xurukefi

7 ms·

1.
by xurukefi 2mo ago
> How do clients get the address for a nice domain name without the addresses in public DNS? They don’t. You put the addresses in public DNS.
2.
by xurukefi 2mo ago
Or... - Don't use split DNS. Don't use any special internal or dev domain. Leave it to your infrastructure to route/NAT those public IPs to your internal network. - Don't use the HTTP-01 challenge. Use DNS-01. - Don&#x2
3.
by xurukefi 7mo ago
Sure, but maybe there are other ways to control Googlebot in a similar fashion. Maybe even with a pristine looking User-Agent header.
4.
by xurukefi 7mo ago
That's actually a really neat idea.
5.
by xurukefi 7mo ago
There are ways to work around this. I've just tested this: I've used the URL inspection tool of Google Search Console to fetch a URL from my website, which I've configured to redirect to a paywalled news article. Turns out th
6.
by xurukefi 7mo ago
But it is reliable in the sense that if it works for a site, then it usually never fails.
7.
by xurukefi 7mo ago
Exactly. If I was an admin of a popular news website I would try to archive some articles and look at the access logs in the backend. This cannot be too hard to figure out.
8.
by xurukefi 7mo ago
Because it works too reliably. Imagine what that would entail. Managing thousands of accounts. You would need to ensure to strip the account details form archived peages perfectly . Every time the website changes its code even slightly you
9.
by xurukefi 7mo ago
Kinda off-topic, but has anyone figured out how archive.today manages to bypass paywalls so reliably? I've seen people claiming that they have a bunch of paid accounts that they use to fetch the pages, which is, of course, ridiculous.
10.
by xurukefi 8mo ago
I hate NAT with a passion. It's a terrible technology, whose disruptive nature has probably prevented any novelty on the transport layer. But this article is oversimplifying things. It is well known that NAT is not meant for security a
11.
by xurukefi 1y ago
For me, type hints are mainly useful because they're the only reliable way to get decent IDE auto-completion. Beyond that, they feel like a bolted-on compromise that goes against the spirit of Python. If you really need strict typing,
12.
by xurukefi 1y ago
The LaTeX community is astonishingly good at gatekeeping. I can't think of another field where the adoption of a clearly superior modern alternative has been so slow. For some reason, they seem to take pride in clinging to a 50-year-ol
13.
by xurukefi 1y ago
Nobody forces you to change your key for renewals.
14.
by xurukefi 2y ago
removed
15.
by xurukefi 2y ago
> The question then becomes, whether Adblockers could use this information to skip the ads. It's a cat and mouse game. I wouldn't call it a cat and mouse game because there is nothing from a technical point of view that prevent
16.
by xurukefi 2y ago
> For one thing, this approach seems to inherently conflict with the fact that you can link directly to a particular timestamp in a YouTube video, either in an external link using the `&t=...` URL parameter, or by just including a ti
17.
by xurukefi 2y ago
> What does "server side injection" actually mean? The way ads usually work is that they are separate video files that are fetched by the YouTube client (e.g., the browser) and then displayed to the user. Ad blockers modify the
18.
by xurukefi 2y ago
It's a nice idea, but I don't think it adds enough clarity to the code to justify the messy compiler warnings and errors that this kind of preprocessor abuse will eventually cause.
19.
by xurukefi 2y ago
With PlayReady, as with any other DRM scheme really, there are different tiers. There is SL2000, which is done completely in software (whitebox crypto), and there is SL3000, which does require a TEE. Which tier is requried for which type of
20.
by xurukefi 2y ago
The "client" whose "identity" is abused here is not an end user. A "client" in this context is a program or library that talks to the license servers and receives the content decryption keys. On my Windows mach
21.
by xurukefi 2y ago
Reading the comments here makes me feel guilty. I'm sitting on probably a few hundred files and folders called something like tmp, tmp1, foo, foo23, foobar, testxyz, etc... They all hold probably very irrelevant stuff and are safe to d
22.
by xurukefi 2y ago
Since I'm a bit late to the party and feeling somewhat overwhelmed by the multitude of articles floating around, I wonder: Has there been any detailed analysis of the actual injected object file? Thus far, I haven't come across an
23.
by xurukefi 3y ago
Thanks for the insight. The fact that Paper Mario uses optimizaion flags makes this project even more fascinating. Great work.
24.
by xurukefi 3y ago
Fascinating work. I know that people did the same for Super Mario 64 [1]. It is still unbelievable to me that they can generate a bit-by-bit identical copy of the original ROM by simply running some old gcc on actual C source code files.
25.
by xurukefi 3y ago
While that sounds reasonable, is there any evidence that this is the actual reason? Widevine is also used by other ubiquitous services such as Netflix, Prime, Hulu, etc.. and yet WV still remains an insurmountable barrier for most people, e
26.
by xurukefi 3y ago
The "xor rax, rax" that I just saw at a quick glance makes me flinch. Still putting it on my reading list though. Sounds like a really interesting little toy project.
27.
by xurukefi 3y ago
$ python yt_fts.py download 'https://www.youtube.com/@ycombinator/videos' [...] File "/app/yt_fts.py", line 176, in get_channel_id channel_id = re.search('chann
28.
by xurukefi 3y ago
> It’s absolutely impossible to use any sort of adblocker on twitch. I have never seen any ads on twitch. I just checked with DevTools and it seems like uBlock Origin simply blocks a script called "v6s.js", that is apparantly r
29.
by xurukefi 3y ago
It will be interesting to see how this plays out. Ad blocker detection is an arms race and considering how big YouTube is, people will definitely fight back and go very far out of their way to avoid ads. This could get really ugly given tha
30.
by xurukefi 3y ago
Don't we already implicitly have that sort of trust at the moment with TLS certs considering that proof of ownership via DNS is quite common? Actually, any domain-based validationi, i.e., also HTTP-01, is going to be flawed if you don&

More ›