feld

well, end to end crypto for one

Except the increased risk of heart attack and the damage to kidneys and bowels...

Netflix gives back major fixes and performance improvements to the community because maintaining their own fork of the OS permanently is a nightmare.

My friend put 100,000 miles on his Tesla in a year and was never stranded. He drove 30,000 miles on a known faulty motor.

It's not more unreliable than an ICE vehicle. It's significantly more simple in design and for repair. These claims are FUD.

FreeBSD, OpenSSH, Apache mod_kerb2 (and mod_auth_ldap for authorization), Active Directory.

1. install server

2. msktutil tool joins machine to domain (simple tool; no dependencies) and now you have /etc/krb5.keytab file

3. minor configuration for base OS -- LDAP using keytab instead of bind user with static password, etc

4. webservers just need an HTTP principal keytab created (simple msktutil command, then extract it from the /etc/krb5.keytab file into a file apache can read/write)

5. I can ssh to every server without a password after running "kinit" on my macbook

6. it just works and it's reliable, time tested, and secure.

Clever. Thanks for sharing.

DNSSEC is dead and useless unless every application is written to understand the error messages and every device runs its own DNS resolver (not forwarding, because it's not really validating then and the responses could be spoofed).

We don't need DNSSEC because it doesn't solve any existing problems. The validation is done at the application protocol level with TLS, and apps that aren't running TLS need to fix this gap.

So as it turns out DNSCrypt is winning the internet even though the standards bodies blocked it. Additionally, OpenDNS has massive deployment of DNSCrypt users and this is being furthered by Cisco Umbrella. Cisco is adding this capability to iPhones now as announced earlier this week.

tl;dr DNSSEC has always been DOA, but DNSCrypt is just getting started.

The one and only application I knew of that added DNSSEC for DANE removed it because it was worthless (irssi, irc client).

This has nothing to do with this conversation. DNS recursors are not being discussed. This is strictly about DNS resolvers.

Reader view on iOS Safari makes the web usable on mobile.

All of our linux/freebsd boxes on our network at work must be hooked up to kerberos. most of the day I don't have to type my password for anything HTTP/SSH unless it's for sudo.

User privacy is literally their business model. You pay Apple up front and they never expose your private information to third parties for any reason whatsoever and try to make sure your devices stay private. The cost of your privacy and future software updates through the life of the device is built in to the sticker price. You get exactly what's on the tin.

RIPE is one of the internet registries.

PlexPass server features are generally just beta release features and not locked to your user account. If you had the URL to the installer for the PlexPass version (which requires no authentication to download), you could have access to this feature without paying them.

But be a good person and pay for PlexPass.

You have to admit he has better release management than 99% of the open source projects out there right now.

With Sprint gone #4 will be US Cellular which isn't exactly nationwide, but they're growing leaps and bounds.

I did not evade the point. You are choosing to to ignore it.

This comment is well within HN guidelines.

Alright let me replay this conversation:

Post:

> the free market is broken. I have a choice between two providers but one is a slight inconvenience for me to have installed so I refuse to use it.

YC Approved© Reply:

> the free market is not broken.

🆒

It wasn't a personal jeer. I was commenting on his behavior/attitude, not calling him names. There's a big difference.

alternately:

    > You're just being (a prick | stubborn | bullheaded | rigid | perverse | unreasonable)

OpenBSD's pf doesn't handle layer2.

(imo) Nothing beats FreeBSD's IPFW when it comes to features, but OpenBSD is still king of syntax/usability.

I think their website is on github, so open a pull request

Not currently in the plans because the support window for LibreSSL is significantly shorter than a FreeBSD release support cycle.

Bernstein v. United States

“I don’t think Congress intended that distinction but what it does do us is in our most important investigations it requires us that if we want to find out the subscriber info to a particular email to go and get an order from a federal judge in Washington as part of the FISA court. An incredibly long and difficult process. And I’m worried about that slowing us down — and I’m also worried about it being a disincentive for our investigators to do it at all.”

Hurdles to protect privacy are important. If it's not an arduous process we have a problem.

They certainly seem to have a marketable product for easy ssh key management. They'll make buckets of money on this I bet.

What is your definition of cheap? Don't rule out ARM based solutions.

Well, if you care about security AES-NI allegedly prevents a side channel attack.

X Forwarding and TCP Forwarding is also insecure. Not everyone has the same threat model, but for the average person it's a bad idea to do agent Forwarding unless they fully understand the consequences. This doesn't mean the OpenSSH team should remove it.

Bad security is bad. Nobody should leave ssh open to the internet at large at this point.

But how do you get "accustomed" to it when every OS Cisco has looks the same but is different enough to drive a man insane?

Wow, I forgot that even existed. Here I was thinking of every switch, firewall, and routing product they've done except this line. I guess it doesn't help that I've never had a reason to touch one as every carrier grade router I've used has been Juniper. I wonder why they went with a whole new platform based on QNX when you don't benefit from a realtime OS if all the packets are moved in hardware? Must be something about the pain of upgrades and reloads on other Cisco product lines and somehow QNX can minimize these outage windows.

I've still yet to meet someone who actually prefers Cisco over Juniper MX. I wonder who is buying these?