News for hackers. Stuff that matters.

nsheridan

Expires header in the past is typically used to prevent caching.

The lower-case headers is part of the http2 specification.

An SSH private key isn't "something you have" - it's not a physical object, you can make copies of it.

To me it falls into "something you know". You might not be able to type it from memory into a file but in practical terms it's no different to a password, it just usually happens to reside on disk.

Re:How to Get Started in Soldering for Beginners on Monday April 10, 2023 @10:04AM (#35512445)
Lead solder is totally attainable for hobbyists - I bought a 100g spool a few weeks ago.
I use them for personal machines, and have deployed them in the past in work environments. A few years ago I wrote a CA which can exchange oauth tokens for signed keys: https://github.com/nsheridan/cashier

Auth is handled in a browser e.g. by Google, and the CA will sign a key and return a cert with a valid token.

> I always thought it was funny that I did the same job before and after the certs.

It’s often more advantageous for the company to have people with certs (it was with MCSE and such in the 90s anyway) - more MCSE etc on staff meant it was possible for the company to attain higher partnership levels with Microsoft which often meant more lucrative contracts and so on.

So while you may have been doing the same job as before, just by having the getting the certs you added more value to the business.

Re:Cloudflare had a partial outage on Tuesday June 21, 2022 @06:58AM (#31822489)
SLA - correct. That’s the contract between the operator and the users which describes the penalties for not meeting agreed-upon SLO

SLO - service level objective, the stated availability (or latency or durability etc) of the service. Usually expressed as a value over a period of time (e.g 99.9% availability as measured over a moving 30 average). The SLO is measured by the SLI.

SLI - service level indicator. Simply, the direct measurement of the service (i.e metrics)

SRE - Site Reliability Engineer, usually a member of a team who is responsible for the continued availability of the service and the poor sap who gets paged when it breaches SLO or has an outage or other impactful event.

Not to mention fire suppression systems and electrical risks.
Re:Adding a security key to Gmail on Thursday April 13, 2017 @02:16AM (#14104561)
There's noting stopping you from scanning the barcode multiple times
Re:Ask HN: What are some good technology blogs to follow? on Sunday March 12, 2017 @03:34PM (#13852574)
I'm very happy with inoreader
Re:OpenSSH Keys: A Walkthrough on Sunday January 22, 2017 @04:04PM (#13457454)
This exists - http://man7.org/linux/man-pages/man1/ssh-keygen.1.html#CERTI... - though the tooling is a bit bare-bones. There are some tools written to use certificates though, such as Netflix's BLESS (https://github.com/Netflix/bless), Gravitational Teleport (https://github.com/gravitational/teleport) and my own (https://github.com/nsheridan/cashier)
Re:AT&T Is in Advanced Talks to Acquire Time Warner on Saturday October 22, 2016 @09:21AM (#12768569)
Ireland: 360/36 €60pm. No tv.
Re:New storage classes for Google Cloud Storage on Thursday October 20, 2016 @06:28PM (#12756723)
I really wish AWS would introduce domain verification for 'domain-shaped' bucket names.
Re:Scalable and secure access with SSH on Monday September 12, 2016 @04:58PM (#12483619)
For (possibly) smaller scale I wrote a self-service SSH CA: https://github.com/nsheridan/cashier
This is interesting. I wrote a service for issuing user ssh certs but it doesn't manage host certs.

https://github.com/nsheridan/cashier

Re:The little ssh that (sometimes) couldn't on Monday October 29, 2012 @03:03PM (#4713886)
It's pretty much unmaintained.

Every host it's installed on has to be properly tuned. Fine for large setups where finely tuned TCP stacks are the norm and maintaining your own ssh isn't much overhead, probably not fine for most setups where the 2MB buffer does the job. "To compute the BDP, we need to know the speed of the slowest link in the path and the Round Trip Time (RTT)". Do you know the slowest link in the path for everything you want to conceivably connect to?

The patches were an exercise in trying to max out high bandwidth connections using scp under ideal lab conditions, nothing more.

Re:Ask HN: How to deal with losing interest in your passion? on Monday September 24, 2012 @05:38PM (#4567144)
I lost interested in everything for.. a while, right around when I was diagnosed with depression. After eventually getting on the right brain medicine, I found my desire to work on the things I enjoy came back with a vengeance. Now I just need to make sure it doesn't happen again :)
Re:iOS 6 and OS X 10.8.2 Now Available on Wednesday September 19, 2012 @02:16PM (#4544755)
Witchcraft!
Re:Yeoman: Modern workflows for modern webapps on Monday September 10, 2012 @05:41PM (#4502416)
Worse, this script goes on to install homebrew using 'curl -k ...|ruby'. Yeah, no thanks.
Re:Yeoman at your service - A getting started guide on Monday September 10, 2012 @05:37PM (#4502401)
I can't be the only person who hates install instructions like 'curl -L some.host|bash'. Not to mention that the yeoman install script happily installs homebrew using 'curl -k ... |ruby'. No thanks.
Re:Pasting Text Into Vim on Thursday July 26, 2012 @05:59AM (#4295241)
My .vimrc contains: set pastetoggle=<F2>

Life is suddenly easier :)

3.0 was for tablets, not for phones.
I'd recommend against putting the socket in /tmp. Anyone can reuse the connection.