM techniques are thwarted by only visiting https sites. Is that your problem as a webmaster? Since LE, I have taken up the position that it is easy, and I prefer https sites as a user, so I really don't have a good reason not to enable https.

Also, an attack on my end users is an attack on my site. Anytime someone wants to see my content and gets something else, that is bad. If I can significantly raise the difficulty of doing that, why wouldn't I?

This is a big problem for me. I will buy novelty domains on sale, then abandon them after a year because the renewal price is so much higher than the 1st year promotion. At least com and net are fairly consistent year to year.

If you do that, you quickly run into the feasible depth limit for what you can show in a fixed space. Especially for sparse trees. Consider something like family trees, where you generally don't know anything about certain lines, but may have 20 generations or more on selected lines. No way could you show 2^20 nodes in a fixed format rendering, but you can make something kinda pretty by eliminating the empty space and organizing things to fill it intelligently.

A USB bootloader and a standard footprint with a line of addon shields. 10 years ago, the only choices I saw were to buy an uno or get a pic and somehow figure out how to program it with crazy dongles and things. It was an easy choice.

That is a really great idea. Every time this comes up it boils down to "phones are old and complicated, and there are a billion unique telcos". Great. But if I only do legit business over 3 of them, why not indicate if I am leaving the "trusted zone"?

Possibly privacy. If I host a copy of a popular site's Js, I can watch download patterns and have a pretty reliable "has this user logged into site X" detector.

This is orthogonal to data caps. We could debate separately if people should be allowed to have contracts with those limits, but the actual problem here is that the ISP is modifying the traffic I requested before they deliver it. In this case it was for data cap notices, but next time it might be for ads or malware or anything else they want to inject.

It seems to me that security at the venue is extremely inconsistent. They care enough about cheating to time-delay the stream (even to the announcers), but players are allowed to have phones and keys and things at the table? Maybe don't allow that?

I feel like I've seen some maps for past elections done hypothetically like this. I can't recall the conclusions though. I think the Senate situation still gives disproportionate power to small states in that model, even if it is slightly less dramatic than the winner take all in each state we have now.

Wouldn't part of this be solved by using a real domain that resolves to 127.0.0.1 instead of localhost? Then you can get a real cert and embed it in the client to make local requests work properly?