itintheory
Joined 4 years ago
Karma
245
Submissions
208
Member since
Mar 24
Recent submissions
Comment · 1 day ago
Where did you migrate to?
Comment · 3 days ago
> gmail inbox
Except it won't impact gmail unless you're accessing it through curl. The browsers already distrusted the compromised intermediates via CRL within hours of disclosure, and removed the affected root via update.
Comment · 3 days ago
I think "everything" is an overstatement. Browsers included the compromised intermediates in their CRLs within hours of disclosure.
So this isn't like Firesheep [0]. Yes, there would be vulnerable traffic, like the git client this thread is discusing, but it's not "everything"
Comment · 3 days ago
Why is the color of the access point relevant?
Comment · 4 days ago
> cyberprotection services
These services cost money. Scrapers also cost money in terms of resource utilization and downtime. There's always a tradeoff.
The ROI of services like Cloudflare bot protection, Datadome, HUMAN, AWS bot mitigation etc. is highly dependent on your income from the data. In the case of publicly hosted freely accessible data it can be hard to justify.
Comment · 4 days ago
Sure, that's why they sanitize the User-Ggent header when using these proxies. Good luck attributing the scraping to anyone at all.
Comment · 5 days ago
I miss BonziBuddy. He had personality in a way that our modern agents lack.
Comment · 7 days ago
Any recommendations? I'm finding a Lasko that looks fine but is out of stock everywhere.
Comment · 9 days ago
1. Yeah, that's true. It'd need to be something akin to SPF where it gets validated and kept up to date.
2. Yep, you're right. CAA isn't the correct record type.
3. I'd guess that in the vast majority of cases where a TLS cert is used, DNS is also in use. In the case of an offline validation, you're also not able to check CRL, OCSP, etc. so there are already tradeoffs there. Oh, wrt to "secure" - I guess that's the gotcha. DoH would be chicken-and-egg... something like DNSSEC would be needed, though that may be an impossible prerequisite.
Comment · 9 days ago
That makes sense. Seems like there could be a different record type, similar to SPF that could be used in this way though...
Comment · 10 days ago
> One big problem with the CA system is that any CA - even the most incompetent - can sign certificates for any domain.
Is this not what CAA records were intended to solve? It seems like in practice they're only used by CAs to decide if they can sign a cert for a given domain, but it seems like a client could use it to determine if a server cert was from the correct CA.
Comment · 11 days ago
It's worth noting that they also operate CERTInext which provides TLS and other certificate services in the US. In particular, CERTInext was chosen to be the CA for InCommon which means it's used by LOTS of universities all over the country. This was a migration from Sectigo that took place this year.
Comment · 18 days ago
I've met plenty of developers who seem to go too far in the other direction and spend all their time optimizing their tools, and not actually producing anything that anyone else cares about. Reminds me of https://xkcd.com/1205/
Comment · 18 days ago
Nest Hub was $99, and is now perpetually out of stock. AFAICT it's discontinued. Which is strange, and a shame, because it's a great product. People are paying similar prices for digital picture frames with a cloud service, which the nest hub can do with a little bit of config, and a bunch more.
Comment · 20 days ago
The entire premise of cloaks as optional seems like broken UX to me. I'd like to see a new version make your connections details private by default.