X-Istence

Current certs are limited to 2 years max already, so this reduces it to 1 year.

For certs that were issued before September 1st, 2020 nothing will change, they will continue be valid for 2 years. So if you get a certificate on August 31st, 2020 that is valid for 2 years, it will be valid till August 30th, 2022.

However certificates created after September 1st, 2020 that are issued for 2 years will no longer be accepted by Safari (and thus it will throw a TLS warning when a user visits the page)

> Why is one year certs more secure?

The issue with long lived certificates is that if the certificate + private key is stolen, then it can be abused for the duration of the certificate lifetime.

Revocation is currently not very feasible because of the high cost for turning on CRL/OCSP checking on every request, and even with OCSP stapling (which is not currently enforced because of potential for sites to go down because the staple is missing or outdated and the certificate authors OCSP servers are not returning new answers).

Here's a good article that explains some of the issues with revocation: https://arstechnica.com/information-technology/2017/07/https...

Last edit:

Shorter certificates are better for security overall, as there is less time for an attacker to potentially abuse a certificate.

Friend of mine makes hourly what many people earn in a week ($1k hourly billable), so while they lived in LA it made sense to have someone drive them from the airport back home because what should take ~20 minutes at most usually took 2 hours.

During those two hours they could work, and thus make money, it didn't make sense to drive themselves.

Their company hired a particular car hire service and the drivers would get rotated through a schedule, but they ended up having a particularly good relationship with a particular driver.

So they dropped the contract with the company, and basically just paid the one driver himself, basically a personal chauffeur, but with a schedule that is known two weeks ahead of time, with some emergencies, but not 24/7.

Eventually this allowed said driver to buy a couple of cars, and start a company himself, while always making sure to take care of my family member first and foremost himself.

They trusted the driver with their children, and for certain purchases the driver would either go pick up items (such as jewelry/high end clothes) or their driver would drive a consultant (personal shopper) to go do the shopping/pickups.

My friend moved away from the LA area, but used the same driver for ~6 years or so, the driver now runs a high-end private car hire service that offers services to cater specifically to people that need services like that. No advertising, word of mouth only, and everyone involved is highly vetted and trusted.

It's pretty amazing how much time you get back when you can pay someone else to do the things that take time but don't really provide happiness in life. Such as cleaning/driving/cooking/household chores that the rest of us have to do ourselves, and thus is all billable time.

That doesn't solve the problem of the hostname on the EC2 instance itself being the same across all instances thereby making it harder to see what logs came from what hosts.

It doesn't solve the problem of allowing you to look at logs and then quickly SSH'ing to a single machine in the ASG.

I have a Dell 34" UltraWide curved and I love it. I upgraded from two monitors to a single UltraWide and not having a bezel is amazing, and the slight curve helps because my eyes don't need to refocus as I move from one corner to the other when looking at it. It has reduced my eye strain tremendously.

This is one of the best troll posts that is getting taken seriously ever... wow.

It's a giant pain in the behind, if you can even get it to compile correctly.

Moddable isn't:

https://github.com/Moddable-OpenSource/moddable/tree/public/...

For $3700 you can have a brand new apartment in the Dogpatch of SF... if I find mold I am not staying, especially if the landlord won't fix it.

There's a lot about this story that just doesn't seem to add up... its weird.

> 2: clang is still significantly worse than GCC

Do you have any sources/information to back that statement up?

Bank of America allows me to do this for my credit card with them.

Yup... that's what I have been doing.

Yeah, I tried that... and then when I entered the manual routing number it's like "Hey, you need to login instead because this bank is known to us"

The worst part is that certain banks won't let you link an account that Plaid claims is supported based upon the routing number/account number.

So for example when I attempted to link based upon routing/account number at Simple, it told me I can't continue because I should hand over my account information for the other bank to Plaid instead.

I've done it, and then immediately changed my account info. So yes, technically Plaid has my historical data, but at least they won't get it going forward. It really sucks though, because it locks my money into a singular bank otherwise.

> If you are travelling in the USA as long as you stick to the interstate system you pretty much get mobile data the entire way. IF you drift onto smaller highways then that is when things get very spotty outside of metropolitan areas.

Stretches of road in Utah would like to have a word with you. Specifically I-70.

> Allows a process to call execve(2). Coupled with the proc promise, this allows a process to fork and execute another program. If execpromises has been previously set the new program begins with those promises, unless setuid/setgid bits are set in which case execution is blocked with EACCES. Otherwise the new program starts running without pledge active, and hopefully makes a new pledge soon.

https://man.openbsd.org/pledge

Pledge can be inherited by child processes too.

Worked at a company where the old school cable runners would still use wax string to lace the cables...

That was until the heat from the exhaust from the servers started to melt the wax and it became a really nasty sticky mess.

Any service that uses API keys are basically handing out bearer tokens. Whoever holds that API key can make requests to the service, it grants you access.

Github will happily hand you an access token by visiting "https://github.com/settings/tokens".

These are bearer tokens, in that the bearer gets granted access by that token alone.

You happen to send it along in a Basic authentication in HTTP instead of as an Authorization header, but it is a bearer token all the same.

No OAuth2 flow required.

I've been using the SB6190, and I haven't had any issues with latency or jitters. Even all of the testing didn't show any issues.

Mine is a hardware version 3 though.

> The problem is that Apple has often been replacing logic boards when this type of thing happens as well. Some people see it as a good thing, but it usually results in the complete wipe of data.

You should have backups anyway. Especially with Time Machine it's dead simple to keep good backups.

Apple doesn't typically have an arrangement with a university. Apple does allow you to send the device in/get it shipped back to you though if there is an issue. There may also be a certified Apple repair store near your daughters university.

It looks like that FreeBSD GitHub repo is private.

Are there any blog posts/email threads you'd point people to if they want to read more about the work that was done?

I'd love to see and read about some of the things you ran into, and how you accomplished some of those high speed transfers.

This is the reason why my local DNS resolver won't allow returning private IP space (including localhost).

> Specifically, on top of Japan, the U.S. and Australia, cables connected to NATO members should be off-limits to Huawei.

I don't understand this at all... if the communications across the cable are properly secured then it shouldn't matter what cables it runs across.

This post really needs a /s on it for full effect.

~24 hours is what it took for my replacement.

Wait... you are pissed off because you get better sound quality from your laptop speakers?

> - Keyboards with much worse action that are more prone to failure (from dust no less) and require replacing the motherboard to fix... all for a Touchbar no one wants and 0.5mm cut in thickness.

The keyboard replacement replaces the top-case, your motherboard and everything else is transplanted over to the new top-case.

You don't need all of six in most cases. You just need a couple of different functions.

As the maintainer of WebOb/Pyramid/Waitress we have a compat module that contains all of the changes/renames/functions to help with the Python2/3 compatibility and all tests run across both platforms.

Are the functions borrowed heavily from six? Yes, but we don't need to vendor all of six.