HNHacker News
TopNewBestAskShowJobs

Lukasa

333 karma · joined April 24, 2013

My name is Cory. I build networking software. I work on open source Python projects. I write about networking and about Python. See https://lukasa.co.uk for, you know, me.
submissionscomments
Lukasa··on [dead]
This email reads like a tin-foil hat conspiracy theory. No evidence is provided for it, it's just a statement that some 'evil organisation' has forced an open organisation to do something the author didn't like.

I should note that the author has a bit of a tendency to see conspiracies of this nature[0] and has been banned from the LKML in the past[1].

I'm going to assume this is simply groundless mud-slinging until I see any evidence to the contrary.

[0]: https://lkml.org/lkml/2014/10/6/432 [1]: https://lkml.org/lkml/2014/10/5/151

Lukasa··on HTTP/2 Frequently Asked Questions
Notice that Amos was arguing for a happy-eyeballs approach, which removes the round trip. The issue isn't the wait for an extra round trip, it's making it mandatory to wait for an SRV result before using an A result.

If the language says "You MUST consult SRV records for _http2._tcp before you use the result of an A lookup", then anything that delays that SRV lookup will delay page resolution. Browsers are strongly disincentivised from making anything slow, so it's just safer not to add the extra delay point. If we specced that, no-one would do it.

Better to have what we have now, which is: do SRV if you want.

Lukasa··on HTTP/2 Frequently Asked Questions
Correct, but you don't need the RFC to make SRV optional. If you'd like to use it, use it.
Lukasa··on HTTP/2 Frequently Asked Questions
> Why doesn't the HTTP/2 protocol use SRV DNS records?

This was discussed by the WG. The best rationale is given in the thread starting from this mail[0] from Will Chan at Google, followed up by this one[1] from Amos Jeffries (Squid Proxy). The summary is: waiting for SRV lookups can be slower than just doing straight-up A records, so no client in a competitive space is going to do it.

Everyone agrees that in an ideal world this would be great, but in practice no-one is going to be the first person to move on that front. The wins aren't big enough and the cost is too high.

[0]: http://lists.w3.org/Archives/Public/ietf-http-wg/2014JanMar/... [1]: http://lists.w3.org/Archives/Public/ietf-http-wg/2014JanMar/...

Lukasa··on Show HN: A tool for creating custom TLS CA bundles
Re building into Firefox: It absolutely could, and I'd love it if someone went ahead and did it. That would be a big coup for Mozilla and it simply can't be that hard to do. Hell, the Chrome guys could do it, mkcert is build on one of Adam Langley's tools anyway.

As for self-hosting, I think anyone who wants to deploy mkcert in anger should self-host, and I believe I've made it trivial to do that. There are some steps I can still take to improve this: I want to pin Mozilla's cert in the client so that it can't be MITM'd, for example.

Lukasa··on Show HN: A tool for creating custom TLS CA bundles
Yes indeed, and you can do just that. The API server is open-source[1], and it's been Dockerized. Anyone who's really paranoid should absolutely run the server themselves.

[1]: https://github.com/Lukasa/mkcert

Lukasa··on HTTP/1.1 just got a major update
The argument is that the two should be able to transparently interop together, and specifically that RFC 723[0-5] simply codifies the way HTTP/1.1 already works in the real world.

We'll see how well that goes.

Lukasa··on If You Can Read This, You're SNIing
Bug report opened on NewsBlur: https://github.com/samuelclay/NewsBlur/issues/534

Because they're using Requests this should be a fairly trivial fix for them.

Lukasa··on If You Can Read This, You're SNIing
Yeah, we're not delighted about how complicated this is, but it's really the best we could do. =( To be clear though, Requests only requires the three packages be installed, it'll do everything else automatically.

Actually, is there interest in this being an installable add-on? Meaning you'd run: pip install requests[SNI] to get it?

Lukasa··on How I Judge the Quality of Documentation
Most languages now have a tool for writing and hosting documentation to make this as easy as possible for you. The author of the post runs http://readthedocs.org/, which is primarily used by Python developers, for instance.

For Go, the standard toolchain is the builtin go doc tool (http://godoc.org/code.google.com/p/go.tools/cmd/godoc), and the GoDoc website for hosting (https://godoc.org/-/about). Using that pair of tools will be a good start.

The advantage of these standardised tools is that it gives most documentation for projects in a given language a common 'look'. Go libraries have one kind of appearance, Python ones another, and so on. This tends to make navigating around much easier.

Lukasa··on Explicit Trusted Proxy in HTTP/2.0
This is not a new security hole. Carriers can do this today and transparently MITM all current HTTPS traffic: no new risk is present.
Lukasa··on Explicit Trusted Proxy in HTTP/2.0
That's a totally understandable fear. Personally, I trust the ability of user-agents to help users make informed decisions in this area, but I can understand why you don't. Nevertheless, even with this proposal HTTP/2.0 will be substantially more secure than HTTP/1.1 is, at least in the aggregate.

It's also worth noting that this is a proposal. You didn't actually make this mistake yourself but I do want to highlight it: the HTTP WG is not yet discussing this as anything more than a suggestion (see http://lists.w3.org/Archives/Public/ietf-http-wg/2014JanMar/... ). If you are worried about this sort of proposal becoming a draft, I highly recommend you join the working group and keep an eye on the proxy discussions.

Lukasa··on Explicit Trusted Proxy in HTTP/2.0
As discussed yesterday, this is not a new MITM vulnerability. To make this work you need to establish a TLS connection to the proxy which is verified in the usual certificate authority way. Note that the standard says that user agents that discover they're talking to a trusted proxy should obtain user consent to talk to that proxy.

Any situation in which someone can force your machine to trust one of these proxies is a situation when they had administrator access to your machine anyway, and in that situation you're already screwed.

Would it kill HN to actually read one of these specs instead of just whining about it?

Lukasa··on One of the Most Alarming Internet Proposals I've Seen
Both this article and that one were impressively alarmist. Speaking as someone who has implemented a HTTP/2.0 client stack it's really nothing like as bad as either of these articles makes out.

For once, I invite you to fully read the comments on this post and the one you're referring to. Or, alternatively, take a read of the draft RFCs and the WG mailing list, which is totally open.

Lukasa··on HTTP 308 Incompetence Expected
You're entirely right, and it's not just browsers. Your statement about 'user agents' was the better one. Consider also curl (http://curl.haxx.se/docs/manpage.html#-L) (and presumably libcurl), Python's requests (https://github.com/kennethreitz/requests/blob/master/request...) library, Python's urllib.request (http://docs.python.org/3.3/library/urllib.request.html#urlli...) (what used to be urllib2), the list goes on. I don't believe I've ever seen a HTTP client library that doesn't do 301 method conversion.
Lukasa··on No-fly list takes legal hit
The historical reason, as far as I can recall, is that it's an attempt to make the judiciary independent. If judges were elected, they'd have exactly the same biases as the other elected offices, which means they'd be a less effective check-and-balance system. That also leaves aside the many, many ways you can corrupt an elected official that cannot be used for an unelected official.

In most western democracies (and certainly in Westminster-style democracies, which I know best) the judges are bound by a certain set of rules that limit how activist they can be: specifically, a constitution. They're required to make findings of law, nor findings of morality, so they can't just manufacture law or destroy law as they see fit: they need a different law they can point to which overrules the one in question. Hence the US Constitution, which acts as the highest law in the land. A judge will always reference their decision, in the end, to an established law (or the constitution).

Conversely, elected officials are empowered to _make_ law. Less true in the US (where the constitution binds the hands of the legislature and executive), but very true in Westminster systems where parliament is the supreme authority.

Lukasa··on Requests v2.0 Python module released
Once again, thanks so much for that. Genuinely great work and we're so glad to have it.
Lukasa··on Persona makes signing in easy for Gmail users
I wrote a blog post about implementing an IdP from scratch in Python. (Uses Django, but the lessons should be transferable). https://lukasa.co.uk/2013/04/Writing_A_Persona_Identity_Prov...
Lukasa··on Writing A Persona Identity Provider
As suggested above, this is probably because your browser doesn't trust StartSSL. If you don't want to add them to your trusted certs, the same page is available over HTTP as well as HTTPS.
Lukasa··on Writing A Persona Identity Provider
That seems likely. If you can't add StartSSL to your chain of trust, the same page can be accessed over HTTP instead of HTTPS.
Lukasa··on Writing A Persona Identity Provider
I can't reproduce this in Chrome or Firefox. Is this still happening for you?
← PreviousPage 3 of 3