ivankuz

Thank you very much for such a clear explanation of what's happening. Yeah, I sensed that it's not a limitation of the nginx per-se, as it was asked not to do ssl termination, hence of course it can't extract header from the scrambled bytes. As I needed it to do grpc through asp.net, it is a kestrel requirement to do ssl termination that forced me to use the ssl-passthrough, which probably comes from a whole different can of worms.

It was the latest nginx at the time. I actually found a rather obscure issue on Github that touches on this problem, for those who are curious:

https://github.com/kubernetes/ingress-nginx/issues/1681#issu...

> We discovered a related issue where we have multiple ssl-passthrough upstreams that only use different hostnames. [...] nginx-ingress does not inspect the connection after the initial handshake - no matter if the HOST changes.

That was 5-ish years ago though. I hope there are better ways than the cert hack now.

A fun tale about wildcard certificates for internal subdomains:

The browser will gladly reuse an http2 connection with a resolved IP address. If you happen to have many subdomains pointing to a single ingress / reverse proxy that returns the same certificate for different Host headers, you can very well end up in a situation where the traffic will get messed up between services. To add to that - debugging that stuff becomes kind of wild, as it will keep reusing connections between browser windows (and maybe even different Chromium browsers)

I might be messing up technical details, as it's been a long time since I've debugged some grpc Kubernetes mess. All I wanted to say is, that having an exact certificate instead of a wildcard is also a good way to ensure your traffic goes to the correct place internally.

> so much of what the Soviets worked on feels rooted in a sort of “that’ll show them!” inferiority complex

That's what the Cold War was about, innit? Same reason why the US went to the moon.

I'm not sure I follow you on the energy topic? If anything, the "progressive" shutdown of the nukes was a rather questionable move.

In general, I think there's a relatively healthy balance, albeit, with a fair bit of animosity between the sides.

The thing about "outdated technologies" is - they work. It's really easy to see in the software world, where I will choose a battle-tested technology any day, over the new flashy thing that everybody's buzzing about that is in theory or with many iterations will be great. So why would other industries be different? Surely there will be a drag from people whose wealth depends on the technology/approach being used, but that's just how it works. If I put a lot of effort into developing a thing, I will defend the thing as much as I can, and it's the job of the newcomers to push me over with big enough arguments.

While not exhausting nor practical in its absolute, I frequently return to a phrase from The Brothers Karamazov by Dostoevsky:

> You need to love the life more than its meaning.

Purpose in life is important, but for a healthy mind being lost is fine. It's "the next step", something you will inevitably face again.

I'm not advocating for either side here, just want to explore my ideas for a bit.

During some rough patches of my life, I found solace in being vulnerable with my friends and speaking about how I felt.

At other times, taking a more stoic approach worked wonders. Learning to notice feelings and emotions without them leading you into a spiral of debilitating self-pity or self-loathing, for me, is the ultimate life skill. And to be honest, I only could really progress with such a skill in relative solitude.

The way I have it now, the approach of reaching out for help with mental space is more like going to a doctor. There's a certain threshold of suffering that needs to be reached, for you to take deliberate actions. Practising mindfulness and all the stoic narratives is more like doing fitness. It helps with the ongoing, everyday, low-key pain, as well as prepares you for the bigger issues in the future.

By default, when following `<a>` links from site FOO to site BAR, the browser will tell site BAR in the Referrer header[1], that you're coming from the site FOO.

If you add attribute `rel=noreferrer`[2] to the `<a>` tag, the browser will not attach such a header.

It looks like the guys from asahilinux dot org somehow altered the behaviour of their website in cases when Referrer was set to hackernews, so hn added the `rel=noreferrer` to those links.

No idea about the context of the drama though.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re... [2] https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...

That's awesome! I did something similar a while ago, but instead of Flappy Bird I merged wordle with Snake https://ivan.engineering/projects/snordle/

I'm using CyberChef (https://gchq.github.io/CyberChef/) quite a lot for different tasks.

I love the simplicity of writing a program in mere minutes and distributing it with a single link.

Very honorable mention to this topic would be https://www.ryeboard.com/.

They're moving quite fast and seemingly in the right direction.

I've been lately working with a lot of F# (thus its compiler and Rider IDE) and my take on “more powerful machines for development” is that it's quality of life improvement. When intellisense (or whatever it's called in different circles) works instantly, as well as go to definition, find usages, etc: it's just so much better than waiting even a second for those actions.

There's another side in need of compiling large projects regularly, which I didn't encounter much, but if my newest MBP with i9 took around 20 minutes to compile haskell-ide-engine, I imagine what compile times you can hit potentially in bigger projects and how unbearable it could be on any less powerful machines.