21–30 of 90 posts
Earlier quoted context omitted.
I thought this was fairly common?
It is and it's a best practice. I've never heard anyone complain about this. Most security scanning software will ding any site that doesn't use HSTS
> while curl is my hobby, I also work on curl as a full-time job. It is a business and I serve and communicate with many customers on a daily basis. While it's not my business, I still wonder how this business looks like. Is curl sponsored? If so, is this a common thing for foundational tools alike?
Off topic but I find it wild that SF has API ads on bus shelters. Is that unusual/right in a dev hotspot, or have I been well underestimating just how intrinsic the tech culture is there? (I’m an Australian, so I guess my question applies to the US as much as SF)
Off topic but I find it wild that SF has API ads on bus shelters. Is that unusual/right in a dev hotspot, or have I been well underestimating just how intrinsic the tech culture is there? (I’m an Australian, so I guess my question applies to the US as much as SF)
> https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobb... has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site. That's aggravating. What's the workaround? edit0: Chrome made more progress, then collided with Vodafone's shitty approximation to infrastructure which is known unsolvable. edit1: M…
> https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobb... has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site. That's aggravating. What's the workaround? edit0: Chrome made more progress, then collided with Vodafone's shitty approximation to infrastructure which is known unsolvable. edit1: M…
> That's aggravating. What's the workaround?
Are you aware that you’re possibly being impacted by some kind of MITM attack?
Earlier quoted context omitted.
It is and it's a best practice. I've never heard anyone complain about this. Most security scanning software will ding any site that doesn't use HSTS
You don't see why Firefox refusing to connect would be annoying? I don't care whether the blog about curl is encrypted in transit or not and I do care about a forced change to chrome to see the content.
Earlier quoted context omitted.
It is and it's a best practice. I've never heard anyone complain about this. Most security scanning software will ding any site that doesn't use HSTS
You don't see why Firefox refusing to connect would be annoying? I don't care whether the blog about curl is encrypted in transit or not and I do care about a forced change to chrome to see the content.
> I would personally perhaps protest against the use of PUT for POSTing JSON, but nobody asked me. Just wondering, if the resource ID is known, I thought PUT is the recommended method? We usually use POST for creating a new resource for which you don't know an ID yet.
Auth requests are for a new session ID, not a new user ID. It's a (C)reate in CRUD, not an (U)pdate. POST - Create, GET - Retrieve, PUT - Update, DELETE - Delete