« first day (3492 days earlier)      last day (84 days later) » 

6:12 AM
Is there a reason to pay for SSL certificates instead of using free ones from something like letsencrypt.org ?
 
 
3 hours later…
8:50 AM
@JohnZhau, I think paid certificates include some kind of insurance or warranty in case the CA is compromised, but I'm afraid that protection has never been useful to anyone anyway
also, I think that for some paid certificates you need to prove your identity in more secure ways, like providing documents, etc. In exchange for that, you get a certificate that will show something "cool" in browsers (like name or organization, green locks, etc.). But again, I'm not sure how useful this is, since notifications and address bars in browsers keep changing all the time
 
9:48 AM
@JohnZhau No.
@reed Indeed, that is an "Extended Validation" certificate. Not worth it.
 
 
2 hours later…
11:59 AM
I have to disagree with @ConorMancone for once. There are reasons, although bad ones.

For example, you might have hardware that is externally reachable and thus needs a public certificate, but getting that certificate onto the machine is a huge Pain in the Ass. As such, having a cert that you need to renew 4 times a year may be less desireable than a certificate that is valid for, say 5 years.

Furthermore, you may be a non-tech business and your hosting provider may offer you a paid certificate for X moneys per year, whereas you'd have to do Let's Encrypt yourself. It may be less money to
 
12:22 PM
TIL: You can easily create a .tar archive from an .m3u playlist, provided that that playlist lists local files (and not remote streams)
tar -cf Archive.tar -T Playlist.m3u
 
@MechMK1 Both good points
 
@ConorMancone Both reasons I encountered "In the wild"
I'm not saying they're good reasons though. Especially given that one essentially sold a Let's Encrypt certificate for 500 € per year
Of course, they'd say it's the labour they're selling
But I have to manually renew my certificate 4 times a year (No automatic renew for DNS challenges) and it's certainly not worth 125€ per pop for like 10 minutes of work
 
12:36 PM
@MechMK1 let's encrypt's certbot has some good options for easily extending it to add in your own logic during the renewal process. As a result if you're up for some scripting and your DNS "host" supports API calls, you can actually have certbot automate the renewal via DNS challenges.
I like let's encrypt :)
 
@ConorMancone I don't think they support it via API, and even if, it's probably a premium enterprise gold diamond feature
 
GCP and AWS both use let's encrypt for certificates they supply now. They are at least nice enough to not charge for it. Obviously though that's not the case everywhere. Having worked with some smaller hosting companies that didn't have good devops, I can see plenty of cases where let's encrypt just isn't an option.
For me though that would be reason enough to switch to a new hosting provider (although I'm a VPS guy these days anyway, so I always have full control)
 
VPS?
I assume that's a VM you control?
 
Oh yeah, acronyms. I forget that that one in particular has a million of them. Yes, Virtual Private Server, aka EC2 instance, aka VM, aka [insert a bunch of other options here]
 
1:05 PM
Nothing beats bare metal on your own desk at home :D
Upspeed? Uptime? Who gives a fuck
I don't need orchestration, I listen to metal.
 
1:27 PM
When it comes to actual internet-connected services I've never wanted to have to bother with setting up a DMZ with my router, port forwarding, worrying about IP address changes, etc.... Cloud compute resources are cheap these days - I think I pay $20/month for the couple VMs I use.
 
1:39 PM
My home server works for me. All I need to do is set up TeamSpeak
Plus I stream all my music from that server, which is super fast over the local wire
 
I have a bunch VPS scattered around, some I don't even know where they are and what they are done
the security on them is pretty tight, so I doubt anyone other than me are using them... I have one around for 7+ years that I host wireguard, transmission-daemon, apache/mysql, openvpn, pptp, pi-hole, and I don't know what else
it's a very small server, maybe 512MB ram, and I pay $7/mo... it's very useful when I am on the road and there's only open wifi... or I don't trust the wifi where I am... or the place has a hostile proxy...
I even have a python script running there that creates a vpn over websockets, and I run sshl (or sslh) to run openvpn, apache and ssh on the same 443 port...
with fixed ip, 250gb of disk, very good uplink and downlink, it's very convenient...
 
1:56 PM
I see my server more like a NAS that happens to run TeamSpeak as well
I am still giggling at the orchestration/metal pun :D
 
and I am more an orchestration guy...
 
Since I only have one server, I never felt the need
 
@MechMK1 It was pretty good :)
 
I have a bunch... in different countries as well
 
@ConorMancone I feel so stupid that I am laughing at my own joke
 
2:03 PM
you guys probably don't suffer from "this content is not available in piss-hole countries. get lost" as much as me...
 
Especially since only after I made it, there was a "metal" / "bare metal" pun in there too
 
so I have a VPS in Canada, US, France, Germany... so I can choose where I will come from
 
@MechMK1 If I didn't laugh at my own jokes then no one would :) I got a good chuckle out of it though, so I think you're fine
 
@ConorMancone I'd laugh at your jokes :D
 
@ThoriumBR I bet that makes it much easier to avoid being labeled as coming from a proxy
I've never actually setup a VPS as a VPN though, although I've considered it from time to time. I don't have much use for them in general though
The last time I used a VPN was to stream the olympics for free from England. I would have been happy to pay to stream the olympics, but because of how the thing was managed in the US, I actually couldn't have because of licensing from cable companies.
 
2:06 PM
a VPS with wireguard and pi-hole makes wonders... no ads nor tracking network-wide
 
Well, maybe I could have if I signed up for cable, but there was no way I was going to agree to a $100/month cable package just to stream the Olympics for 2 weeks - even if I could just cancel it afteward
 
I will buy a router where I can install openwrt, so I can send everything over wireguard, and every single device here is free from ads
and I am planning on creating a docker container, or ansible recipe, to create the "getaway gateway", with all sorts of vpn and proxies installed: tor, wireguard, pptp, ipsec, openvpn, sshuttle, pi-hole, socks-over-websockets, privoxy, sslh... so whatever the place I am, I can connect to it and escape to the internet. good luck firewall, good luck...
 
Nice! Yes, I've never had to deal with such issues. Didn't realize how spoiled I was...
socks-over-websockets... never would have occurred to me. As they say, "necessity is the mother of all invention".
Note to self: only hire devops people from countries with repressive internet restrictions :)
 
when you work on several different clients, that's very useful
it's not the country that is restritive, the clients are. some block even stackoverflow...
no url with forum on it can be accessed... no .exe nor .zip downloaded. no gmail or any webmail
 
Blacklists work so well...
 
2:14 PM
connection only to tcp 80,443, and dns.
so far, I never faced a firewall that could block me for long... they can block me until I fire up my hotspot on my phone and devise another workaround... that's why I have a pile of vpn there
 
 
6 hours later…
7:57 PM
-1
Q: Why letsencrypt certificate generation not done like domain verification done by GSuite?

Mani BharathyI have used letsencrypt's certbot for creating certs for my domains. I have to download certbot and run in my machine and it gives a string to be placed in as dns record. I have to manually add the dns record. Then the certbot will verify it and generate my cert. I thought the process was cool co...

This user claims Google can automatically add DNS records to your domains, and the registrar will just ask you "Do you want Google to do that?". I can't believe such a procedure can happen. Can anyone confirm if it is possible?
 
They are just trying to make things convenient. It works by them integrating with your DNS registrar and managing records for you. It also only works for registrars "big" enough to support such an integration, and you have to explicitly give permission just like you do anytime you connect two separate systems.
So the short answer is: yes, what they are saying is accurate
 
Damn Google, it's integrating everywhere like an infectious disease
 
To look at it from another angle, the major players can act as a DNS registrar themselves. For instance my company uses Route 53 as a DNS registrar, and so when I need AWS to generate a certificate for me (which AWS also does via let's encrypt), it's extremely easy. AWS uses let's encrypt via DNS validation, and AWS is also effectively in charge of the DNS, so when I create the certificate it just gives me a big button to push that automatically generates the DNS records.
It will then manage the renewals for me automatically in the future
I've also generated certificates in GCP (which it generated through let's encrypt), but I don't quite remember the details of the process. All I remember is that it was easy and automatic after I validated my ownership of the domain. In my case though I never gave GCP access to my registrar account - I created some DNS records with my registrar to prove ownership of the domain, and then after that I think GCP was happy to issue certificates for me.
 
8:12 PM
yes, that's how it should work I guess. You add the record. I didn't expect Google to integrate with registrars that way
unless your registrar is Google itself, of course
anyway, however weird this "feature" is, I still hate it less than I hate Google AMP (accelerated mobile pages)
 

« first day (3492 days earlier)      last day (84 days later) »