0x073's comments

On: Show HN: Posthorn, self-hosted mail gateway

[0x073]

Does postal still use outdated rails? That's the biggest issue I have with this project as a exposed web service and mail server is for me high risk especially with outdated software.

[e12e → 0x073]

They seem to be on 7.2, which will get security patches until August this year:

https://github.com/postalserver/postal/blob/8ef89606bc34146f...

https://rubyonrails.org/maintenance

Not great, but better than 6.x.

[0x073 → e12e]

The links shows: gem "rails", "= 7.1.5.2"

I don't know rails well, but that sounds like 7.1 (that is unsupported) and not 7.2?

[e12e → 0x073]

Ah, my bad. Wishful thinking going from GitHub to rails site.

Rails minor versions are a bit odd imnho - but you're right 7.1 isn't under support anymore.

On: I love Linux, but I can't quit Windows

[0x073]

As Linux moves faster than windows I disagree. Systemd, wayland and flatpak resetting my skills in this areas completely windows 11 is still more or less the same.

Additional the UI behavior also more often changed than windows e.g gnome 2 to newer versions many core apps are more minimal/less functions and yes I just can fork and use the old behavior as open source but then my pc is more about fixing issues like under windows.

[ghusto → 0x073]

High churn stuff in the Linux world is take-it-or-leave-it. You can go without and still end up aquiring skills that you use 20 years from now.

I haven't used Linux as a desktop since well before Systemd days. When I picked it up a few weeks ago (for a desktop), I had no trouble applying the troubleshooting skills I acquired 20 years ago to fix issues. In contrast, I had to drive someone's Windows laptop a while ago and I didn't know what I was looking at, never mind fixing anything.

On: Obsidian plugin was abused to deploy a remote access trojan

[0x073]

AppContainer (e.g. used in uwp or msix)

[andersa → 0x073]

Can you configure that as a user for an unsafe program you want to run such as an online game? I think not.

On: EU Parliamentary Research Service calls VPNs "a loophole that needs closing"

[0x073]

There was a time that parents control what websites children can access.

Now there is a time politicians control what websites we can access.

On: Singapore introduces caning for boys who bully others at school

[0x073]

I know bullies that claim that they get bullied by the person they bully. The bully stopped in the end, but the wrong person got pushed.

On: Sam Altman's home targeted in second attack

[0x073]

"they must be allowed to fail organically so that they don't have any excuse."

Didn't work for a german political party some centuries ago, don't work for this.

But violence is false.

[yomismoaqui → 0x073]

Right now your comment is the 1st response for the 1st comment. Godwin's law speedrun I guess.

On: Artemis computer running two instances of MS outlook; they can't figure out why

[0x073]

At least it's no discord or ms teams.

On: Microsoft wants Edge to automatically open by default at Windows 11 boot

[0x073]

I mean open the most used software automatically can be user friendly. It's like a Chromebook. ;)

[hulitu → 0x073]

Kids those days. "Prefetch" folder in XP anyone ?

On: Why I forked httpx

[0x073]

If this would be a tv show I probably would view it, but wow what a drama.

On: You can run a DNS server (2025)

[0x073]

"Otherwise any MitM can easily redirect users to a phishing resource."

Yes, but with nowadays https/tls usage it's almost irrelevant for normal websites.

If bad actors can create valid tls certs they can solve the dnssec problem.

[throw0101d → 0x073]

> If bad actors can create valid tls certs they can solve the dnssec problem.

I think you have it backwards: by not running DNSSEC it can mean bad actors (at least a certain level) can MITM the DNS queries that are used to validate ACME certs.

It is now mandated that public CAs have to verify DNSSEC before issuing a cert:

* https://news.ycombinator.com/item?id=47392510

So if you want to reduce the risk of someone creating a fake cert for one of your properties, you want to protect your DNS responses.

[0x073 → throw0101d]

If you mean MITM between DNS Server and CA (e.g. letsencrypt), thats on a level of BGP hacking (means for me government involved) and means they can just use a CA (e.g. Fina CA 2025 with cloudflare).

I think the risk didn't change much (except for big corp/bank).

[throw0101d → 0x073]

At one point (pre-HTTPS ubiquity) the NSA hacked (e.g.) Belgium telecoms via injecting malware into web response from (e.g.) Slashdot:

* https://thehackernews.com/2013/11/snowden-reveals-gchq-plant...

* https://www.aclu.org/documents/quantum-insert-diagrams

* https://en.wikipedia.org/wiki/Man-on-the-side_attack

Still state-level, but probably less noticeable than BGP hijacking.

Unless you're entering IP addresses in all your applications and code, non-SEC DNS is an unsecured link in the chain of communications.