agwa

9 ms·

1.
by agwa 29d ago
The database/sql package gained native support[1] for the uuid.UUID type so it will Just Work even without the methods. This probably should have been mentioned in the release notes and database/sql package docs. [1] https:/
2.
by agwa 3mo ago
What's particularly crazy about this interchange is that there is going to be a second, elevated peanut roundabout that's rotated 90 degrees, for buses to use: https://blogger.googleusercontent.com/img/b/
3.
by agwa 3mo ago
You would think so, but even an authentication company screwed it up: https://cybercx.co.nz/blog/json-web-token-validation-bypass-...
4.
by agwa 3mo ago
The cost is the vigilance required to use them safely. It's not just compute/storage costs.
5.
by agwa 3mo ago
Fair enough, but those optimizations are basically free. People think stateless tokens are free but they really are not.
6.
by agwa 3mo ago
As someone who operates a PostgreSQL database containing 27 billion SSL certificates, each 1-2kb each, with a bunch of secondary indexes that get inserted in random order, I find it pretty incredible that people see the need to optimize the
7.
by agwa 3mo ago
Aw, thanks :-)
8.
by agwa 3mo ago
The blog post provides a certificate chain that validates in OpenSSL but not in Go. The reason it doesn't validate in Go is that the Subject field in the CA certificate uses a different string encoding than the Issuer field in the leaf
9.
by agwa 3mo ago
The following go flags let you build statically-linked cgo binaries, provided that all the C libraries that you're using support static linking and don't call the NSS functions in glibc: -tags netgo,osusergo -linkmode external -ex
10.
by agwa 3mo ago
I think that on Unixes without overcommit, people allocate massive amounts of swap so that fork never fails.
11.
by agwa 3mo ago
Yeah, I agree. No criticism of Go's behavior is intended; just pointing out that the RFC is technically dead.
12.
by agwa 3mo ago
That RFC is obsoleted by https://datatracker.ietf.org/doc/html/rfc9844 which removes all guidance around URIs: > This document completely obsoletes [RFC6874], which implementors of web browsers have determined
13.
by agwa 4mo ago
The downside is that to get the size optimization, TLS servers will get moderately more complicated (they'll need to have multiple MTC certificates configured and select the right one depending on the client's state), and TLS clie
14.
by agwa 4mo ago
You'll be able to immediately use use a "standalone certificate" while waiting for the batch to be created. The tradeoff is that the standalone certificate will have multiple huge ML-DSA signatures.
15.
by agwa 4mo ago
Right, I read all that and I didn't see anything to indicate that AI is being used to write code - just one person's unsubstantiated claim.
16.
by agwa 4mo ago
Where do you see that about Postfix? I followed the links and the only thing I see is that AI is being used to find bugs, not write code.
17.
by agwa 4mo ago
Those changes were passed during the first Trump administration by a Republican congress, though they didn't go into effect until Biden was in office. https://kpmg.com/kpmg-us/content/dam/kpmg/pdf&#x
18.
by agwa 5mo ago
If you want your dev environment to be as similar to prod as possible, and you use a proxy in prod, then you should use a proxy in dev also. I was presenting a solution to someone who doesn't want to do that.
19.
by agwa 5mo ago
Do be aware that CGI, unlike FastCGI, has a pretty big footgun due to the use of environment variables to convey HTTP headers: https://httpoxy.org/ Go's CGI server implementation doesn't set $HTTP_PROXY so you&#x2
20.
by agwa 5mo ago
Please see the section about untrusted headers - this is not fixed by HTTP/2. You're right that being able to point your browser right at the app is very convenient. With Go, you can have a command line flag that switches between
21.
by agwa 5mo ago
Putting security-critical logic in proxies is a violation of the End-to-End Principle, not an example of it. That doesn't mean it's a bad thing; as ragall notes, the End-to-End Principle doesn't make sense here. You're
22.
by agwa 5mo ago
Go's embedded HTTP server can handle it just fine: https://blog.gopheracademy.com/advent-2016/exposing-go-on-th...
23.
by agwa 5mo ago
That is way! Unfortunately, sometimes you have to do path-based routing to different backends, and now you're back to needing a proxy between your clients and your applications.
24.
by agwa 5mo ago
What you're looking for is mod_proxy_fcgi, not FPM. It's included in Fedora's httpd-core package; I don't know about RHEL: https://packages.fedoraproject.org/pkgs/httpd/httpd-core/fed...
25.
FastCGI: 30 years old and still the better protocol for reverse proxies(agwa.name)
424 points by agwa 5mo ago|101 comments
26.
by agwa 5mo ago
I'll note that while X.509 certificates are deployed widely on the Internet, they are not deployed in the manner the ITU intended. There is no global X.500 directory and Distinguished Names are just opaque identifiers that are used to
27.
by agwa 5mo ago
Oh wow, thanks for those numbers! Since mmbleh mentioned Linode I'm guessing they're more concerned with traffic from servers, where CGNAT is uncommon. But even that may be changing - https://blog.exe.dev/ssh-host-
28.
by agwa 5mo ago
I don't doubt your experience, but I wouldn't expect it to continue. I don't think Tuna-Fish is correct that "most" of the IPv4 world is behind CGNAT, but that does appear to be the trend. You can't even assume
29.
by agwa 5mo ago
Correct. Even a million rounds of hashing only adds 20 bits of security. No need if your secret is already 128 bits.
30.
by agwa 5mo ago
But JWTs are usually used as bearer tokens when doing API authentication. Those are definitely secrets that need to be scanned for. Or are you suggesting that the API requests are signed with a private key stored in an HSM, and the JWT cert

More ›