Whitestrake

Caddy's new commercial licensing, like nginx, is completely optional as the actual source license continues to be Apache 2.0.

For any business running their own web servers, compiling Caddy themselves instead of utilizing the build server at caddyserver.com is a trivial step that also gives them greater control over the binary they end up using anyway.

The most apparent comparison looks to be NGINX Plus, for which the lowest cost tier works out at over $200/month ($2,500/year) per instance.

https://www.nginx.com/products/buy-nginx-plus/

This is incorrect, or at least only half-true.

Caddy is still Apache 2.0 licensed. You can use it for free for commercial purposes. You just can't use the build server at caddyserver.com to download a precompiled Caddy with plugins. Instead, you can download the source, compile it with plugins yourself, then distribute your own binary amongst all your hosts.

> > Furthermore telling app devs not to worry about it because nginx takes care of everything is a false security blanket that will bite you eventually.

> Nobody said this.

That seems dishonest to say... From the grandparent:

> Or... you spend your time building something useful, leveraging skills you do have, and let nginx leverage its own strengths.

Really sounds like at least one person in this thread is advocating for app devs not to worry about things that nginx takes care of.

Agree that making straw men doesn't help. There's advice on either side regarding which one to use and realistically both are equally 'false security blankets'. The correct answer is to educate yourself on the benefit and drawbacks of each and make a conscious decision about where to implement your security.

From the grandparent comment:

> This is what our lawyers suggested to protect ourselves.

Generally speaking, a lawyer's advice is going to be optimized for maximum protection in possibly unforeseeable circumstances, not for what might actually be needed or even reasonable to request of every user.

Generally speaking, companies aren't going to go out of their way to rein in their lawyer. Most people won't even read that fine print, unfortunately.

Any thoughts on the Wowtac A2 vs Wowtac A2S?

I hold the principle of open-mindedness higher because I personally don't see a downside to it. Closed-mindedness always struck me as a symptom of insecurity. Being insecure about something like the criminality of child sexual exploitation doesn't sound like something I ever want to espouse, so if you want to tell me why you think it's a good idea, I'll listen (the likely outcome being the conclusion that you're a whacko, and moving on).

Being open-minded doesn't mean I'll sit still while someone endlessly or facetiously justifies an objectionable notion. If I've heard it before, or it's insincere, I'll dismiss it outright, as I imagine you would.

But on principle, I'll listen to an earnest attempt to demonstrate the merit of anything, even something I'd otherwise categorically reject. You might not influence my position in the slightest, but being open-minded doesn't mean easily persuaded, either. It just means being willing to incorporate new information or ideas in your decision-making process.

I don't think SoundCloud is an entity with some optimistic face you could approach and convince through reason or merit.

I expect they, like any business, would take a stance primarily based on liability, cost, benefit, etc... overriding how anyone working at the company actually feels about it.

It costs them nothing to ignore/outright reject without consideration a crazy proposal like "lets give our entire database of content to a third party". Assessing the technical and legal ramifications of that proposal costs time/effort/money. Why bother?

If SoundCloud gives their content to Archive Team, they're shouldering the possibility of some kind of liability, surely. If they say nothing, let Archive Team take it themselves, from their website, they let Archive Team (who understand and are willing to) take responsibility for that.

I agree with the case for using a wildcard, but just to play devil's advocate - why can't they take the CloudFlare approach?

Generate a cert for 100 of your client's domains, use that cert across those domains. Cut your 50m domains down to 500,000 certificates. Serving the right certificate for the right domain is a simple enough task.

As new tumblr domains are registered, generate more certs in batches of 100 domains.

I doubt anyone would ever seriously suggest putting millions of SANs on a single certificate, but 100 isn't too farfetched.

I feel like you and I are not operating on the same definition of implication.

In the above comment when using the word implication my intent was "a conclusion that can be drawn despite not being explicitly stated".

To be unambiguous, the explicit statement is that computers prior to a specific date should be considered to be compromised. The conclusion that can be drawn, based on the fact that the writer specified that date, is that later dates did not qualify for the same statement, because the conditions were not sufficient. That is to say, that they were not insecure enough for the writer to include in his comment. That is the implication, despite the writer not saying outright that computers after that date were "secure".

The conclusion assumes the credibility of the writer, and the intellectual honesty of their comment (i.e. they didn't put that date there just to be facetious) but I believe that's a fair assumption given the context of questioning the semantics.

I also note that the actual implication here is not that computers are secure after that date, or even that computers are insecure but not compromised. The implication is, in fact, that while computers might be compromised after that date, the writer doesn't believe it's worth advising people to ASSUME they are compromised.

I think it's more accurate to say that the comment is explicitly stating that Windows was insecure prior to that date, the implication from which is that it was not as insecure after (else why make the distinction of the date at all).

It can be both the WSJ and a scam site at the same time.

Remote hosts need Python, but you can use the raw command functionality to figure out what the remote package manager is and install Python as required.

Reminds me of an old classic, the then-Minister for Communications in Australia back in 2010.

https://www.youtube.com/watch?v=1gl7X6peh-w

HSMM-MESH is cool, really really cool, and people should definitely go check it out, but to quote the website you've linked:

  it is NOT a replacement for your home internet connection
    being an Amateur Radio network, it can only carry traffic that is allowed under FCC Part 97 rules
    several types of internet traffic violate these rules
  also, it is NOT a replacement for your home internet connection
  finally, it is N O T a replacement for your home internet connection
  and by the way, it most certainly CANNOT be used in any way with your business network

I understand much of the traffic you'd usually send over the internet is not permissible over broadband hamnet.

Is plausible deniability the right term here? Usually that's about the ability to deny having known about or authorised something after it's already been discovered.

I'm not really sure how you'd refer to the concept "they don't know I have it, so they don't know to ask". Security through ignorance?

Arbitrary, rather than random. Most of the time, it's entirely up to the developer. I'm sure the percentage of applications that actually require administrative privileges to perform tasks is in the single digits or lower.

Maybe:

"Here is a link to an encrypted report containing info on what we found. Please verify your ID and we will give you the key."

I thought the essay's concern was that funding is growing too fast, allowing expenses to expand to fill the gap in a way that is unsustainable (because eventually the funding growth must come to an end).

That appears to be an objectionable decision in and of itself, if I understand the argument of the person you've replied to.

The iTerm2 features page[1] has a pretty good run-down of all the extra stuff it can do. Personally, I'm a big fan of the split panes, and I use iTerm2 full screen with two panes.

That said, almost identical behaviour can be had in fullscreen with two Terminal windows sharing a full screen desktop space.

I also enjoy having my terminal be a slightly-transparent black rectangular slate, with no title bars, corner curving, etc., but that's purely preference and has no impact on functionality.

[1] https://www.iterm2.com/features.html

"I haven't experienced the problem you're talking about, so it must not exist."

I've found Spectacle leaves a bit of padding space under where the dock folds out - potentially useful, but unwanted in my case, and I wasn't able to find a setting to change that behaviour.

I use BetterSnapTool instead, which seems to have a better collection of settings and solves my (admittedly minor) gripe with Spectacle.

The monetary incentive aside - on principle, it's a good thing that a group of people can arrange with a politician to specify the policy they want to see and then vote for that politician to enact it, right?

> In other words, you clicked allow before your brain had time to stop you. How do you prevent this?

The simple solution to this specifically (which I think has been implemented already anyway for some Android rooting options?) is to have a few seconds of delay where the "Allow" button on the root permission request is greyed out.

I'm with you - totally unable to remember the contents of the last lightbox popup I dismissed, and I'd challenge anyone to honestly recall theirs if it wasn't within the last few minutes.

What about taking the generic domain name and redirecting to a domain name for your actual brand?

It absolutely makes sense not to display warnings that HTTPS isn't in use in circumstances where HTTPS is not feasible - i.e. local addresses. It's simple enough for a browser to determine. I don't think conditionally accepting a self-signed cert is necessary.

Agreed, I think it's less about being able to get it right, and more about being unable to get it wrong (because users can and will get it wrong in every way possible).

Linux is able to get it right in almost every way imaginable, but I can't think of any distro that's as resilient to the user as Windows. Almost all the bloat, crap, and bad decisions seem aimed ostensibly at making it difficult or impossible for the user to ruin their system, and obviously they still are far from impervious.

What client(s) do you use to access your bucket? What kind of sharing features do they have? Is there a web frontend? And how do you deal with eventual consistency?