Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Caddy – The HTTP/2 Web Server with Automatic HTTPS

caddyserver.com

Post reply on HN
Print view View original

61–66 of 66 posts

Re: Caddy – The HTTP/2 Web Server with Automatic HTTPS

#61

Post by piaste »

jimktrains2 wrote: post #48
piaste wrote: post #35

Earlier quoted context omitted.

You make it sound like the Caddy folks completely ignored the issue without providing a reason ("absolutely no reason", "doesn't even consider"). After looking into it, I find your post misleading and unfair, to say the least . Link to the issue for other users who, like me, were concerned by your post: https://github.com/mholt/caddy/issues/1632 According to the author, the issue is that (a) there are two RFCs that c…

I don't see two conflicting rfcs. Can you point them out? I saw a link to a Mozilla thread discussing how they should do normalization, but nothing about not supporting the fully qualified format. Cross origin rules don't apply for looking up a virtual host. Also, the concerns over security the caddy developer make aren't clarified and probably don't exist. No dot has 2 possible meanins and with dot has one _to the r…

> I don't see two conflicting rfcs. Can you point them out?

The quote is:

"RFC 1034 says the two domains are the same, but RFC 3986 says they are not. I can't tell from the http spec whether the two Host values are equivalent or not."

Re: Caddy – The HTTP/2 Web Server with Automatic HTTPS

#62

Post by [deleted] »

piaste wrote: post #61
jimktrains2 wrote: post #48

Earlier quoted context omitted.

I don't see two conflicting rfcs. Can you point them out? I saw a link to a Mozilla thread discussing how they should do normalization, but nothing about not supporting the fully qualified format. Cross origin rules don't apply for looking up a virtual host. Also, the concerns over security the caddy developer make aren't clarified and probably don't exist. No dot has 2 possible meanins and with dot has one _to the r…

> I don't see two conflicting rfcs. Can you point them out? The quote is: "RFC 1034 says the two domains are the same, but RFC 3986 says they are not. I can't tell from the http spec whether the two Host values are equivalent or not."

[deleted]

Re: Caddy – The HTTP/2 Web Server with Automatic HTTPS

#63

Post by kuschku »

piaste wrote: post #61
jimktrains2 wrote: post #48

Earlier quoted context omitted.

I don't see two conflicting rfcs. Can you point them out? I saw a link to a Mozilla thread discussing how they should do normalization, but nothing about not supporting the fully qualified format. Cross origin rules don't apply for looking up a virtual host. Also, the concerns over security the caddy developer make aren't clarified and probably don't exist. No dot has 2 possible meanins and with dot has one _to the r…

> I don't see two conflicting rfcs. Can you point them out? The quote is: "RFC 1034 says the two domains are the same, but RFC 3986 says they are not. I can't tell from the http spec whether the two Host values are equivalent or not."

RFC 3986 is absolutely useless for this task, because no one uses it for this, and it considers things inequal that every browser considers equal.

Besides, it was deprecated by the WHATWG URL spec anyway, which does use the same equality rules as RFC 1034 (after normalization)

Re: Caddy – The HTTP/2 Web Server with Automatic HTTPS

#64

Post by jstanley »

bfred_it wrote: post #27
jstanley wrote: post #5

They make it quite hard to find out, but here it is: > Caddy obtains certificates for you automatically using Let's Encrypt. Not sure why that is not stated front and centre. It's a good idea.

That’s literally the first selling point in 128px font. [1] It might not mention the implementation details but the concept is what matters. [1] https://i.imgur.com/hdEaKpG.jpg

No, it's not. It doesn't explain how it works, which makes it come across as an empty marketing promise.

Re: Caddy – The HTTP/2 Web Server with Automatic HTTPS

#65

Post by jstanley »

wccrawford wrote: post #42
mfontani wrote: post #33

Earlier quoted context omitted.

Only if you're not using it for commercial stuff. If you're using it for commercial stuff you have to pay the $25/month

My understanding of their license page is different. "If your company uses official Caddy binaries internally, in production, or distributes Caddy, a commercial license is required." "If I build Caddy from source, which license applies?" "The source code is Apache 2.0 licensed." https://caddyserver.com/products/licenses

Would be interested to see how reproducible builds would interact in such a situation.

I.e. you get a byte-identical binary file if you build it yourself, but you don't have to pay the $25/mo. Even though you end up at exactly the same place.

Something like http://ansuz.sooke.bc.ca/entry/23 "What colour are your bits?" I suppose.

Re: Caddy – The HTTP/2 Web Server with Automatic HTTPS

#66

Post by jimktrains2 »

piaste wrote: post #61
jimktrains2 wrote: post #48

Earlier quoted context omitted.

I don't see two conflicting rfcs. Can you point them out? I saw a link to a Mozilla thread discussing how they should do normalization, but nothing about not supporting the fully qualified format. Cross origin rules don't apply for looking up a virtual host. Also, the concerns over security the caddy developer make aren't clarified and probably don't exist. No dot has 2 possible meanins and with dot has one _to the r…

> I don't see two conflicting rfcs. Can you point them out? The quote is: "RFC 1034 says the two domains are the same, but RFC 3986 says they are not. I can't tell from the http spec whether the two Host values are equivalent or not."

From rfc 3986:

> The rightmost domain label of a fully qualified domain name in DNS may be followed by a single "." and should be if it is necessary to distinguish between the complete domain name and some local domain.

When there is no ambiguity then they mean the same thing.

Anyway, as a sibling comment said, it's not a good rfc to use for this purpose.

Post reply on HN