221–230 of 378 posts
Earlier quoted context omitted.
trust me, it's on the backlog to fix.
Is everything on the backlog? Still not supporting long DKIM keys. Still using deprecated and discouraged SMS as 2factor. Are your margins really that thin? It's been years :(
Check out this older thread from 2014: https://news.ycombinator.com/item?id=8254757
"We're rolling out Google Authenticator support sometime in the fall." What happened? :(
I want to clarify some details on how the Early Access Program (EAP) works because I'm seeing some confusion here in the comments. EAP is a 7-day period in advance of General Availability (GA) during which domains can be registered immediately (not pre-ordered). EAP is a descending price ("Dutch") auction, meaning that prices start off high and then decrease as the auction goes on. The reason for this is to efficient…
Both pricing mechanisms are great at: (a) transferring wealth from the secondary market to registrars, and (b) guaranteeing that desirable domain names get allocated purely on economic value terms, thus effectively shutting out non-profit-oriented enterprises from the best domain names. If someone with some quirky desire to name a domain name after their cat would like to grab the domain name and refuse to sell, this…
Why can't they add a new URL scheme "secure://" to Chrome that will only support HTTPS? Adding a new scheme would support all existing https websites on the internet today with no need to pay anyone money or rush to reserve domains. This .app thing is needlessly difficult, and just a way for Google to push its brand on technology concepts en-masse, like the .dev fiasco. Now everyone in the world has to register a new…
Moves like this intrigue me. On the one hand, I support creating new platforms with security built-in by default, but on the flip side, the Chrome team just axed HPKP without even so much as bothering to try to refine it to mitigate the footguns. I don't understand how the web-facing security decisions at Google are made. :/
There are motivating reasons for that[0]. The Expect-CT header is its replacement, and is getting picked up by recent versions of Chrome. [0]: https://scotthelme.co.uk/im-giving-up-on-hpkp/
I'm still disappointed. I don't feel expect-ct effectively covers the same use cases.
If it’s not clear from the article, HTTPS is required for all .app domains, which Google accomplished by adding the .app TLD to the default chrome HSTS preload list. Interestingly that will only ensure HTTPS only when using a browser with HSTS enabled with a preload list that includes the .app TLD. Therefore non-web code, or code in browsers without the TLD in the HSTS preload list, will be able to make HTTP requests…
> It does seem like a positive step, but to be honest the solution seems a bit clumsy and ineffective, closer to security theater than actual security. On it's own I could see the argument for it being more security theater, but if I had an app on the ".app" TLD I can now stop listening on port 80 altogether without as much worry that I'm breaking stuff. That's a real security improvement. .app will be HTTPS only fro…
Except the part where the `.app` domain is only "https-only" in Chrome.
Earlier quoted context omitted.
To be blunt, this is a horrible roll-out by Google. It is a perfect example of the right hand not talking to the left hand, or the rest of the body for that matter. Several significant issues: 1) The announcement is made by Google, yet Google is not accepting EAP registrations. Very confusing. 2) The registrars accepting EAP are not as widely known as you would expect for something like this, meaning that I am going…
The right hand cannot talk to the left hand in this case, however. It's a complicated space to operate in. Start here if you're a policy wonk: https://archive.icann.org/en/topics/new-gtlds/gac-board-regi... Whether registrars support EAP, and how they implement it, is entirely up to each registrar. If you have complaints about any specific registrar practices, or about registrars not supporting it full stop, then tho…
Just for fun, I tried these domain names via the url get.app: apple.app facebook.app instagram.app twitter.app ycombinator.app * snapchat.app * producthunt.app * whatsapp.app amazon.app microsoft.app google.app hotmail.app * dropbox.app intercom.app * pivotal.app * tesla.app dell.app ibm.app * * AVAILABLE