1 karma · joined July 1, 2023
Maybe even https://order.rsync.net could be the link and YOU (the sysadmin of the service) might not even notice, because I'm pretty sure you don't check/monitor your DNS records every couple of minutes.
The reason "it did not happened yet", is not valid, because if could happen anytime in your service's lifetime. It's like an open door and no robbery happened yet, but the likelihood of it is happening is worse than if you at least close the door. It would be silly to complain "It has been open for a long time and there were no robbery." after it happened.
> "people that don't notice being redirected to a different domain are not smart enough to be using rsync.net in the first place."
This is just an assumption, I would not make that. You could be surprised. Sometimes even web developers don't understand how x509 certs and https work.
When going from a HTTP page to a HTTPS page, what guarantees can you give that I see the original content and clicked the proper link and that I was not MITM-ed? A potential attacker can MITM and easily redirect me to any order page they want... This is security 101.
I was a bit agressive here because too much unnecessary complexity is probably the mistake I hate the most.
Here is the agressive part: People who can't see that shouldn't be software developers.
To learn to write good code you have to write a shit-metric-ton of bad code.
The problem with this is how do you know if your code is good or bad? A lot of programmers never learn. They only way is to learn from others and write. You won't necessarily will be a better programmer if you just write programs by yourself. def are_all_numbers(everything):
return all(is_float(e) for e in everything)So basically I don't find it a valid reason to make an entirely new thing because the existing solutions did not worked the way you wanted.