Hacker News: growse

New comment by growse in "Why DMARC's new "NP" tag can fail with DNSSEC"

growse — Sun, 05 Jul 2026 18:07:24 +0000

> Summary: it's not DNSSEC itself, it's DNS providers like Cloudflare returning incorrect data to make responses shorter and avoid switching to TCP.

I feel like we need the angry goose meme here.

"But why are those providers returning incorrect data?"

New comment by growse in "Are we self-sovereign PKI yet?"

growse — Tue, 26 May 2026 20:52:48 +0000

> No one.

I thought everyone was "trying so hard to re-invent PGP".

> we do need a single key that can be used for all those things

We do? This is not obvious. Why does my disk encryption key need to be the same that I use to sign binaries that I release?

New comment by growse in "Are we self-sovereign PKI yet?"

growse — Tue, 26 May 2026 20:15:08 +0000

Who's reinventing a tool that can do all that?

New comment by growse in "Are we self-sovereign PKI yet?"

growse — Tue, 26 May 2026 19:06:16 +0000

> Everyone is trying so hard to re-invent PGP

Which bit of PGP?

Show HN: Aptmatic – a TUI for managing apt across a bunch of Debian boxes

growse — Sat, 09 May 2026 10:46:28 +0000

Article URL: https://crates.io/crates/aptmatic

Comments URL: https://news.ycombinator.com/item?id=48073849

Points: 3

# Comments: 0

Screw You, Realtek

growse — Mon, 04 May 2026 08:55:37 +0000

Article URL: https://www.growse.com/2026/05/02/screw-you-realtek.html

Comments URL: https://news.ycombinator.com/item?id=48006203

Points: 4

# Comments: 1

New comment by growse in "GnuPG – post-quantum crypto landing in mainline"

growse — Sun, 26 Apr 2026 08:32:42 +0000

I don't know enough about either the technical nuance or the political drama, but some observers have noted that GnuPG's implementation is (deliberately?) incompatible with the IETF's standards. It's not clear why.

https://floss.social/@hko/116459621169318785

New comment by growse in "IPv6 traffic crosses the 50% mark"

growse — Thu, 16 Apr 2026 14:51:04 +0000

Maybe your company's ISP is CGNat'ting you?

New comment by growse in "IPv6 traffic crosses the 50% mark"

growse — Thu, 16 Apr 2026 07:13:53 +0000

A non-trivial minority of the time, they don't support IPv4 either!

New comment by growse in "More common mistakes to avoid when creating system architecture diagrams"

growse — Sun, 22 Mar 2026 18:38:36 +0000

I do similar, but frame it in terms of dependencies.

The database can live without the web server, but the web server doesn't work without the database.

Therefore webserver ---> database.

Key thing in that these deployment / context / container diagrams don't have a temporal axis. If you want to represent a flow, then you want a diagram where time has directionality, like a sequence diagram.

New comment by growse in "Cert Authorities Check for DNSSEC from Today"

growse — Tue, 17 Mar 2026 06:39:17 +0000

If I accidentally yank the power cable out of my load balancer, I can plug it back in and I'm back up and running.

If I cock up my DNSSEC config, nobody can resolve any records under my org's domain (goodbye internal email!) and you've got to twiddle your thumbs for a period of time waiting for various timeouts to pass (go ask Slack how it went for them).

These things are not the same.

New comment by growse in "Cert Authorities Check for DNSSEC from Today"

growse — Mon, 16 Mar 2026 18:48:52 +0000

> As if DNS isn't a major contributing to A LOT of downtime. That doesn't mean it's not worth doing not investing in making deployment more seamless and less error prone.

Ah yes. Let's take something that's prone to causing service issues and strap more footguns to it.

It's not worth it, because the cost is extremely quantifiable and visible, whereas the benefits struggle to be coherent.

New comment by growse in "Cert Authorities Check for DNSSEC from Today"

growse — Mon, 16 Mar 2026 18:46:53 +0000

That entire post is that you should enable DNSSEC because it's "more secure", and there are no reasons not to.

"More secure" begs the question "against what?", which the blog post doesn't seem to want to go into. Maybe it's secure from hidden tigers.

My favourite DNSSEC "lolwut" is about how people argue that it's something "NIST recommends", whilst at the same time the most recent major DNSSEC outage was......... time.nist.gov! (https://ianix.com/pub/dnssec-outages.html)

New comment by growse in "Inspecting the Source of Go Modules"

growse — Sun, 15 Feb 2026 13:49:17 +0000

If you're in (for example) a CI context and do a git checkout @tag, there's no guarantee that you'll get the same content as the last time you fetched that tag.

Tags are not immutable.

New comment by growse in "MinIO repository is no longer maintained"

growse — Fri, 13 Feb 2026 18:12:46 +0000

> Why is entitlement to others labor the moral position, instead of the immoral position?

You seem to be mistaking me for someone arguing that anyone is entitled to others' labour?

New comment by growse in "MinIO repository is no longer maintained"

growse — Fri, 13 Feb 2026 13:30:41 +0000

The social contract is found (and implicitly negotiated) in the interactions between humans, ie: society.

New comment by growse in "MinIO repository is no longer maintained"

growse — Fri, 13 Feb 2026 10:18:11 +0000

It's a social contract, which for many people is a moral contract.

New comment by growse in "Upcoming changes to Let's Encrypt and how they affect XMPP server operators"

growse — Wed, 11 Feb 2026 08:08:23 +0000

> CABF started imposing restrictions on the public CA operators regarding the issuance of non-HTTPS certificates.

The restriction is on signing non web certificates with the same root/intermediate as is part of the WebPKI.

There's no rule (that I'm aware of?) that says the CAs can't have different signing roots for whatever use-case that are then trusted by people who need that use case.

New comment by growse in "Upcoming changes to Let's Encrypt and how they affect XMPP server operators"

growse — Wed, 11 Feb 2026 08:05:07 +0000

> [citation needed]

My citation is the membership of the CAB.

> IMHO "other relying-party software applications" can include XMPP servers (also perhaps SMTP, IMAP, FTPS, NNTP, etc).

This may be your opinion, but what's the representation of XMPP etc. software maintainers at the CAB?

New comment by growse in "Upcoming changes to Let's Encrypt and how they affect XMPP server operators"

growse — Tue, 10 Feb 2026 09:08:45 +0000

The CAB is only concerned with the WebPKI. This means HTTPS.

There's loads of non web, non HTTPS TLS use cases, it's just the CAB doesn't care about those (why should it?).