Hacker News new | past | comments | ask | show | jobs | submit | xnyanta's comments login

I am happily using them for all of my domains they support. The problem with Cloudflare registrar is that they flat out don't support many domains/tlds.


DoH will prevent government from hijacking your query in the first place. These blockades are only possible because of DNS being clear text and suceptible to MITM


That's one level of security, but even for DoH, it's possible for entities to attack and control an HTTPS server, returning falsified DNS queries, and now the antigovernment.com website you logged in to talk about anti-government politics is actually run by government. The only way to prevent that is via DNSsec to make sure that antigovernment.com goes to a real antigovernment.com server.


This makes no sense whatsoever.

If the government can transparently MITM your HTTPS connections with the DoH server, they can just as well MITM your connection to the real antigovernment.com server regardless of what DNS you use. And in fact, if they can't MITM your connection to the real antigovernment.com, they also can't trick you to talk to their fake antigovernment.com regardless of intercepting your DNS: you will connect to the attacker IP, the attacker IP will give you a bogus certificate, your browser will refuse to connect.


Wait what do you mean? They can have an HTTPS server and MITM, but how can they get a certificate for the DoH server I use?


They only need a certificate signed by an authority trusted by your resolver. And, unlike for the website itself, your browser does not show certificate information for the DoH server.

DoH also does not solve the problem of where the DNS server you use gets its information from: A government can compromise the other side as well.


So, like, you are assuming someone using a resolver that ignores the certificate chain of trust, as an evidence that DoH is not useful?

Do your program language _show_ you the certificate information when you use an http library to connect to an HTTPS service?

Sure the other end of the DNS query may not be encrypted, but I can easily decide which government to trust, and run my DoH server there.


> your browser does not show certificate information for the DoH server.

It doesn't show it, but I expect it would put up an error message if the DoH server's cert is invalid.


>it's not that hard to run an audio cable back from the TV to an audio receiver

Wait until you find out that many consumer sound bars (Sonos comes to mind) only support the latest and greatest digital audio formats over eARC.


OK but audio technology of the 80s sounds better than the "latest and greatest formats" on a shitty soundbar so who cares?


Speak for yourself but I'd rather have LPCM surround audio than deal with proprietary formats like Dolby Digital and DTS which are the only way to get surround without using eARC over HDMI.

This has literally nothing to do with any kind of sound bar, toast0's reply to your original comment explains the situation in detail.


There is another way: decode it in your media centre and send it analogue to your amplifier. Remember when media centres were actually capable? It has to be decoded to analogue somewhere. Dolby digital and DTS are not the only way to get surround (also good stereo is better than shit surround, but let's assume you mean good surround).

The whole thing about HDMI is a circular argument. You can only use HDMI because you can only use HDMI. There's nothing technical stopping another cable supporting this stuff. That was my original point. We're in this situation for silly reasons, not technical reasons.


So true, I picked up the Samsung G80SD "Smart Monitor" and the deciding factor was literally just that it supports eARC, allowing me to use my Sonos Beam soundbar with my computer and supporting compressed audio formats like Dolby Atmos.

To make things even worse, this monitor supports sending back the ARC audio over DisplayPort, but only in stereo. If I use HDMI between the monitor and the computer, I get all of audio channels.


If you want your devices on your LAN to have publicly routable IP addresses, by definition they need to be GUA. I think you just mis-understand what end-to-end connectivity means.

Your "WAN" is a small transit subnet between your router and your ISPs, while the "LAN" is the actual public ip space you will be assigning to your end devices.

>If an address is publicly routable, what's "LAN" about it?

Routable or not, it's LAN because it's in your network behind your router. It's just an identifier.


Pretty sure nix-darwin + its homebrew integration could set up 99% of this with a pull of your configuration repo and a single installation command.


After fiddling with it for months, potentially


You might be over-estimating how long it takes to write a Nix config.

Just start with a reasonable Nix config and take it from there by comparing with nix-darwin and home-manager configuration pages.

I know people who did it over a weekend.


Shameless plug: I maintain a Nix for MacOS configuration starter that has a step by step guide on getting started (725+ stars).

https://github.com/dustinlyons/nixos-config


Never used nix-darwin, but if it’s even a fraction as capable as NixOS, I believe it.


Samsung Internet is a really good browser though, definitely my favorite on Android


This was my immediate though while reading thr article. Why should the kubernetes authors be burdened by having to maintain an LTS release.

That should be Red Hat's job, just like they do with RHEL.


You definitely don't need to drain your nodes. I have never drained my nodes on my peronal cluster and just update and restart the control-plane components.

The procedure is more of a cloud-ism where people don't upgrade their nodes in place but rather get entirely new nodes.


Super interesting read, definitely nostalgic. Are you planning to further expand gala's functionality to use a different exploit to gain persistence in the exploit chain for an untethered jailbreak?


Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: