71–80 of 522 posts
> 429 Too Many Requests Aight, level with me: Is every mastodon server running on a Raspberry Pi?
my profile, on the same server, loads fine.
> 429 Too Many Requests Aight, level with me: Is every mastodon server running on a Raspberry Pi?
This is a terrible implementation of domain verification. dns-01 and http-01 are more or less standardized at this point. Use them, and don't roll your own. Reference: https://letsencrypt.org/docs/challenge-types/ .
I don't get http-based verification in general. If you want to really prove someone owns a domain, make them change an authoritative DNS record. Everything else feels like it is begging for edge cases to crop up. Why should my social media or SSL certificate vendor care about my web servers?
In contrast, HTTP based verification often has built-in support with your webserver (Caddy) or only requires copy-pasting a few lines to your docker compose file.
There are edge cases, but they're also widely exploited so you won't run into them if you follow best practices.
Earlier quoted context omitted.
Dunno. That’s such a fundamental piece of thinking you just have to come across in the design phase, I don’t know how you would build a beta that didn’t avoid the issue in the first place unless you had a flawed take on security in the first place.
It is surely easy to cast stones at a single bug, but I don't think that's the right way to look at things.
I have written atrocious bugs over the years, so I’m definitely not in the stone casting business here. However, I can’t see this as simply a bug, rather than a fundamental design flaw. And if an entity is both becoming infamous for reinventing the wheel, and attempting to fill a sensitive niche, I feel it has somewhat of an obligation to accept criticism such as that.
Earlier quoted context omitted.
FWIW it seemed obvious to me. I think a minority of people who play in this space can’t conceptualize others’ understandable ignorance of the norms and axioms. https://xkcd.com/2501/
You got all that from a "429 Too Many Requests". That's an impressive level of deduction Holmes!
For those not getting the context(like me), this seems to be about the Bluesky Social( https://bsky.app/ ), a twitter alternative.
This is a terrible implementation of domain verification. dns-01 and http-01 are more or less standardized at this point. Use them, and don't roll your own. Reference: https://letsencrypt.org/docs/challenge-types/ .
I don't get http-based verification in general. If you want to really prove someone owns a domain, make them change an authoritative DNS record. Everything else feels like it is begging for edge cases to crop up. Why should my social media or SSL certificate vendor care about my web servers?
Earlier quoted context omitted.
It's ridiculous that this is not in the title.
FWIW it seemed obvious to me. I think a minority of people who play in this space can’t conceptualize others’ understandable ignorance of the norms and axioms. https://xkcd.com/2501/
*Edit: typo
Earlier quoted context omitted.
I don't get http-based verification in general. If you want to really prove someone owns a domain, make them change an authoritative DNS record. Everything else feels like it is begging for edge cases to crop up. Why should my social media or SSL certificate vendor care about my web servers?
Convenience. DNS is routinely not automatable by API, or inconvenient to automate. HTTP, however, is normally easy to work with.
for 99.99% of cases when a domain is pointed at me and I want to serve an SSL certificate for it, I can answer an HTTP-01 challenge. Needing to orchestrate a DNS challenge will always be a more complicated external thing.
HTTP challenge (and TLS-ALPN) are in-band, DNS is out-of-band.
