Clients are supposed to check. For example, Apple requires a varying number of SCTs in order for Safari to trust server certificates. https://support.apple.com/en-us/103214

And yes, it does break MITM use cases, for example on Chrome: https://httptoolkit.com/blog/chrome-android-certificate-tran...

So how does that work with middleboxes? Corporate isn't about to forgo egress security (nor should they).

I don't currently MITM my LAN but my general attitude is that if something won't accept my own root certificate from the store then it's broken, disrespecting my rights, and I want nothing to do with it. Trust decisions are up to me, not some third party.

Corporate managed machines can control the software running on the computer to do anything. I'm not sure the details, but chrome certainly can support corporate MITM. There's likely some setting you have to configure first.

The default should be to reject certificates which aren't being logged, and if you as a user or corporation have a reason to use private certificates, you just configure your computer to do that. Which fully protects against the risk of normal CAs signing fraudulent certificates.

Discussed in https://news.ycombinator.com/item?id=45290245

Recovering as of October 20, 2025 09:43 UTC

> [Monitoring] We are seeing error rates recovering across our SaaS services. We continue to monitor as we process our backlog.

Similar discussion: https://news.ycombinator.com/item?id=45305845

Comments moved thither. Thanks!

Yep, this should be merged with that discussion. I’ve flagged it, hopefully the mods will take action, no point in having two identical threads.

Probably VS Code with https://github.com/kahole/edamagit

Related: https://news.ycombinator.com/item?id=44211779

GitHub Copilot's Sonnet 4 is not great in Elixir either, but I'm not sure if it's because of Copilot or Sonnet.

I've been waiting for https://github.com/opentofu/registry/pull/824 ("Revert commit that removed Russian providers") to be resolved, but it seems to have stalled.

Open source does not work as I envisioned, I guess.

"Code is cheap, show me your nationality" approach to opensource is an absolute disgrace to the world. Surely sharing knowledge and volunteer work in software is one place where nationality and politics should have no place

That's not about nationality though. That PR is about (re)enabling OpenTofu to work more smoothly with Russian SaaSes, which are either already sanctioned or are likely to be sanctioned.

Everything is political, being "apolitical" is a political choice. You can't escape politics.

For personal blog, I have found the following alternatives:

- Chyrp Lite: lightweight blogging engine, written in PHP. https://github.com/xenocrat/chyrp-lite

- Typecho: a PHP-based blog software. https://github.com/typecho/typecho

and file-based static content generator:

- Quartz: Publish an Obsidian vault as a static site. https://github.com/jackyzha0/quartz

- Logseq: Publish a Logseq graph as a static site. https://github.com/logseq/publish-spa

also Jekyll templates:

- https://github.com/maximevaillancourt/digital-garden-jekyll-...

> Keep doing the first sort of bug fix, and you end up with a mess.

To avoid the mess, design with the fail-fast principle in mind, which brings you closer to the spot where an error occurred.