# https Published articles for https. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## AWS Elastic Beanstalk introduces Cluster Mode DevFeed: [AWS Elastic Beanstalk introduces Cluster Mode]() Original publisher: [Read original article]() Author: Channy Yun (윤석찬) Published: 2026-09-17T19:20:21Z Content type: release Language: en Sources: [AWS News Blog]() Topics: [Amazon Web Services](), [Deployment](), [Amazon EKS](), [autoscaling](), [Monitoring](), [observability](), [Provisioning](), [Secrets Management](), [AWS Certificate Manager](), [CI/CD]() Tags: [amazon-eks](), [amazon-elastic-kubernetes-service](), [application](), [autoscaling](), [aws](), [aws-certificate-manager](), [aws-elastic-beanstalk](), [ci-cd](), [cluster](), [code](), [compute](), [container](), [deployment](), [dockerfiles](), [https](), [infrastructure](), [kubernetes](), [launch](), [monitoring](), [news](), [provisioning]() ### AI overview AWS Elastic Beanstalk introduces a fully managed Cluster Mode that runs multiple applications on shared infrastructure powered by Amazon EKS. It also highlights AI-assisted environment analysis, GitHub Actions deployment, observability, traffic-splitting deployments with rollback, autoscaling, secrets management, and HTTPS by default. ### Source excerpt Run an application on AWS Elastic Beanstalk Cluster Mode without provisioning or operating the compute underneath it. You provide a container image or source code; Elastic Beanstalk with service-operated compute creates and operates the environment that runs it. ## datasette-publish-fly 1.4 DevFeed: [datasette-publish-fly 1.4]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-09-11T02:58:52Z Content type: release Language: en Sources: [Simon Willison's Weblog]() Topics: [fly](), [App](), [bug]() Tags: [bug](), [datasette](), [datasette-1-542](), [deploy](), [fly](), [fly-40](), [https](), [release](), [volume]() ### AI overview Release notes for datasette-publish-fly 1.4. The release sets force_https=true in fly.toml, fixes a volume lookup bug, and adds compatibility with app-scoped deploy tokens. ### Source excerpt Release: datasette-publish-fly 1.4 Sets force_https=true in fly.toml. #31 Fix for Volume could not be found bug. #32 Compatible with app-scoped deploy tokens. #34 Tags: datasette, fly ## CAA DNS Issuer-Critical Flags Are Confusing to Configure DevFeed: [CAA DNS Issuer-Critical Flags Are Confusing to Configure]() Original publisher: [Read original article]() Author: Remy Porter Published: 2026-09-10T06:30:00Z Content type: opinion Language: en Sources: [The Daily WTF]() Topics: [certificates](), [domain]() Tags: [bits](), [boolean](), [certificates](), [documentation](), [feature-articles](), [flag](), [https](), [readability]() ### AI overview The article examines confusion around the issuer-critical flag in DNS CAA records. It explains that the flag is defined as a bitmask, while many users interpret the documentation as requiring the integer 1 instead of the value representing the specified bit, creating a dilemma for certificate issuers such as LetsEncrypt. ### Source excerpt I'm not a DNS person, in that I appreciate that it exists but am not up on the inner workings. It solves a lot of problems with dark magic I don't fully understand, and fortunately don't need to. But Lucio noticed something that I do think is interesting, within the scope of the CAA record type. The CAA record started with RFC6844, which was obsoleted by RFC8659. Both RFCs lay out the same core idea: you can add a CAA record to your DNS entries to say, "hey, this domain over here is allowed to issue certificates for me". That's the sort of thing that enables LetsEncrypt to hand out certs, and is an important part of why we can run HTTPS everywhere these days. Now, RFC6844 has this in it: Issuer Critical: If set to '1', indicates that the corresponding property tag MUST be understood if the semantics of the CAA record are to be correctly interpreted by an issuer. Issuers MUST NOT issue certificates for a domain if the relevant CAA Resource Record set contains unknown property tags that have the Critical bit set. The issuer critical flag means that the certificate issuer needs to validate your CAA record before it issues a certificate for you. There's more in the RFC about what exactly that means, but we don't care about those details for right now. The rule here is "set a flag to 1". A little later in the RFC, the flag is described in more detail- as a bitmask. Specifically, bit 0 is the issuer critical flag. Bits 1-7 are reserved for future use. Now, here's where we get into trouble, because programmers don't understand bits, and because the CAA record expects you to put an integer in this field. So, if you want issuer critical enabled, what value to you put in this field? 128, obviously. That's 10000000. Except, if you don't understand bits, that's not obvious. A lot of people read this and decided that the documentation meant they needed to put 1 in the field- aka 00000001. This is wrong. The updated RFC tries to explain it a bit more clearly: Bit 0, Issuer Critic ## Vaultwarden: gestor de contraseñas autoalojado DevFeed: [Vaultwarden: gestor de contraseñas autoalojado]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-08-03T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [Docker](), [Docker Compose](), [TLS (Transport Layer Security)](), [nginx](), [proxy](), [backups]() Tags: [backups](), [bitwarden](), [compose](), [docker](), [docker-compose](), [hardening](), [homelab](), [https](), [nginx](), [proxy](), [tls](), [vaultwarden]() ### AI overview A Spanish-language tutorial explains how to self-host Vaultwarden, an unofficial Rust server compatible with Bitwarden clients. It covers Docker Compose deployment, HTTPS behind an Nginx reverse proxy, admin-token hardening, and backups, while noting the trade-off between community support and the official Bitwarden server. ### Source excerpt Instala Vaultwarden con Docker: servidor ligero compatible con los clientes de Bitwarden, con HTTPS, hardening del admin token y backups. ## Certificados SSL gratis con Certbot DevFeed: [Certificados SSL gratis con Certbot]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-07-27T00:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [let's encrypt](), [SSL](), [TLS (Transport Layer Security)]() Tags: [https](), [let-s-encrypt](), [ssl](), [tls]() ### AI overview A tutorial explaining how Certbot and Let's Encrypt use ACME validation, when to choose HTTP-01 or DNS-01, how wildcard certificates work, and the implications for automatic renewal. ### Source excerpt Cómo funciona la validación ACME, cuándo usar HTTP-01 o DNS-01, cómo emitir certificados wildcard y cómo funciona la renovación automática de Certbot. ## Inside the Git Proxy: Capturing What an AI Agent Pushed (Part 2) DevFeed: [Inside the Git Proxy: Capturing What an AI Agent Pushed (Part 2)]() Original publisher: [Read original article]() Author: Eugene Petrenko Published: 2026-06-22T00:00:00Z Content type: article Language: en Sources: [Eugene Petrenko]() Topics: [Git](), [AI Agent](), [HTTP](), [Authentication]() Tags: [ai-agent](), [ai-agents](), [ai-coding](), [authentication](), [eugene-petrenko](), [git](), [http](), [https](), [infrastructure](), [jonnyzzz](), [logs](), [proxy](), [refs](), [tag-41199d53f463](), [workflow]() ### AI overview This article explains the capture half of a Git proxy for AI agents. It covers intercepting HTTPS traffic, parsing Git packfiles, logging commits, pinning objects with marker refs, and handling signed and atomic protocol behavior. ### Source excerpt Part 2 -- how the git proxy intercepts HTTPS, forces a parseable pack, logs every commit, pins the objects with marker refs, and survives the sharp edges of a signed, atomic protocol. ## RFC 9958: Post-Quantum Cryptography for Engineers DevFeed: [RFC 9958: Post-Quantum Cryptography for Engineers]() Original publisher: [Read original article]() Published: 2026-06-20T00:00:00Z Content type: article Language: fr Sources: [Blog de Stéphane Bortzmeyer]() Topics: [Post-quantum cryptography](), [Cryptography](), [Post-Quantum](), [Security, Privacy and Abuse Prevention](), [Internet Engineering Task Force (IETF)](), [Internet](), [ECDSA]() Tags: [cryptography](), [ecdsa](), [https](), [ietf](), [internet](), [post-quantum](), [post-quantum-cryptography](), [publication](), [quantum](), [rfc](), [rsa]() ### AI overview This French article explains RFC 9958, which guides engineers implementing post-quantum cryptographic algorithms in Internet software and protocols. It assumes familiarity with the algorithms themselves and focuses on their practical integration, while describing the quantum-computing threat to traditional systems such as RSA and ECDSA. ### Source excerpt Tout le monde parle (https://www.afnic.fr/observatoire-ressources/papier-expert/en-route-vers-la-journee-du-conseil-scientifique-2025/) des calculateurs quantiques et du risque qu'ils font peser sur la cryptographie traditionnelle. La solution ? Remplacer ces algorithmes par des algorithmes post-quantiques, c'est-à-dire résistant aux calculateurs quantiques. Ces algorithmes existent déjà, plusieurs sont normalisés et beaucoup ont déjà été mis en œuvre dans des programmes. Mais les intégrer dans les protocoles de l'Internet n'est pas trivial. Ce RFC vise à guider les ingénieur-es qui vont appliquer ces algorithmes post-quantiques à des logiciels et des protocoles du monde de l'Internet. ## 20 Networking Concepts Explained in 15 Minutes DevFeed: [20 Networking Concepts Explained in 15 Minutes]() Original publisher: [Read original article]() Author: Ashish Pratap Singh Published: 2026-06-02T05:28:43Z Content type: tutorial Language: en Sources: [AlgoMaster Newsletter]() Topics: [networking](), [Networks](), [domain](), [Internet](), [browser](), [HTTP]() Tags: [browser](), [concepts](), [dns](), [domain](), [http](), [https](), [ipv4](), [ipv6](), [mac-address](), [network](), [networking](), [postgresql](), [recursive-resolver](), [redis](), [ssh](), [wi-fi]() ### AI overview A tutorial introducing core networking concepts, including IP addressing, DNS resolution, ports, MAC addresses, and ARP, with examples involving browsers, routers, servers, SSH, HTTP, PostgreSQL, and Redis. ### Source excerpt Networking can feel overwhelming, but a small set of concepts carries most of the weight in interviews and real-world systems. ## Deconstructing OkHttp DevFeed: [Deconstructing OkHttp]() Original publisher: [Read original article]() Author: Jesse Wilson Published: 2026-05-22T12:00:00Z Content type: article Language: en Sources: [Public Object]() Topics: [Library](), [Network](), [Code](), [Kotlin](), [implementation](), [Cache](), [certificates]() Tags: [architecture](), [cache](), [certificates](), [https](), [implementation](), [kotlinconf](), [ktor](), [library](), [network](), [okhttp](), [performance](), [presentation](), [retrofit](), [testing]() ### AI overview A KotlinConf talk examines OkHttp's implementation rather than its basic usage, covering interceptor-based architecture, connection lifecycles, cache state machines, URL decoders, HTTPS testing certificates, performance, and extension mechanisms. ### Source excerpt I presented this at KotlinConf on May 22, 2026. Also available on slides, YouTube, and Speaker Deck. OkHttp is a popular library for making network calls. You might use it directly, or with Ktor, Retrofit, Coil, or gRPC. But this is not a talk on how to use OkHttp. Instead, ## Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices DevFeed: [Mongoose: Preauth RCE and mTLS Bypass on Millions of Devices]() Original publisher: [Read original article]() Author: Simone Margaritelli Published: 2026-04-01T22:00:00Z Content type: article Language: en Sources: [evilsocket]() Topics: [Mongoose](), [Vulnerabilities](), [Security](), [Embedded Systems](), [Internet of things](), [C](), [cross-platform](), [HTTP](), [MQTT](), [WebSocket]() Tags: [authentication-bypass](), [buffer-overflow](), [c](), [cesanta](), [cross-platform](), [cve](), [cve-2026-5244](), [cve-2026-5245](), [cve-2026-5246](), [cybersecurity](), [embedded](), [embedded-devices](), [embedded-systems](), [exploit](), [heap-overflow](), [http](), [https](), [industrial-control](), [iot](), [iot-security](), [library](), [mdns](), [mips](), [mongoose](), [mqtt](), [mtls](), [rce](), [responsible-disclosure](), [security](), [stack-overflow](), [tls](), [vulnerability-research]() ### AI overview The article reports three independently exploitable vulnerabilities in Mongoose v7.20, an embedded C networking library used in IoT devices: an mTLS authentication bypass, a preauthentication heap-overflow RCE through client public-key parsing, and a preauthentication RCE through mDNS over UDP. Mongoose v7.21 reportedly includes patches for the issues, which were assigned CVE-2026-5244, CVE-2026-5245, and CVE-2026-5246. ### Source excerpt So, Mongoose. I ## Retronetworking - 2026-04-01: RetroNetCall: 40C3 c3isdn network, new location DevFeed: [Retronetworking - 2026-04-01: RetroNetCall: 40C3 c3isdn network, new location]() Original publisher: [Read original article]() Author: xent Published: 2026-03-30T23:44:02Z Content type: news Language: en Sources: [Open Source Mobile Communications: News]() Topics: [Network]() Tags: [2026](), [announce](), [bug](), [communication](), [https](), [issue](), [location](), [network](), [presentation](), [tracker]() ### AI overview An announcement for the April 1, 2026 RetroNetCall, a retronetworking-oriented spin-off of OsmoDevCall. The session includes a presentation on initial findings from a visit to the Hamburg Messe, the new site for that year's Chaos Communication Congress. ### Source excerpt We're happy to announce the next incarnation of RetroNetCall, the retronetworking oriented spin-off of OsmoDevCall This time, we have a presentation about the first findings after @jolly and @xent visit of the Hamburg Messe on 28th March 2026 (the new site for this year Chaos Communication Congress). When: Wednesday, April 1st, 2026 from 20:00 CEST Time Topic Who 20:00 Meet and Greet everyone 20:10 40C3 New Location (Hamburg Messe) @jolly and @xent Where: https://osmocom.org/RetroNetCall (Big Blue Button of https://franken.de/) ## Moved my blog to \[blog.wagemakers.be\](https://blog.wagemakers.be) DevFeed: [Moved my blog to \[blog.wagemakers.be\](https://blog.wagemakers.be)]() Original publisher: [Read original article]() Author: Staf Wagemakers Published: 2026-01-26T17:26:00Z Content type: tutorial Language: en Sources: [stafwag Blog]() Topics: [migration](), [hosting](), [GitHub](), [Security](), [RSS Feed](), [Hugo](), [Atom](), [XML]() Tags: [atom](), [blog](), [disquss](), [github](), [hosting](), [html](), [https](), [hugo](), [jekell](), [migration](), [rss](), [security](), [security-privacy](), [xml]() ### AI overview The author moved the blog from GitHub to self-hosted hosting and documents the migration issues encountered. The article covers HTML redirects, updating hardcoded links, Disqus comment reindexing, and difficulties redirecting RSS feeds when moving from Octopress to Jekyll. ### Source excerpt If you follow my blog posts with an RSS reader, update the rss feed to: https://blog.wagemakers.be/atom.xml ...If you want to continue to follow me off-course ;-) I moved my blog from GitHub to my own hosting ( powered by Procolix ). Procolix sponsored my hosting for 20 years, till I decided to start my company Mask27.dev. One reason is that Microsoft seems to like to put "copilot everywhere", including on repositories hosted on github. While I don't dislike AI ( artificial intelligence ), LLM ( Large Language Models ) are a nice piece of technology. The security, privacy, and other issues are overlooked or even just ignored. The migration was a bit more complicated as usual, as nothing "is easy" ;-) You'll find the pitfalls of moving my blog below as they might be useful for somebody else ( including the future me ). ## Browser support for RFC9460 HTTPS DNS records DevFeed: [Browser support for RFC9460 HTTPS DNS records]() Original publisher: [Read original article]() Published: 2025-12-12T22:00:01Z Content type: article Language: en Sources: [Signs of Triviality]() Topics: [browsers]() Tags: [2025](), [browsers](), [dns](), [https]() ### AI overview A quick summary of browser support for RFC9460 HTTPS DNS records and the extent of that support as of December 2025. ### Source excerpt A quick summary of which browsers support RFC9460 HTTPS DNS records and to what extent as of December 2025. ## Hosting Bugsink on Coolify DevFeed: [Hosting Bugsink on Coolify]() Original publisher: [Read original article]() Author: Julien Published: 2025-07-07T20:33:23Z Content type: tutorial Language: en Sources: [Thoughts, stories and ideas.]() Topics: [Docker Compose](), [Deployment](), [Docker](), [Cross-origin resource sharing (CORS)]() Tags: [bugsink](), [coolify](), [deployment](), [docker](), [docker-compose](), [environment-variables](), [http](), [https](), [redirection](), [testing]() ### AI overview This tutorial explains how to deploy Bugsink on Coolify with Docker Compose while a Coolify bug prevents the default Bugsink deployment template from working correctly. It covers port redirection, HTTPS, domain configuration, and environment variables. ### Source excerpt A simple Docker Compose setup to host Bugsink using Coolify that supports HTTPS ## Heroku ACM Adds Wildcard Domain Support for the Common Runtime DevFeed: [Heroku ACM Adds Wildcard Domain Support for the Common Runtime]() Original publisher: [Read original article]() Author: Ethan Limchayseng Published: 2024-09-27T03:09:00Z Content type: release Language: en Sources: [Heroku]() Topics: [Heroku](), [cloud security](), [certificates](), [Cloud]() Tags: [announce](), [certificates](), [cloud-infrastructure](), [cloud-security](), [heroku](), [https](), [news](), [product-features](), [security]() ### AI overview Heroku Automated Certificate Management now supports wildcard domains for the Common Runtime, allowing one wildcard certificate to cover multiple subdomains. Heroku ACM handles certificate issuance, renewal, and management. ### Source excerpt We are thrilled to announce that Heroku Automated Certificate Management (ACM) now supports wildcard domains for the Common Runtime! Heroku ACM's support for wildcard domains streamlines your cloud management by allowing Heroku's Certificate management to cover all your desired subdomains with only one command, reducing networking setup overhead and providing more flexibility while enhancing the [...] The post Simplify Your Cloud Security: Heroku ACM Now Supports Wildcard Domains appeared first on Heroku. ## Automatic Certificate Management for Eco Dynos DevFeed: [Automatic Certificate Management for Eco Dynos]() Original publisher: [Read original article]() Author: Vivek Viswanathan Published: 2024-02-09T01:56:00Z Content type: release Language: en Sources: [Heroku]() Topics: [Heroku](), [certificates](), [TLS (Transport Layer Security)](), [Encryption](), [Security]() Tags: [availability](), [certificates](), [dynos](), [heroku](), [https](), [improvements](), [let-s-encrypt](), [news](), [product-features](), [security](), [tls]() ### AI overview Heroku announces that Automatic Certificate Management and manual certificate support are available for apps running on Eco dynos. ACM uses Let's Encrypt, automatically renews certificates one month before expiration, and creates new certificates when custom domains are added or removed. ACM is no longer automatically enabled when changing dyno types. ### Source excerpt TLS and HTTPS encryption have become foundational primitives and a requirement for running any app or service on the internet. Many Heroku customers told us through our public roadmap to make Heroku Automated Certificate Management available to all dyno types, including our Eco subscription. We're thrilled to announce that Automatic Certificate Management(ACM) and manual certificate [...] The post Automatic Certificate Management for Eco Dynos appeared first on Heroku. ## Maximizing page performance and security with Cloudflare tuning DevFeed: [Maximizing page performance and security with Cloudflare tuning]() Original publisher: [Read original article]() Author: Tom Published: 2024-01-11T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [Cloudflare](), [GitHub Pages](), [Security](), [Website]() Tags: [cloudflare](), [cloudflare-tuning](), [configuration](), [github-pages](), [how-to](), [http](), [http-3](), [https](), [https-configuration](), [page-performance](), [performance](), [security](), [static-site-optimization](), [tls](), [website-security]() ### AI overview A practical guide to tuning Cloudflare for a statically generated blog hosted on GitHub Pages. It covers HTTPS, HSTS, TLS versions, Brotli, and related settings, recommending that readers enable changes incrementally and measure their effects. ### Source excerpt Learn how to maximize page performance and security by tuning Cloudflare settings, specifically for a statically generated blog hosted on GitHub Pages. ## Use Github with SSH on port 443 DevFeed: [Use Github with SSH on port 443]() Original publisher: [Read original article]() Author: Tom Published: 2023-12-26T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [GitHub](), [OpenSSH](), [Firewall]() Tags: [blocking](), [bypass-firewall-github](), [firewall](), [github](), [github-repository-access](), [github-ssh-port-443](), [how-to](), [https](), [linux](), [port](), [repository](), [ssh](), [ssh-configuration-github](), [ssh-github-access](), [timeout](), [wifi]() ### AI overview This tutorial explains how to use GitHub over SSH on port 443 when standard SSH access is blocked or times out, such as on hotel or public Wi-Fi networks. It describes configuring the connection to simulate HTTPS traffic so repositories can still be cloned, pulled, and pushed over SSH. ### Source excerpt Learn how to use GitHub with SSH on port 443 to bypass firewall restrictions and ensure seamless repository access. ## Use of HTTPS Resource Records DevFeed: [Use of HTTPS Resource Records]() Original publisher: [Read original article]() Published: 2023-11-14T01:35:15Z Content type: article Language: en Sources: [Signs of Triviality]() Topics: [domain]() Tags: [analysis](), [dns](), [domain](), [https]() ### AI overview An analysis of more than 225 million domain names examines current use of the new HTTPS DNS Resource Records. ### Source excerpt An analysis of over 225 million domain names to determine the current use of the new HTTPS DNS Resource Records. ## TLS Routing Support for Teleport Behind an AWS Application Load Balancer DevFeed: [TLS Routing Support for Teleport Behind an AWS Application Load Balancer]() Original publisher: [Read original article]() Author: info@goteleport.com (Steve Huang) Published: 2022-11-18T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Load Balancing](), [TLS (Transport Layer Security)](), [Amazon Web Services](), [networking](), [HTTP](), [Amazon Bedrock]() Tags: [aws](), [high-availability](), [https](), [load-balancer](), [load-balancing](), [tls](), [tls-handshake]() ### AI overview This article explains TLS Routing support for Teleport Database Access when Teleport runs behind an AWS Application Load Balancer. It compares application and network load balancers and discusses TLS termination, mutual TLS, ALPN, SNI, and certificate handling. ### Source excerpt How to "penetrate" an AWS Application Load Balancer to enable mutual TLS (mTLS), Application-Layer Protocol Negotiation (ALPN), and more. ## Update on DoS Attacks against our Online Game DevFeed: [Update on DoS Attacks against our Online Game]() Original publisher: [Read original article]() Published: 2022-05-15T22:00:00Z Content type: article Language: en Sources: [Dennis Felsing]() Topics: [spoofing](), [servers](), [Open Source](), [Protocol (disambiguation)](), [client]() Tags: [attacks](), [https](), [ipv4](), [ipv6](), [open-source](), [server](), [servers](), [spoofing](), [udp]() ### AI overview This update describes ongoing DoS attacks against the open-source DDraceNetwork online game. It explains how spoofed UDP connection attempts overload single-threaded game servers and outlines an HTTPS-based IP whitelist, along with limitations involving capacity, IPv4, IPv6, and ISP address translation. ### Source excerpt In my previous post 8 months ago I described how our open source online game DDraceNetwork has been suffering under DoS attacks for about 8 years, basically since its inception. Recently the attacks have gotten much worse, forcing us to work on further approaches. Since many players made suggestions recently, I'm writing this blog post to summarize what we are attempting and to ask for help again. These traffic graphs are from two of the servers we are running, note the logarithmic x-axis. Each spike represents an incoming DoS attack, as you can see some of them last for nearly a day. Recently the attacks have been relatively weak in terms of incoming bandwidth, using spoofed IP addresses imitating our UDP-based connection process. At first the CPU gets overloaded since the server suddenly has to try and handle hundreds of thousands of connection attempts per second. Since our game servers are mostly running on cheap VPSes and each game server runs single-threaded, it is quite easy to overload a system in this manner. HTTPS-based Whitelist To prevent spoofing we collect all players' IP addresses and whitelist those. Since we also develop the game client, we can modify the client to connect to a server via HTTPs for this whitelisting. The iptables rules and ipset setup on the game servers for this whitelist look something like this: ipset create official iphash ipset create whitelist-ip iphash iptables -N serverinfo iptables -A serverinfo -m hashlimit --hashlimit-above 40/s --hashlimit-mode dstport --hashlimit-name si_dstport -j DROP iptables -N game iptables -A game -m set --match-set official src -j ACCEPT iptables -A game -m set --match-set whitelist-ip src -m u32 --u32 "38=0x67696533" -j serverinfo iptables -A game -m set --match-set whitelist-ip src -m u32 --u32 "38=0x66737464" -j serverinfo iptables -A game -m set --match-set whitelist-ip src -j ACCEPT # Still allow non-whitelisted players when there is no attack iptables -A game -m limit --limit 10000 -j ACCEP ## Using TLS Extensions to Route Traffic and Reduce Port Requirements in Teleport DevFeed: [Using TLS Extensions to Route Traffic and Reduce Port Requirements in Teleport]() Original publisher: [Read original article]() Author: ben@goteleport.com (Ben Arent) Published: 2021-12-21T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [TLS (Transport Layer Security)](), [TLS handshake](), [Routing (disambiguation)](), [SSL](), [Server]() Tags: [https](), [port](), [route](), [security](), [ssl](), [tls](), [tls-handshake]() ### AI overview This tutorial explains how Teleport uses TLS extensions, including ALPN and SNI, to route traffic more efficiently and reduce the number of required open ports. It also distinguishes the TLS protocol from the X.509 certificates used with it. ### Source excerpt How to leverage TLS extensions to more efficiently route traffic and reduce port requirements in Teleport. ## send.firefox.com rocks DevFeed: [send.firefox.com rocks]() Original publisher: [Read original article]() Author: Fuzzygroup Published: 2020-03-28T00:00:00Z Content type: opinion Language: en Sources: [Scott Johnson]() Topics: [Firefox]() Tags: [firefox](), [https](), [large-files](), [simple]() ### AI overview The article recommends Mozilla's send.firefox.com for sending large files to individuals, describing it as simple, easy to use, and powerful. ### Source excerpt If you have to send a large file to an individual, use: https://send.firefox.com/ It is brilliantly simple, easy to use and powerful. Recommended. ## Having Hatchbox Redirect All http Sites it Manages to https DevFeed: [Having Hatchbox Redirect All http Sites it Manages to https]() Original publisher: [Read original article]() Author: Fuzzygroup Published: 2020-03-28T00:00:00Z Content type: tutorial Language: en Sources: [Scott Johnson]() Topics: [nginx](), [SSL](), [HTTP](), [configuration](), [servers]() Tags: [can](), [code](), [configuration](), [deploy](), [hatchbox](), [http](), [https](), [nginx](), [request](), [server](), [ssl]() ### AI overview A guide for configuring Hatchbox and nginx in cluster mode so HTTP requests are redirected to HTTPS at the load balancer. It provides the nginx directive and the Hatchbox interface steps needed before deploying the change. ### Source excerpt When you are using hatchbox and SSL in cluster mode you end up with: a load balanced cluster that uses nginx as the load balancer and nginx on each web node This makes it hard to understand where the http to https redirect goes. The answer is that you need to but this on the load balancer and here's a code snippet: server_name _; return 301 https://$host$request_uri; This gets set as follows: Go into Hatchbox.io Go into your app. Go to Advanced. Select Nginx Configuration from the drop down menu Select the Load Balancer tab. Add these changes below the listen [::]:80; directive and then do a deploy. For reference, you can see linuxize. [Next page]()