Viewing profile — agwa

What's particularly crazy about this interchange is that there is going to be a second, elevated peanut roundabout that's rotated 90 degrees, for buses to use: https://blogger.goog…

You would think so, but even an authentication company screwed it up: https://cybercx.co.nz/blog/json-web-token-validation-bypass-...

The cost is the vigilance required to use them safely. It's not just compute/storage costs.

Fair enough, but those optimizations are basically free. People think stateless tokens are free but they really are not.

As someone who operates a PostgreSQL database containing 27 billion SSL certificates, each 1-2kb each, with a bunch of secondary indexes that get inserted in random order, I find i…

Aw, thanks :-)

The blog post provides a certificate chain that validates in OpenSSL but not in Go. The reason it doesn't validate in Go is that the Subject field in the CA certificate uses a diff…

The following go flags let you build statically-linked cgo binaries, provided that all the C libraries that you're using support static linking and don't call the NSS functions in …

I think that on Unixes without overcommit, people allocate massive amounts of swap so that fork never fails.

Yeah, I agree. No criticism of Go's behavior is intended; just pointing out that the RFC is technically dead.

That RFC is obsoleted by https://datatracker.ietf.org/doc/html/rfc9844 which removes all guidance around URIs: > This document completely obsoletes [RFC6874], which implementors of…

The downside is that to get the size optimization, TLS servers will get moderately more complicated (they'll need to have multiple MTC certificates configured and select the right …

You'll be able to immediately use use a "standalone certificate" while waiting for the batch to be created. The tradeoff is that the standalone certificate will have multiple huge …

Right, I read all that and I didn't see anything to indicate that AI is being used to write code - just one person's unsubstantiated claim.

Where do you see that about Postfix? I followed the links and the only thing I see is that AI is being used to find bugs, not write code.

Those changes were passed during the first Trump administration by a Republican congress, though they didn't go into effect until Biden was in office. https://kpmg.com/kpmg-us/cont…

If you want your dev environment to be as similar to prod as possible, and you use a proxy in prod, then you should use a proxy in dev also. I was presenting a solution to someone …

Do be aware that CGI, unlike FastCGI, has a pretty big footgun due to the use of environment variables to convey HTTP headers: https://httpoxy.org/ Go's CGI server implementation d…

Please see the section about untrusted headers - this is not fixed by HTTP/2. You're right that being able to point your browser right at the app is very convenient. With Go, you c…

Putting security-critical logic in proxies is a violation of the End-to-End Principle, not an example of it. That doesn't mean it's a bad thing; as ragall notes, the End-to-End Pri…

Go's embedded HTTP server can handle it just fine: https://blog.gopheracademy.com/advent-2016/exposing-go-on-th...

That is way! Unfortunately, sometimes you have to do path-based routing to different backends, and now you're back to needing a proxy between your clients and your applications.

What you're looking for is mod_proxy_fcgi, not FPM. It's included in Fedora's httpd-core package; I don't know about RHEL: https://packages.fedoraproject.org/pkgs/httpd/httpd-core/…

I'll note that while X.509 certificates are deployed widely on the Internet, they are not deployed in the manner the ITU intended. There is no global X.500 directory and Distinguis…