asdfghjhgfderty

it's insane to expect the opposite: that traffic in my own network will need to keep reaching to a certificate authorities outside to validate packages from one host to another.

if you don't understand why these 3 things are on top of tcp, well, nevermind, I was going to say you shouldn't be designing networks buy you migth be already on the quic steering committee.

most committee now are a joke so that some googler middle mamaget makes it to jr director. sigh.

they are simply constructing GET request headers "by hand " based on some xml file downloaded earlier an then sendind that list of GET via `nc`. the example is just over confusing and using file named as 1, 2

I voted up because that is indeed neat tho.

> In a theoretical future world where 99% of site operators have set this up for protection, and 99% of users are using approved browsers, how would one do something like [compete with apple or google]

A: they won't. and that's the plan. not to mention that now those are the only two players (microsoft a late third) that can both attest you and profile you locally on the device for advertising profiling.

sadly, you are completely wrong. just look at captcha usage.

yeah, very few follow the original recommendation of showing captcha for ips that already showed signs of being bots etc.

but the vast majority shows captchas for absolutely anything. I can't even book a dmv appointment today without answering a gratutious one.

same will surely happen with PAT, especially because it is so easy for the implementer to shove it everywhere. people are lazy and dumb.

nothing on the spec prevents arbitrary data on body of a GET. but clients and proxies are implemented by lazy people who make excuses they are preserving some legacy security feature or something and continue to ignore the spec.

didn't see much about security

nonsense.

autoconf didn't have a core developer. But it had many distro package managers.

there's nobody adding code/fixing bugs, but there are plenty people reading and looking at diffs before packaging it in distros.

then the js libs have neither core maintainers nor anybody at npm corp that cares about security or reading anything.

the top comment is correct to care about those before system libraries.