Viewing profile — justin_oaks

When a company makes it impossible to correct their stupidity, it's a malicious act. The behavior speaks loud and clear: "We don't care what damage we do to developers or users. An…

That happened to me exactly once in my 20-year career. It was on a web server (maybe even NGINX) that had too many cached files. Even though it only happened once, I still set up m…

The list of API integrations provided by the lego project looks quite impressive. https://go-acme.github.io/lego/dns/index.html

Yes, I see that AWS Route53 can limit credential scope. That kind of thing helps a lot. I've never heard of that CNAME approach for changing the validation domain. That looks like …

Moving subdomains to separate zones can make sense for a small set of subdomains and all your certificates would be for names under those subdomains. It gets unwieldy if you have t…

That looks like a great solution. I'll probably make use of that as soon as it's available.

Ah, that's a clever mechanism. That way the secondary machine could not only keep the token secure, but also validate which DNS records to create.

Oh... that's fantastic! It specifically addresses my concerns about needing DNS credentials accessible to scripts. The article says it is for those who > prefer to keep DNS updates…

Some of this might have been "because I want to see if I can". Another reason is "It bothers me to keep seeing this browser tell me my connection is insecure". As for putting it on…

I read a lot about people running things like Caddy which will automatically retrieve Lets Encrypt certificates. And I think it makes sense for publicly accessible web sites since …

I agree that it's not a serious project, but I wouldn't call it a joke. Jokes are funny.

Without TLS, sometimes still referred to as SSL, a webite's content can be modified by anyone controlling the network path. This includes ISPs and WiFi operators. Sure, your websit…

This has been my experience as well. I implemented 2FA for my previous employer and we would have gladly skipped SMS 2FA if we could get away with it. It's more expensive for the c…

I implemented 2FA at a previous job and I was responsible for the production implementation working as expected. My thoughts were that uncompleted 2FA attempts are common for a num…

You may have to temper your expectations. Free usually means "sells/uses your data to offset costs". If you're OK with that, there's no need to switch off of GMail. If you're not O…

I wish consoles were like the Steam Deck: computers running a common OS that just so happen to be used for gaming.

Knowing that there are only 25 responses, it makes it all the more funny that rate limiting is mentioned. And you can host the service yourself! Hard pass. I'll read the 25 respons…

Once you remove the duplicates that are different only because of the typos in them, yes, that's correct.

The author doesn't seem to consider someone's desire to behave morally as an incentive. How odd.

Avoiding shame is an incentive. It boils down to: "Why are people violating these unenforced rules? Sure it benefits them, but don't they feel bad?"

Generally it isn't done because the people in power benefit from the status quo. To fix it, you need collective action. And now you have a collective action problem: https://en.wik…

Your comment could have been simplified to: "I don't like the syntax" And that could be optimized further by leaving no comment. All syntax is learned. None of it is "intuitive". A…

In my day we memorized IPs AND ports. 10.24.67.22:78342 was to access our bug tracker and 192.168.240.17:21282 was for our CVS repository! Seriously though, one of the first things…

I recommend using the .test TLD. * It's reserved so it's not going to be used on the public internet. * It is shorter than .local or .localhost. * On QWERTY keyboards "test" is eas…

I'd recommend using some other reserved IP address block like 169.254.0.0/16 or 100.64.0.0/16 and assigning it to your local loopback interface. (Nitpick: you can actually use all …