The feature I don't want to pay for but would be nice to have: deeper level proxied wildcards.
> If you want to proxy a wildcard DNS record on a deeper level like .www.mycoolwebpage.xyz you can subscribe to Cloudflare Advanced Certificate Manager and get a certificate that is covering that wildcard ¹ ²
When building out services in my smart home, I started with something like 'home.domain.com'. I used Let's Encrypt for services like 'smart.home.domain.com' (and I think Cloudflare proxied these for free?) but realized I was losing some privacy since the subdomains were describing my network services. I also wasn't aware SSL certificates are a permanent record (though what isn't these days) and I had to be careful what names I was using.
I realized instead I could use Let's Encrypt wildcard feature '.home.domain.com' and at least limit the private details potentially leaked in certificate history. But because Cloudflare doesn't proxy deeper wildcard subdomains for free, I'd have to manually create each subdomain in Cloudflare DNS - defeating the privacy objective.
For now, instead of wildcards, I'm just using URL path prefixes. For example 'smart.home.domain.com' becomes 'home.domain.com/smart/'. This works pretty easily in a docker host with traefik handling domains, paths, and certificates. Some apps don't work under path prefixes without a lot of tweaks. And it works fine if it's one-to-one server to subdomain - but if I want to host another server at home I have to come up with another subdomain like 'app-home.domain.com'.
I could also move everything into something like tailscale. Then at least the domains are private. Right now I use an oauth2 proxy infront of my services - but most of them don't need direct internet access. The issue is, for the services that do need the convenience of direct access, tailscale funnel doesn't support custom domains.³ And even if eventually they do, maybe they'll also limit subdomain depth or wildcards.
Anyway for privacy reasons it'd be swell if deeper level subdomain certificates were part of the free tier.
I have set up let's encrypt with DNS challenge running a wildcard in on a subdomain. Its not a recursive wildcard, but for me, it works good enough. Some of the software I host in my home network expects to run as the root on a web server.
The DNS wildcard points to a 192.168.xxx.xxx address. I don't really care that the IP adres of my home server is public :)
How would any DNS service proxy wildcards? Is that something that’s actually supported as part of DNS? What actually gets resolved in that case? I’ve always had to register every domain/subdomain that should get proxied.
I use .lan.<domain>.net for my internal servers at work, through cloudflare dns. It's simple, all .lan get resolved to the same IP. And the server has something like caddy or nginx to take the traffic, see the destination, and forward properly into the network
Tarvis allows people to self host apps without managing servers. Each workspace gets their wild card cert at *.weightedreply.tarvis.site.
Then when any app is installed by user in their workspace, they get subdomians under that wildcard without leaking what apps are running there. N8n app gets n8n.weightedreply.tarvis.site and hermes gets hermes.weightedreply.tarvis.site.
The proxy and auth is handled by self hosted pomerium so no dns records are published for any app subdomians under that workspace url.
I am using Google certificate manager which is free to generate and manage these wildcard certs. I know Google is not preferred but that's the only free service I could find to do this.
The slope of addictive drugs with negative side effects starts with alcohol, then comes nicotine, pot, cocaine, crack, fentinal .... and then all the really exotic modern stuff. It is a spectrum. Some argue that there are upsides, and there are certainly uses for all these drugs, but no sane doctor would say they have no downsides, that unrestrained use is ever a good thing.
Alcohol has greater negative side effects than pot, and nicotine is more addictive than cocaine or pot. I’m not sure what you mean by “exotic modern stuff,” but if it includes hallucinogens (what people usually mean by modern/exotic drugs) then they’re not really addictive at all.
I ask because the scale reads more like a morality scale than anything based on actual negative effects, either in the individual or society.
Isn't it silly that this even needs to be a conversation? Shouldn't we be able to write in any language we want and have the bindings for it to work cross platform? And shouldn't AI aid in building those cross-platform tools?
Maybe React Native isn't the right choice - but two tech stacks for virtually identical interfaces is dumb. Three stacks if you include browsers.
Not sure if it is still like this, but jellyfin used to leak massive amounts of metadata. For example by checking the thumbnail paths (which were unauthenticated) you could see what shows/movies someone had.
Might want to warn the "friend" if they don't have auth on the tunnel itself.
They can also take action if they decide you're wasting their bandwidth or (especially) cache space. It's not allowed to host video files on any free cloudflare plan due to cache space.
Interesting. I had a 705 G4 (or 74 g5? Idk the one with the Ryzen 2400Ge) and the firmware supported putting the machine secure boot system on setup mode.
> The former software manager, for example, told TIME that 70% of his compensation was tied up in RSUs—and that he was four months away from $1 million in stock options vesting
If you are laid off without cause then shouldn't you be able to exercise those options early? Otherwise these contracts sound like scams.
Any information on future CPU's with support for hardware accelerated PQC algorithms? Will all my old devices become slow when PQC is the norm and encrypted communication is no longer hardware accelerated?
Only the asymmetric portion of the cryptography (which is only used in the handshake) will need to use PQC algorithms. Symmetric crypto algorithms (AES/ChaCha20/SHA-*), which are used after the handshake, are not as badly affected by quantum computing so they're not being replaced in the immediate term. I'm pretty sure that general purpose CPUs do not have hardware acceleration for the asymmetric crypto anyways.
you don't really need that tbh. you can get pretty good speedups using standard (vector) intrinsics. the new algorithms are (mostly) modular linear algebra (+ some concept of "noise").
> If you want to proxy a wildcard DNS record on a deeper level like .www.mycoolwebpage.xyz you can subscribe to Cloudflare Advanced Certificate Manager and get a certificate that is covering that wildcard ¹ ²
When building out services in my smart home, I started with something like 'home.domain.com'. I used Let's Encrypt for services like 'smart.home.domain.com' (and I think Cloudflare proxied these for free?) but realized I was losing some privacy since the subdomains were describing my network services. I also wasn't aware SSL certificates are a permanent record (though what isn't these days) and I had to be careful what names I was using.
I realized instead I could use Let's Encrypt wildcard feature '.home.domain.com' and at least limit the private details potentially leaked in certificate history. But because Cloudflare doesn't proxy deeper wildcard subdomains for free, I'd have to manually create each subdomain in Cloudflare DNS - defeating the privacy objective.
For now, instead of wildcards, I'm just using URL path prefixes. For example 'smart.home.domain.com' becomes 'home.domain.com/smart/'. This works pretty easily in a docker host with traefik handling domains, paths, and certificates. Some apps don't work under path prefixes without a lot of tweaks. And it works fine if it's one-to-one server to subdomain - but if I want to host another server at home I have to come up with another subdomain like 'app-home.domain.com'.
I could also move everything into something like tailscale. Then at least the domains are private. Right now I use an oauth2 proxy infront of my services - but most of them don't need direct internet access. The issue is, for the services that do need the convenience of direct access, tailscale funnel doesn't support custom domains.³ And even if eventually they do, maybe they'll also limit subdomain depth or wildcards.
Anyway for privacy reasons it'd be swell if deeper level subdomain certificates were part of the free tier.
¹ https://blog.cloudflare.com/wildcard-proxy-for-everyone/ ² https://developers.cloudflare.com/ssl/edge-certificates/adva... ³ https://github.com/tailscale/tailscale/issues/11563
reply