Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Caddy 2

caddyserver.com

Post reply on HN
Print view View original

161–170 of 247 posts

Re: Show HN: Caddy 2

#161

Post by mholt »

atonse wrote: post #157
mholt wrote: post #94

Earlier quoted context omitted.

Not a stupid question, it's not a phrase you hear very often because there isn't... really... one... at all. (Not in mainstream use AFAIK?) Memory safety is a class of guarantees certain software offers you against certain vulnerabilities. Software written in C is generally considered "memory unsafe" since it's hard to write correct C code when managing with memory, so it's easier to find exploits in them that cause…

But what is the value add for Caddy here? Like how the out of box and auto SSL defaults with HTTP. Apart from memory safety, can the SSH version of caddy impose better defaults that OpenSSH doesn’t right now? Maybe TLS certs, security key support, etc?

Absolutely. And Caddy adds its on-line config API and simpler configuration experience for an all-around more secure, easier-to-maintain, harder-to-get-wrong system.

Re: Show HN: Caddy 2

#162

Post by mholt »

bueny wrote: post #158
mholt wrote: post #65

Earlier quoted context omitted.

Is it too slow for you?

In comparison with other webservers it is slower. For me it's okay but metrics!

* Citation needed? (I mean, yes, of the thousands of dimensions of a web server, Caddy is not the fastest or leanest in all of them, but what's important to you?)

Counterpoints:

- https://twitter.com/mattiasgeniar/status/1249751608721911814

- https://twitter.com/JackEllis/status/1257396020662673414

Re: Show HN: Caddy 2

#163

Post by jamieweb »

nikisweeting wrote: post #36

YESSS so happy there's now an apt install method: echo "deb [trusted=yes] https://apt.fury.io/caddy/ /" | sudo tee -a /etc/apt/sources.list.d/caddy-fury.list apt update && apt install caddy

Be aware that the [trusted=yes] config disables GPG signature verification for the repository, which does slightly break the security model of Apt (where repositories can be untrusted/HTTP-only as long as all packages are signed by trusted keys).

Unless I'm mistaken, a malicious package with the same name as a critical system package could be added to that untrusted repository by an attacker who had compromised it, and if the version number is higher than that of the 'official' package and your Apt priority config prioritises it, your system would download and install it without any verification.

This is a fairly niche attack vector that may not be considered a significant risk in some environments, but it's one to consider when establishing your threat model and risk appetite.

As a side note, it's worth noting that GPG signing packages is not a silver bullet either, especially if the signing keys and administrative access to the repository fall within the same security boundary (e.g. developer doing both from their PC without any segregation/sandboxing). However, it has proven to be a robust method so far, and definitely beats explicit [trusted=yes].

Re: Show HN: Caddy 2

#164

Post by wingworks »

jbverschoor wrote: post #112
gnalck wrote: post #21

Earlier quoted context omitted.

Hey Matt - thanks for creating and maintaining Caddy all these years! Like others have said in this thread, it is so easy to set up and maintain that it really does feel like "magic". In terms of speeding up adoption of Caddy 2, it may be useful to have a list somewhere of the concrete improvements between the two (as I'm sure there are many). A (very) brief look and search around only yielded this article[1] which r…

Adoption for me would be to have an official apt repo :)

Pretty close to official. https://caddyserver.com/docs/install

Re: Show HN: Caddy 2

#165

Post by jbverschoor »

francislavoie wrote: post #135
jbverschoor wrote: post #133

Earlier quoted context omitted.

I swear I couldn't find that page... been looking for half an hour.

It's the second link in the top-left of the docs sidebar! I'm surprised you found that difficult to find.

Yeah guess I should go and sleep

Re: Show HN: Caddy 2

#166

Post by Silhouette »

mholt wrote: post #93
madmax108 wrote: post #91

I know that HN is usually the first to outrage when a project website is too verbose or does not explain the product, but I just want to take a moment to say WHAT A GREAT WEBSITE Caddy has! - The first screen tells me everything I need to know about what Caddy is and why it stands out - Scroll down on how to setup (hattip to whoever did the angled asciinema embed. Looks so cool) - Every page worth of scroll is exactl…

D'aww, thank you! I was really nervous to post this on HN because HN has also been the source of great misery for me in the past, frankly. But I'm relieved at the overall positivity today. Maybe because it's Star Wars Day we're all in a good mood? I'm glad you like the landing page. Took me a couple weeks of trying and throwing designs away, then a few days of concerted effort, just standing in front of my text edito…

You have a really impressive site about a really impressive product. Kudos.

The only constructive criticism I'd offer immediately for the new updates is that they look very light on detail about setting up a production deployment on different platforms -- things like running Caddy as a service that starts automatically, monitoring its health and restarting if necessary, ensuring that any important security updates are known about and installed, etc. It's great to have so much that "just works" and a simple developer experience demonstrated immediately, but the other stuff is still important too.

Edit: I see https://caddyserver.com/docs/install now talks about some of these issues for Caddy 2. In that case, perhaps it would be useful to add a prominent link there from the v2 page at https://caddyserver.com/v2? I was half-expecting the "Download" button to take me to such a page, and was very surprised to find myself sent to GitHub (particularly since there are neither instructions about downloading nor visible links to the assets to download actually visible on the GH page you arrive at).

Re: Show HN: Caddy 2

#167

Post by 627467 »

mholt wrote: post #14

Hi HN -- this is what I've been working on for the last 14 months, with the help of many contributors and the backing of several sponsors. (Thank You!) Caddy 2 is a fresh new server experience. Some things might take getting used to, like having every site served over HTTPS unless you specify http:// explicitly in your config. But in general, it will feel familiar to v1 in a lot of ways. If you've used v1 before, I r…

I started using caddy (v2) a couple of months ago. I'm no dev/admin type and it has been a godsend because it made so easy for me to secure my sites

Re: Show HN: Caddy 2

#169

Post by lenkite »

For all the criticism of golang, the fact that it can be used to craft superb software like this is a testament to its real-world efficacy.

Re: Show HN: Caddy 2

#170

Post by francislavoie »

jamieweb wrote: post #163
nikisweeting wrote: post #36

YESSS so happy there's now an apt install method: echo "deb [trusted=yes] https://apt.fury.io/caddy/ /" | sudo tee -a /etc/apt/sources.list.d/caddy-fury.list apt update && apt install caddy

Be aware that the [trusted=yes] config disables GPG signature verification for the repository, which does slightly break the security model of Apt (where repositories can be untrusted/HTTP-only as long as all packages are signed by trusted keys). Unless I'm mistaken, a malicious package with the same name as a critical system package could be added to that untrusted repository by an attacker who had compromised it, a…

Yeah, we're aware. Unfortunately Gemfury doesn't support GPG signing yet (see https://gemfury.com/help/apt-repository#apt-setup) but we will set that up as soon as they do. Their service made it the easiest to get set up on short notice.
Post reply on HN