News for hackers. Stuff that matters.
Re:Another free CA as an alternative to Let's Encrypt by kuschku on Tuesday November 24, 2020 @02:35PM (#25202139)
> Pure FUD. It's such a non-issue. As you've been told many times.

If it's such a non-issue, why did matt say he wouldn't accept a PR that'd fix this?

Re:Another free CA as an alternative to Let's Encrypt by francislavoie on Tuesday November 24, 2020 @02:39PM (#25202180)
Because it would add unnecessary complexity to the system. It's a waste of time.
Re:Another free CA as an alternative to Let's Encrypt by ThePowerOfFuet on Wednesday November 25, 2020 @04:56AM (#25207565)
This has been a shitty thread to read, tbh. It's clearly not pointless if there are improvements which could be made to make the product more spec-compliant, such as handling terminating dots in Host headers. And I'm saying this as someone who's never used Caddy for anything, ever.
Re:Another free CA as an alternative to Let's Encrypt by francislavoie on Wednesday November 25, 2020 @05:05AM (#25207610)
If you want the background story: https://github.com/caddyserver/caddy/issues/1632

This is all from four years ago. And kuschku hasn't taken no for an answer after all this time. It's frustrating and annoying to hear their complaints on every HN thread since.

I agree with you the thread is shitty. I'm just hoping being direct will end the trolling.

Re:Another free CA as an alternative to Let's Encrypt by kuschku on Wednesday November 25, 2020 @06:02AM (#25207968)
Is it "trolling" if one expects a webserver to work like every other webserver, even offering to make the required changes?

If you want to learn why supporting FQDNs is important, you can actually read the issue and PR on the traefik repo where they chose to add support for this:

https://github.com/traefik/traefik/issues/4622 https://github.com/traefik/traefik/pull/4763

They just accepted the issue, and fixed it. Super easy, no 4 years of "no one needs this" "no you're wrong" "the specs are wrong" "you're trolling"

Re:Another free CA as an alternative to Let's Encrypt by francislavoie on Wednesday November 25, 2020 @06:09AM (#25208013)
Yes, because Caddy is not like every other webserver. It also automates TLS management, can act as an ACME server, etc.

You make it out to be a simple change, but it's really not. And the arguments for making any changes are not compelling enough to warrant the risks involved. Compliance for the sake of compliance is completely pointless.

Re:Another free CA as an alternative to Let's Encrypt by kuschku on Wednesday November 25, 2020 @06:17AM (#25208069)
> Yes, because Caddy is not like every other webserver. It also automates TLS management, can act as an ACME server, etc.

That’s why I’m comparing it to traefik, which can also automate TLS management, in the exact same way (even using the same libraries for most of the functionality, they’re after all both go webservers).

> And the arguments for making any changes are not compelling enough to warrant the risks involved

Why is it that you think you know better than the maintainers of e.g. traefik? It’s not like this is legacy functionality they kept around just for the sake of it, they added it in 2019 because there’s demand for it, today.

Re:Another free CA as an alternative to Let's Encrypt by mholt on Wednesday November 25, 2020 @12:36PM (#25211828)
> even using the same libraries for most of the functionality

You're wrong. Caddy uses a superior library that's been more stress-tested at scale in production: https://github.com/caddyserver/certmagic and https://github.com/mholt/acmez - neither of which lego uses. Bugs and limitations in lego caused severe problems for several of our larger customers.

Re:Another free CA as an alternative to Let's Encrypt by francislavoie on Wednesday November 25, 2020 @06:23AM (#25208111)
> even using the same libraries for most of the functionality

Actually no, not anymore.

https://github.com/caddyserver/caddy/pull/3621

> because there’s demand for it, today

We've only seen the demand from you. Nobody else. One individual isn't enough demand.

Re:Another free CA as an alternative to Let's Encrypt by znpy on Thursday November 26, 2020 @10:00AM (#25220545)
I wonder why that person won't switch to nginx, apache or something else completely, if caddy doesn't work for them.

At this point it's just a game of wasting other people's time.

Re:Another free CA as an alternative to Let's Encrypt by kuschku on Saturday November 28, 2020 @10:09AM (#25237959)
I’m not using caddy – but I get complaints that websites hosted on caddy servers don’t work with my tools, which follow the specs and require the absolute URL to work just as well as the relative one.

And I can’t remotely telepathically make all caddy users switch to nginx. So as long as a single HTTP server runs a version of caddy with this bug, I’ve got extra work to do, because the caddy people are wasting my time

Re:Another free CA as an alternative to Let's Encrypt by carstenhag on Wednesday November 25, 2020 @05:30PM (#25215011)
Hello, ironically it was me who has created that issue some years ago. I saw that http://ai./ works in a browser and wondered why chagemann.de. doesn't. The culprit was caddy, and the caddy maintainer didn't want to fix it (or apparently accept PRs fixing it). Not sure where the trolling is supposed to be at.