The DMZ

6:12 AM

Is there a reason to pay for SSL certificates instead of using free ones from something like letsencrypt.org ?

8:50 AM

@JohnZhau, I think paid certificates include some kind of insurance or warranty in case the CA is compromised, but I'm afraid that protection has never been useful to anyone anyway

also, I think that for some paid certificates you need to prove your identity in more secure ways, like providing documents, etc. In exchange for that, you get a certificate that will show something "cool" in browsers (like name or organization, green locks, etc.). But again, I'm not sure how useful this is, since notifications and address bars in browsers keep changing all the time

Conor Mancone

9:48 AM

@JohnZhau No.

@reed Indeed, that is an "Extended Validation" certificate. Not worth it.

MechMK1

11:59 AM

I have to disagree with @ConorMancone for once. There are reasons, although bad ones.

For example, you might have hardware that is externally reachable and thus needs a public certificate, but getting that certificate onto the machine is a huge Pain in the Ass. As such, having a cert that you need to renew 4 times a year may be less desireable than a certificate that is valid for, say 5 years.

Furthermore, you may be a non-tech business and your hosting provider may offer you a paid certificate for X moneys per year, whereas you'd have to do Let's Encrypt yourself. It may be less money to…

MechMK1

12:22 PM

TIL: You can easily create a .tar archive from an .m3u playlist, provided that that playlist lists local files (and not remote streams)

tar -cf Archive.tar -T Playlist.m3u

Conor Mancone

@MechMK1 Both good points

MechMK1

@ConorMancone Both reasons I encountered "In the wild"

I'm not saying they're good reasons though. Especially given that one essentially sold a Let's Encrypt certificate for 500 € per year

Of course, they'd say it's the labour they're selling

But I have to manually renew my certificate 4 times a year (No automatic renew for DNS challenges) and it's certainly not worth 125€ per pop for like 10 minutes of work

Conor Mancone

12:36 PM

@MechMK1 let's encrypt's certbot has some good options for easily extending it to add in your own logic during the renewal process. As a result if you're up for some scripting and your DNS "host" supports API calls, you can actually have certbot automate the renewal via DNS challenges.

I like let's encrypt :)

MechMK1

@ConorMancone I don't think they support it via API, and even if, it's probably a premium enterprise gold diamond feature

Conor Mancone

GCP and AWS both use let's encrypt for certificates they supply now. They are at least nice enough to not charge for it. Obviously though that's not the case everywhere. Having worked with some smaller hosting companies that didn't have good devops, I can see plenty of cases where let's encrypt just isn't an option.

For me though that would be reason enough to switch to a new hosting provider (although I'm a VPS guy these days anyway, so I always have full control)

MechMK1

VPS?

I assume that's a VM you control?

Conor Mancone

Oh yeah, acronyms. I forget that that one in particular has a million of them. Yes, Virtual Private Server, aka EC2 instance, aka VM, aka [insert a bunch of other options here]

MechMK1

1:05 PM

Nothing beats bare metal on your own desk at home :D

Upspeed? Uptime? Who gives a fuck

I don't need orchestration, I listen to metal.

Conor Mancone

1:27 PM

When it comes to actual internet-connected services I've never wanted to have to bother with setting up a DMZ with my router, port forwarding, worrying about IP address changes, etc.... Cloud compute resources are cheap these days - I think I pay $20/month for the couple VMs I use.

MechMK1

1:39 PM

My home server works for me. All I need to do is set up TeamSpeak

Plus I stream all my music from that server, which is super fast over the local wire

ThoriumBR

I have a bunch VPS scattered around, some I don't even know where they are and what they are done

the security on them is pretty tight, so I doubt anyone other than me are using them... I have one around for 7+ years that I host wireguard, transmission-daemon, apache/mysql, openvpn, pptp, pi-hole, and I don't know what else

it's a very small server, maybe 512MB ram, and I pay $7/mo... it's very useful when I am on the road and there's only open wifi... or I don't trust the wifi where I am... or the place has a hostile proxy...

I even have a python script running there that creates a vpn over websockets, and I run sshl (or sslh) to run openvpn, apache and ssh on the same 443 port...

with fixed ip, 250gb of disk, very good uplink and downlink, it's very convenient...

MechMK1

1:56 PM

I see my server more like a NAS that happens to run TeamSpeak as well

I am still giggling at the orchestration/metal pun :D

ThoriumBR

and I am more an orchestration guy...

MechMK1

Since I only have one server, I never felt the need

Conor Mancone

@MechMK1 It was pretty good :)

ThoriumBR

I have a bunch... in different countries as well

MechMK1

@ConorMancone I feel so stupid that I am laughing at my own joke

ThoriumBR

2:03 PM

you guys probably don't suffer from "this content is not available in piss-hole countries. get lost" as much as me...

MechMK1

Especially since only after I made it, there was a "metal" / "bare metal" pun in there too

ThoriumBR

so I have a VPS in Canada, US, France, Germany... so I can choose where I will come from

Conor Mancone

@MechMK1 If I didn't laugh at my own jokes then no one would :) I got a good chuckle out of it though, so I think you're fine

MechMK1

@ConorMancone I'd laugh at your jokes :D

Conor Mancone

@ThoriumBR I bet that makes it much easier to avoid being labeled as coming from a proxy

I've never actually setup a VPS as a VPN though, although I've considered it from time to time. I don't have much use for them in general though

The last time I used a VPN was to stream the olympics for free from England. I would have been happy to pay to stream the olympics, but because of how the thing was managed in the US, I actually couldn't have because of licensing from cable companies.

ThoriumBR

2:06 PM

a VPS with wireguard and pi-hole makes wonders... no ads nor tracking network-wide

Conor Mancone

Well, maybe I could have if I signed up for cable, but there was no way I was going to agree to a $100/month cable package just to stream the Olympics for 2 weeks - even if I could just cancel it afteward

ThoriumBR

I will buy a router where I can install openwrt, so I can send everything over wireguard, and every single device here is free from ads

and I am planning on creating a docker container, or ansible recipe, to create the "getaway gateway", with all sorts of vpn and proxies installed: tor, wireguard, pptp, ipsec, openvpn, sshuttle, pi-hole, socks-over-websockets, privoxy, sslh... so whatever the place I am, I can connect to it and escape to the internet. good luck firewall, good luck...

Conor Mancone

Nice! Yes, I've never had to deal with such issues. Didn't realize how spoiled I was...

socks-over-websockets... never would have occurred to me. As they say, "necessity is the mother of all invention".

Note to self: only hire devops people from countries with repressive internet restrictions :)

ThoriumBR

when you work on several different clients, that's very useful

it's not the country that is restritive, the clients are. some block even stackoverflow...

no url with forum on it can be accessed... no .exe nor .zip downloaded. no gmail or any webmail

MechMK1

Blacklists work so well...

ThoriumBR

2:14 PM

connection only to tcp 80,443, and dns.

so far, I never faced a firewall that could block me for long... they can block me until I fire up my hotspot on my phone and devise another workaround... that's why I have a pile of vpn there

reed

7:57 PM

-1

Q: Why letsencrypt certificate generation not done like domain verification done by GSuite?

I have used letsencrypt's certbot for creating certs for my domains. I have to download certbot and run in my machine and it gives a string to be placed in as dns record. I have to manually add the dns record. Then the certbot will verify it and generate my cert. I thought the process was cool co...

This user claims Google can automatically add DNS records to your domains, and the registrar will just ask you "Do you want Google to do that?". I can't believe such a procedure can happen. Can anyone confirm if it is possible?

Conor Mancone

They are just trying to make things convenient. It works by them integrating with your DNS registrar and managing records for you. It also only works for registrars "big" enough to support such an integration, and you have to explicitly give permission just like you do anytime you connect two separate systems.

So the short answer is: yes, what they are saying is accurate

reed

Damn Google, it's integrating everywhere like an infectious disease

Conor Mancone

To look at it from another angle, the major players can act as a DNS registrar themselves. For instance my company uses Route 53 as a DNS registrar, and so when I need AWS to generate a certificate for me (which AWS also does via let's encrypt), it's extremely easy. AWS uses let's encrypt via DNS validation, and AWS is also effectively in charge of the DNS, so when I create the certificate it just gives me a big button to push that automatically generates the DNS records.

It will then manage the renewals for me automatically in the future

I've also generated certificates in GCP (which it generated through let's encrypt), but I don't quite remember the details of the process. All I remember is that it was easy and automatic after I validated my ownership of the domain. In my case though I never gave GCP access to my registrar account - I created some DNS records with my registrar to prove ownership of the domain, and then after that I think GCP was happy to issue certificates for me.

reed

8:12 PM

yes, that's how it should work I guess. You add the record. I didn't expect Google to integrate with registrars that way

unless your registrar is Google itself, of course

anyway, however weird this "feature" is, I still hate it less than I hate Google AMP (accelerated mobile pages)

Transcript for