HackerTrans
TopNewTrendsCommentsPastAskShowJobs

msmith

no profile record

Submissions

Go fixes HTTP/2 rapid reset vulnerability

groups.google.com
9 points·by msmith·hace 3 años·0 comments

comments

msmith
·hace 5 meses·discuss
To mitigate the threat from an attacker who controls the network between the cert issuer and the DNS server, CAs will check the DNS records from multiple vantage points.

Let's Encrypt has been doing this for several years, and it's a requirement for all CAs as of 2024.

[1] https://cabforum.org/2024/08/05/ballot-sc067v3-require-domai...
msmith
·hace 2 años·discuss
1 is the lowest score. 10 is highest
msmith
·hace 2 años·discuss
- “G4” the TV network, not to be confused with the series of Mac computers
msmith
·hace 2 años·discuss
https://www.infracost.io/ might do what you're imagining
msmith
·hace 3 años·discuss
I had a similar experience in the same era. In addition to the deviant stuff I also used it to tinker with graphics programming using inline assembly for the “performance critical” (for a 386SX) parts. That experience definitely laid the foundation for what I do today.
msmith
·hace 3 años·discuss
This sounds like how we use a CVSS score to gauge the severity of software vulnerabilities.

Maybe the world needs a standardized place to catalog and rank all the data breaches that have been disclosed.
msmith
·hace 3 años·discuss
I feel the same way. What about Akamai, Fastly, or Okta? Maybe Cloudflare gets more attention because their low end plans are accessible to anyone.
msmith
·hace 3 años·discuss
It boggles my mind that Google Fiber has been available in Austin, TX for 10 years but is still not available in the communities next door to Google HQ.
msmith
·hace 3 años·discuss
I'm going to guess dboreham is Canadian?
msmith
·hace 3 años·discuss
I think you're assuming that the panic happens when a request is received, but it actually happens when a conflicting route is registered.

To me, that's reasonable behavior and is consistent with other things such as https://pkg.go.dev/regexp#MustCompile
msmith
·hace 3 años·discuss
Definitely. I have a couple use cases for it at <dayjob>.

Thanks for sharing that link. https://www.url2png.com/ is another I know about.
msmith
·hace 3 años·discuss
https://www.pagesnap.app/

Webpage screenshots as a service. I was scratching a personal itch with this one but maybe some day I will make it something others can use at scale.

Backend powered by Google Cloud Run, Pupeteer, and headless Chrome. Website is Next.js.
msmith
·hace 3 años·discuss
Also Go's HTTP/2 packages - https://news.ycombinator.com/item?id=37863419
msmith
·hace 3 años·discuss
Can your example be solved by having the k8s cluster resource reference the network resource’s “name” attribute?

Doing that allows Terraform to create both resources in one plan/apply step, and it also helps Terraform understand the dependency between the resources so that they are created in the correct order.
msmith
·hace 3 años·discuss
I use New Retirement and one of my biggest complaints about that app is that it expects you to provide the optimistic/pessimistic rate of return for each of your investment accounts. I would love to have a tool that provides some guidance on setting those numbers, based on historical returns and the asset classes in the account.

I can see value in having similar guidance for things like mortgage interest rates. Maintaining all of this educational content and keeping it up to date may be a challenge, though.
msmith
·hace 3 años·discuss
I love to see more tools like this for do-it-yourselfers like me. I've only just now tried using ProjectionLab for about 20 minutes, so take this with a grain of salt, but I've watched Rob Berger's review of the tool and I've been a subscriber to New Retirement for a few months now.

First impressions:

- It's obvious you've put a lot of love into this tool and it really shows. The UI is very responsive and I think I would enjoy using it.

- At first glance, it compares favorably to the core features in New Retirement: Tracking your assets and investments; Showing projections based on different scenarios and assumptions.

- I didn't see any places where it's providing financial planning suggestions. New Retirement offers "Digital Coach Suggestions" which recommends various things to look into, based on the information you enter. For me, that's a valuable feature because one of the reasons why I'd pay for a tool like this is so that it can help me poke holes in my financial plan.

- Your pricing is totally fine. I see your competition as financial planners who charge a few thousand dollars for a one-time financial plan or, worse, an ongoing 1% AUM fee. I've paid a human to do a financial plan. It was worth the money because it gave me the reassurance that I kinda know what I'm doing, but I didn't see the value in paying a recurring fee for them to "monitor" my investments going forward. I'd much rather pay for direct access to a tool that lets me do that myself.

- Despite the previous bullet point, I do see some value in having a human who can give good financial planning advice. I would pay a few hundred dollars to meet with a human who can give me useful advice whenever I'm at an inflection point in my financial life. Maybe that's another potential revenue source for you in the long run.
msmith
·hace 3 años·discuss
This is great. It reminds me that I tried to recreate this effect with Turbo Pascal back in the 90’s when I first got into programming.

Sneakers, Wargames, and BBS culture were pretty influential for me at the time.
msmith
·hace 3 años·discuss
Oh, right. I meant to say 14” MBP in my parent post.
msmith
·hace 3 años·discuss
Does it support more than one external display? The lack of that feature was the primary thing that drove me to choose a 13" MacBook Pro instead.