• 0 Posts
  • 23 Comments
Joined 1 year ago
cake
Cake day: June 29th, 2023

help-circle


  • Explaining my job is trivial compared to the insanity I cook up in my spare time.

    Oh, so you like gaming? No, I’m actually not playing the game. I’m building a mod for it. Erm, okay, so this is for other players then? No, I’m mostly building it for myself. Ah, so you haven’t put a lot of time into it yet? Roughly 12 years. What? So what does the mod do then? It plays the game for me, and publishes in-game metrics to a monitoring application, so that I can see the progress of the game in an abstract form while I’m on the couch, thinking about how to optimize the automation further.

    Regular fun stuff.




  • I actually agree. For the majority of sites and/or use cases, it probably is sufficient.

    Explaining properly why LE is generally problematic, takes considerable depth of information, that I’m just not able to relay easily right now. But consider this:

    LE is mostly a convenience. They save an operator $1 per month per certificate. For everyone with hosting costs beyond $1000, this is laughable savings. People who take TLS seriously often have more demands than “padlock in the browser UI”. If a free service decides they no longer want to use OCSP, that’s an annoying disruption that was entirely not worth the $1 https://www.abetterinternet.org/post/replacing-ocsp-with-crls/

    LE has no SLA. You have no guarantee to be able to ever renew your certificate again. A risk not anyone should take.

    Who is paying for LE? If you’re not paying, how can you rely on the service to exist tomorrow?

    It’s not too long ago that people said “only some sites need HTTPS, HTTP is fine for most”. It never was, and people should not build anything relevant on “free” security today either.


  • gencha@lemm.eetoSelfhosted@lemmy.worldPaid SSL vs Letsencrypt
    link
    fedilink
    English
    arrow-up
    2
    arrow-down
    16
    ·
    7 days ago

    People who have actually relevant use cases with the need for a reliable partner would never use LE. It’s a gimmick for hobbyists and people who suck at their job.

    If you have never revoked a certificate, you don’t really know what you’re doing. If you have never run into rate-limiting issues with LE that block a rollout, you don’t know what you’re doing.

    LE works until it doesn’t, and then it’s like every other free service on the internet: no guarantees If your setup relies on the goodwill of a single entity handing out shit for free, it’s not a robust setup. If you rely on that entity to keep an OCSP responder alive for free so all your consumers can verify the validity of your certificate, that’s not great. And people do this to save their company $1 a month for the real thing? Even running the shitty certbot in compute has a larger cost. People are so blindly in love with this “free” garbage. The fanboys will never die off





  • Yes and no:

    For example, on or about December 26, 2018, SMITH emailed two coconspirators that, “We need to get a TON of songs fast to make this work around the anti-fraud policies these guys are all using now.”

    To obtain the necessary number of songs for his scheme to succeed, SMITH eventually turned to artificial intelligence. In or about 2018, SMITH began working with the Chief Executive Officer of an AI music company (“CC-3”) and a music promoter (“CC-4”) to create hundreds of thousands of songs using artificial intelligence that SMITH could then fraudulently stream. CC-3 soon began providing SMITH with thousands of songs each week that SMITH could upload to the Streaming Platforms and manipulate the streams for.








  • Numbers give the wrong impression that one version follows another. Debian release channels exit alongside each other individually. Giving the release channels names helps to make that distinction. It also makes for an easy layout of packages in APT repositories.

    Sid is and always has been Sid. If you were to assign numbers, what number should replace that name? There are perfectly working labels for release channels and there is no reasonable replacement.



  • I feel like most people base their decision on license purely on anecdotes of a handful of cases where the outcome was not how they would have wanted it. Yet, most people will never be in that spot, because they don’t have anything that anyone would want to consume.

    If I had produced something of value I want to protect, I wouldn’t make it open in the first place. Every piece of your code will be used to feed LLMs, regardless of your license.

    It is perfectly fine to slap MIT on your JavaScript widget and let some junior in some shop use it to get their project done. Makes people’s life easier, and you don’t want to sue anyone anyway in case of license violations.

    If you’re building a kernel module for a TCP reimplementation which dramatically outperforms the current implementation, yeah, probably a different story