Ayesh

10 ms·

1.
by Ayesh 14d ago
Such an excellently written articles with really nice interactive visualizations!
2.
by Ayesh 1mo ago
If a registrar requires you to use their own nameservers, then they are no longer comparable to other registries.
3.
by Ayesh 4mo ago
PHP has quite a lot of oddities such as how loose comparisons (`==`) are made, numeric-strings, and type coercion. But the two oddities mentioned in the article are not that "odd" with a bit of context. - PHP has `SplFixedArray`[^
4.
by Ayesh 7mo ago
I think the previous post is talking about a search that will find the sibling domain names that have obtained certificates with the same account ID. That is a strong indication that those domains are in the same certificate renewal pipelin
5.
by Ayesh 7mo ago
I'm surprised the ballot passed, unanimously even! I get that storing the DNS credentials in the certificate renewal pipeline is risky, but many DNS providers have granular API access controls, so it is already possible to limit the su
6.
by Ayesh 7mo ago
Yes, and it's not that long ago, or I aged really quickly. For code signing certificates and EV certificates, (and OV certificates, if they are even alive), this is still the case.
7.
by Ayesh 7mo ago
LetsEncrypt doesn't see your private key when you obtain the certificate. So no, it's not _really_ a juicy target.
8.
by Ayesh 8mo ago
If you update via Winget, you are probably safe. Winget downloads the installer from GitHub: https://github.com/microsoft/winget-pkgs/blob/master/manifes...
9.
by Ayesh 9mo ago
Microsoft had a very fair shot at redeeming themselves, but with how Teams, GitHub and all the AI crap they push into GitHub and Windows, it's clear they have not changed one bit.
10.
by Ayesh 9mo ago
I know that HN replies must carry some substance, unlike majority of Reddit comments. But I wanted to say that this comment read line a poem to me.
11.
by Ayesh 9mo ago
Local meetups are very easy to get selected into, and they often have two or three speakers lined up, with a balance of speakers they know and are experienced, and new speakers. Most of the time, the organizers are squeezed to find a speake
12.
by Ayesh 9mo ago
I imagine it'll go against your talk getting into the shortlist. But there are some conferences that ask and respect your preference whether you'd like the video recording to have your face or just the audio. But I have yet to see
13.
by Ayesh 9mo ago
To prove a very important point, that EV certificates are broken, someone obtained a "Stripe Inc." EV certificate by registering a company in a different state. https://arstechnica.com/information-technology/2
14.
by Ayesh 9mo ago
Considering how many ACME clients are available today with all sorts of convenient features, and that many web servers nowadays have ACME support built in (Caddy, Apache mod_md, and recent Nginx), I believe that people who don't automa
15.
by Ayesh 9mo ago
https://github.com/letsencrypt/boulder You can find a docker-compose.yml file to get some idea. Appears to be using MariaDB. They shut down OCSP responders and expiry email reminders, so there really is no need to have
16.
by Ayesh 9mo ago
As someone else mentioned, it's a non-profit, so I guess it's not technically possible to get acquired. But I personally believe that the people behind LetsEncrypt genuinely care about the mission and will never sell out for their
17.
by Ayesh 9mo ago
It's been a long time so this is my fading memory, but CAs used to generate a private key on their end and let you download both private key and the certificate containing the public key. The non-technical person who paid big money for
18.
by Ayesh 10mo ago
This must be how winning in life feels like. I wish your family good health.
19.
by Ayesh 10mo ago
the MySQL extension was dropped in PHP 7.0.
20.
by Ayesh 10mo ago
iOS shoots HEIF natively I think. Raw photos probably are shot in DNG. DNG "images" are popular for raw images because theyb can be losslessly converted from to the camera raw formats like the Nikon's, and DNG is open source
21.
by Ayesh 10mo ago
Thank you. The linked third party article is a terrible incomplete rehash.
22.
by Ayesh 11mo ago
Canonical URLs come to the rescue.
23.
by Ayesh 11mo ago
> Everything after the '?' character. It only strips known tracking parameters b(like those utm_ query params). It does not remove all parameters; if that's the case, YouTube video links will stop working.
24.
by Ayesh 11mo ago
It's a typical pattern in, say react, to have just this scaffolding in the HTML and let some frond end framework to build the UI.
25.
by Ayesh 11mo ago
Yes, I'm just as curious as you on _why_ does a staging setup needs the same amount of resources as prod. All of my staging setups are on a ~$15 Hetzner server, with a GitHub Action to `docker compose build && docker compose up
26.
by Ayesh 1y ago
It's not better. Short lived certificates are definitely the better way forward. 24 hour certificates will add a significantly more load on CAs, a lot more than maintaining an OCSP responder.
27.
by Ayesh 1y ago
If the certificate was issued with must-staple flag, then the server can refuse to connect if the handshake did not include an OCSP response. web servers can refresh OCSP responses in the background and cache valid responses to add some tol
28.
by Ayesh 1y ago
I don't think so. - Let's Encrypt: doesn't support it since May 7 this year - Buy Pass: No longer offers free certificates, probably didn't have must-staple either - Zero SSL, I didn't find any public links to check
29.
by Ayesh 1y ago
Firefox has a a toggle `Query OCSP responder servers to confirm the current validity of certificates`, which is turned off by default. Edit: It seems to be enabled by default! I've been using Firefox for as long as I remember, and don&
30.
by Ayesh 1y ago
I was a big fan of OCSP-stapling and must-staple. Both of which are slowly being discouraged; LetsEncrypt refuses to issue must-staple certificates since a few months ago, and I think they are shutting down OCSP servers, if not shut down al

More ›