• 0 Posts
  • 67 Comments
Joined 3 years ago
cake
Cake day: June 25th, 2023

help-circle


  • Jet says the following

    If you want https it’s gotta be a external DNS record anyway, might as well point to internal ips

    My point is, the A record, the one pointing to an IP address, doesn’t need to be public/external, it’s not needed for the wildcard cert, so it can be kept internal.

    I’m mentioning the other challenge trying to make it clear why the record matters for that, and not for a wildcard cert, sorry if that just made things more confusing.


  • The point is, the challenge doesn’t require a public DNS A record pointing to your IP, it’s not involved in issuing a wildcard certificate. It requires you to control DNS records for the domain to issue a temporary TXT or something record to prove it, one which you can remove afterwards. This was my point in the original comment.

    It’s A and AAAA records that are used when you open a website in a browser to map the domain to an IP address, the ones I’m saying don’t need to be public.

    The challenge dosent require your site to be public only the DNS to be public.

    And just to be clear, that was describing a different kind of challenge, the simpler one which most people probably use, and which does actually involve A records.


  • I’m a bit confused by what you’re saying, because to my knowledge the DNS entry you’re mentioning won’t help with getting a certificate at all. Challenges will typically require either having the DNS entry point to a publicly reachable website (doesn’t get you wildcard) or proving the ability to modify records for the domain by adding something like a TXT record on the fly, which shouldn’t require A/AAAA records.

    So you should be able to do the second type of challenge without a global A record to get a wildcard certificate, and use local DNS for the A record?


  • If you want https it’s gotta be a external DNS record anyway

    Not sure what you mean by that, but off the top of my head, you can get certificates via challenges that prove DNS control (rather than checking if the DNS points to your server), and you can get wildcard certificates so you don’t even have to expose the existence of subdomains.

    And that’s ignoring the option of using your own CA, which only really works with your own devices, but for local access might be viable.






  • IIRC he was telling people to spam sponsorblock with fake segments, because in some videos he had parts where he just stopped discussing the topic and talked to his (sickly?) cat when it came by, and people were accurately marking those segments as offtopic or whatever it’s called. He was presenting it as evil sponsorblock blocking his sick elderly cat. I could try to find a link later when I’m at my PC.

    Other than that, he’s generally alarmist and arrogant, but I do appreciate him and what he’s doing.




  • People looking up alternatives doesn’t mean they actually want to use them. Switching to an alternative necessarily means some pains, in terms of changed interface, functionality, and community. You can’t just magically switch between platforms and have all the people follow you there, and that’s a dealbreaker for many.

    As far as I know, the fediverse is growing, just not explosively. We can hope that at some point it reaches a threshold that convinces a lot of people to move over, cementing it as a “proper” platform.






  • I’ve gotten such symptoms before when running out of RAM - I’m on Arch and never bothered setting anything up for that instance and I’m not sure what’s going on, but I think the system is struggling to recover memory or something before it resorts to killing processes, and would sometimes freeze for a minute like that.

    That said, yeah… Kernel modules (which device drivers often are) are allowed to run at a higher level of privilege, with less oversight, more access to hardware and better performance, so if they misuse that privilege they can break things badly. And with proprietary drivers, you have no idea or control of what it’s actually doing, so you can only try to downgrade or wait and hope the company fixes it.