isaack

I always find this to be handy: https://learnxinyminutes.com/

It is useful as a cheat sheet.

In addition: if you have experience in multiple "imperative" language (read: non-functional / non-prolog / etc) it's easy to pick up another language using that site alone.

Non-paywall version: https://outline.com/c789vA

iOS supports DoH/DoT natively via work profile. Create one yourself here: https://dns.notjakob.com

Add (2021) to the title?

Have you looked into https://github.com/slackhq/nebula? It uses X509 cert for auth.

Although for my home lab, using X509 is more of a minus than a plus due to complexity involved.

There's a similar site that shows towers and coverage around the world! And everyone can contribute data too! Sadly you can only contribute on Android but not iOS.

http://www.cellmapper.net/

Yes, but if you goal is to hide your identity, this really wouldn't work. Everything is still tagged to your identity, i.e. @mydomain.com.

CloudFlare had a much more elegant solution: the Alt-Svc HTTP header [1]. It is entirely transparent to the user. Security is guaranteed because it uses the original SSL/TLS certificate for exchange (that is, on top of the usual safety guarantees provided by a Tor hidden service).

Sadly they stopped doing that a while ago [2]. If anyone has insider knowledge about the reason behind, I would be really interested to hear about it.

[1] https://blog.cloudflare.com/cloudflare-onion-service/

[2] https://community.cloudflare.com/t/tor-alt-svc-header-not-be...

How about 802.1x? It's still safe and I can do many fancy networking tricks (VLAN, etc) with it. But it's not compatible with a lot of "IOT" stuff including Chromecast.

I don't think Tailscale's use of 100.x.x.x address space conforms with the RFC, but I don't think that there are any better alternatives out there. Do note though, once people start abusing the 100.x.x.x space, it will become "just another private IP space" and lost its significance:

RFC6598 requires that, when used as a routable address, the device must be able to do address translation across router interfaces when the addresses are identical on two different interfaces.

[1] https://tools.ietf.org/html/rfc6598#section-4

@Jorge - is there a way for me to build "relays" out of ESP32/RPi Zero?

@HN Crowd - is there something I could do to prepare for possible censorship? I was thinking of mesh Internet over the air, something like DN42 but over wireless links

As a Hongkonger, can I ask what's the best technology for:

1. Censorship-resistant chat: Something DHT-based preferrably, I am looking at Status.im right now

2. Mesh Internet over the air, something like DN42 but over wireless links

Cathay Pacific CEO stepped down after China’s civil aviation regulator issued a major safety risk warning to Cathay and set out a list of demands, including giving full information on crew flying into its airspace [1]. The news is first reported by China's state-owned CCTV [2].

[1] https://www.scmp.com/news/hong-kong/transport/article/302312...

[2] https://www.bloomberg.com/news/articles/2019-08-16/cathay-pa...

Does anyone have experience with getting their paid G Suite account locked? If paying them means that I can un-suspend my Google Account easily, I would be more than happy to shell out $5/month just for that privilege.

I have always wanted to create a Slack alternative that is built upon email. Everything happens on emails (and hidden headers), standards-compliant since day 1 and low barrier to use.

A carrier deploying NAT might not be using CGNAT, and hence, in compliance with the spec, decide not to use the 100.64/16 space.

One requirement of CGNAT, for instance, requires that the carrier's router be able to handle "address crashes". [1]

[1] https://tools.ietf.org/html/rfc6598#section-4

You need to turn off CloudFlare proxying for your domain. Instructions here: [1]. (Can't find an official help page, sorry).

Also make sure that you are using a CNAME record pointing to `YOUR-USERNAME.github.io.`.

[1] https://webmasters.stackexchange.com/a/71922

[2] https://help.github.com/articles/setting-up-a-www-subdomain/

For people on the "hipster" train of SPA/JWT etc, I found OpenID Connect (not the original OpenID) incredibly useful. With a simple JS library [1] you can ask your users to log in with Google, Microsoft, etc, and you can then validate the JWT tokens issued on the server-side.

[1] https://adodson.com/hello.js/

If I were the hacker:

1. I would get a proper SSL cert signed

2. Only hijack one of the ranges, and do not respond to other domains (causing SERVFAIL), so other domains will resolve unaffected, instead of causing a scene (see: https://www.reddit.com/r/sysadmin/comments/8ejrkk/google_dns...)

Taken down now

Backup 1: http://archive.is/WnwiB

Backup 2: http://webcache.googleusercontent.com/search?q=cache%3Ahttp%...

You should thank HDMI CEC [1] for that.

[1] https://support.google.com/chromecast/answer/7199917

Seconded.

They run their own TLD's .design, .ink and .wiki [1] so these guys really know their stuff. Support is not 24/7, but usual office hours, but those who pick up your phone/email REALLY know what they are talking. Plus really cheap domains, they mentioned somewhere that they are aiming for $1 mark-up for all TLD's.

[1] http://toplevel.design/

I wonder if this is related to Symantec's Encryption Everywhere program[1]?

[1] https://www.symantec.com/about/newsroom/press-releases/2016/...

Just signed up. Cert is valid for 12 months and is chained from DigiCert's CA -- same as their website

I noticed that Ubuntu only gave the patch for this vulnerability a "low" priority[1]. Furthermore, they state that "The default compiler options for affected releases should reduce the vulnerability to a denial of service". Can someone enlighten me 1) What was the compiler flags used to harden this flaw? 2) Was the same compiler flags used to compile Debian packages?

Thanks,

[1] https://launchpad.net/ubuntu/trusty/+source/apt/1.0.1ubuntu2... [2] http://www.ubuntu.com/usn/usn-2353-1/ [3] http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20...

Safari 7 has WebGL but is disabled by default. Enable developer menus, then click on "Enable WebGL".

It may not be a good idea to measure DDoS merely based on the volume. For example, a 100Gbps L7 attack is much harder to mitigate than a 100Gbps L3 attack. [1] Also, some had previously questioned the accuracy of CloudFlare's figures. [2]

[1] https://blogs.akamai.com/2013/03/how-big-is-300-gbps-really.... [2] http://www.techweekeurope.co.uk/news/prolexic-ceo-scott-hamm...