HN user

kcen

53 karma
Posts5
Comments14
View on HN

One of the problems with forcing strictly disparate domain/service is that each one introduces its own security context and authZ handling. That's a lot of places for mistakes.

I learned about it from creack (lead contributor according to github) @ a startup meetup in SF.

Things that impressed me:

1. super passionate

2. he was very receptive and quick at squashing bugs I reported (real or not)

3. docker was super portable (the same across all linux distros)

4. they (the docker team) had real solutions for the long application deployment times that were plaguing me

Everyone seemed to know it would succeed, which is rare around here.

The primary downside to a small TTL is cost. For many DNS providers you are allotted a number of requests per month that DNS will resolve. On particularly popular websites having a ton of DNS requests can cause the cost of DNS services to inflate significantly.

It takes just as many people to fly a robo-F16 as it does to fly a manned F16. Only difference is that the pilot is on the ground instead of in the air.

Also the unmanned F16 provides 0 advantages over a purpose built UAV (plus is bigger, slower, and more expensive), I highly doubt anybody would seriously consider these for warfare applications.

It's cool tech, take it at face value.

Isn't that the point of OAuth? (versus HTTP basic auth)

Your secret key shouldn't be compromised, because you're supposed to keep that secret. Also if you use HTTPS for requests you'd still get a cert error even if DNS was routing incorrectly. You're probably fine.

The DNS was not exactly hijacked, there were issues inside of LinkedIn's top level DNS provider whom were delegating www.linkedin.com authorization to unauthorized nameservers, namely NS[SOMETHING].ztomy.com. The ztomy DNS replaces its delegated domains to point to a domain parking page if there is no record exiting. These changes were then propagated to other nameservers and thus to the end user. End result, dns doesn't point where you think it does.

We got hacked 13 years ago

That way you can safely put your public key on all of your application servers so that any node can write data, but only allowed nodes can read.