A bit unfortunate that so many of the interesting bits were left to ai. I would've enjoyed some commentary on why the custom TLS implementation was necessary. Oh well.
Update: found this explanation in a comment at the top of the (surprisingly short) Go file in the linked repo:
The target client is Netscape Communicator 4.51 (both the 40-bit export build and the 128-bit US build) with its clock set to the year 2000.
Go's crypto/tls cannot help: it dropped SSLv3 in Go 1.14, never accepted the SSLv2-compatible ClientHello that Netscape 4 sends, and never had RC4-MD5 or the 40-bit export suites. So this file carries its own tiny SSLv3 server-side implementation on top of stdlib primitives (RSA PKCS#1 v1.5, RC4, DES, 3DES, MD5, SHA-1). The server key is 512-bit RSA so that export clients can encrypt the premaster secret to it directly, without a ServerKeyExchange.
I've written and worked on a few TLS implementations, so it wasn't terribly interesting to me. And I have to go to work tomorrow and solve real, modern CA problems :)
But in short, I wanted to use Go, and it doesn't support SSLv3, the SSLv2 Client Hello, or the 40-bit RC4-MD5 export-grade cipher suites which I wanted to support too.
I was more shocked that I managed to get stock OpenSSL to issue a certificate that worked. There's a number of things that didn't work there, too. You can find my scars in mkcert.sh in the repo. Perhaps all of this is worthy of a follow-up post.
I could have tried to get some old server running instead, but I wouldn't have wanted to deploy that on the internet, even on an isolated Fly VM.
I bet all the certificate metadata shown in the „View a certificate“ popup window is vulnerable to cross-site scripting. Back then you probably wouldn’t get a <script> tag through a CA's review process and I found such a problem in Netscape's image „About page“ popup.
If it were vulnerable to XSS, why would you even want it properly signed by a CA?
People almost never inspect the certificates of working websites, the only time they might look at it is when it fails validation.
I actually do like to view certificates of working sites, because it can be interesting to see what's listed in the Subject Alternative Names field. It can lead to some interesting observations about what sites are linked.
Strange seeing how people have such a hard time seeing others using AI and seem to want to complain about it instead of just, well, asking AI why something was likely done a way. It works both ways my dudes, experts don’t need to explain every last detail, prompt a bot with the context until you understand.
From my prospective, the outputs of a bot aren’t the interesting bits, it’s the input prompt that should warrant more attention.
A while back I helped a friend (read: dumped a bunch of compute power into it) brute force the SSL keys for Sega's "Phantasy Star Online" Dreamcast game.
They used a similar kind of custom (and flawed) TLS implementation in their game(s) which allowed signing new certificates after brute forcing.
The benefit to this is that users can now play these games without needing to burn a new CD with either the SSL certs swapped, or the code patched to dummy out the checks. A "retail CD" will simply work with private servers now.
I've also been on the other side of the fence, building a "retro internet" service [1] has meant trying to implement ancient SSL/TLS services for things and people that want to use them on the network.
Getting modern OpenSSL (aka what ships in Debian) to even accept these ciphers, let alone keys that short is an uphill battle. Understandably, they're disabled by default and (in Debian at least) the cipher support isn't even compiled into the binary! This requires building a custom OpenSSL to build Nginx against to serve ancient SSL.
Presumably for the OP this kind of work was either outside of their realm of knowledge, or simply "easier" to outsource to the slop machine. Though I hope the machine they're running their demo TLS implementation on is separated completely from their own network. Rolling your own crypto libraries is always a bad idea [2] and I doubt LLM's have "improved" that
Wasn't intended as a "nerdswipe". Wrangling OpenSSL to actually work is a herculean task on a good day. Much less figuring out how to enable ancient crypto protocols within it
It's okay to "not know things". Computers are such an incredibly vast field that there's chunks of them that can simply be beyond some of us
> A while back I helped a friend (read: dumped a bunch of compute power into it) brute force the SSL keys for Sega's "Phantasy Star Online" Dreamcast game.
Is there anything published online about this? It looks like the Sylverant website still requires patching the game.
>>>a few odd coding decisions, such as rolling your own crypto (RNG)<<<
Let me give some context here. MaraDNS is a DNS server that’s been around for a very long time, since 2001. There has never been, in those 25 years, any security holes found having to do with the RNG code used by MaraDNS. MaraDNS originally used an AES variant for the RNG; when DJB found cache timing attacks a little over two decades ago, I revised the AES-based RNG code to minimize the impact of such impacts, making the code slower and more complicated. So, about two decades ago, I implemented a new RNG based on RadioGatún, an algorithm which isn’t vulnerable to cache timing attacks and, indeed, has no known attacks which break its cryptographic claims, even though those claims were made over two decades ago.
My code has been extensively audited by multiple AI-based security researchers, and while they found two minor issues with the DNS-over-TCP code in the recursive resolver, and a minor issue with the RFC8482 reply in the recursive resolver, no issues have ever been found with the RNG code in MaraDNS (except the issue with possible cache timing attacks I fixed myself after learning about them). [1]
In the same time period, OpenSSL has had a large number of security issues, security advisories, and so on. OpenSSL has had countless security holes and patches in the last two decades (Heartbleed, etc.); MaraDNS has had precisely 0 known issues with its RNG code in the same time period. If I had relied on OpenSSL to keep MaraDNS’s cryptography secure, it would had been exposed to many more attacks than it has, since the code I rolled myself ended up being far more secure than using the code in a third party library.
Point being, it is possible for someone to roll their own secure RNG. I wouldn’t do so in a corporate context, for the simple reason management often times puts unreasonable time constraints on developers, but for an open source project developed on my own timeline, it can be, in fact it has been very secure.
Also: I was never exposed to the Lastpass breach because, instead of using Lastpass, I rolled my own secure website password generator. [2]
Forget whether you "roll your own" or not, userspace RNGs are a bad idea. The advice to rely on getrandom or urandom is as much about the superior security properties of a kernel RNG as they are about whether you'll fuck up AES somehow.
Linux kernel crypto code has resulted in security issues, e.g. CVE-2026-31431.
The advantage of using a cryptographically secure stream cipher [1] is that we only need about 128-256 bits of good entropy to generate an arbitrary large number of secure random numbers, across multiple systems (e.g. MaraDNS has a native Windows port where /dev/urandom randomness is instead done with proprietary Windows API calls). It can even give us some level of protection on systems where the OS level random API is compromised: Some people are wary of RDRAND because they think Intel might actually use an insecure PRNG for the numbers, and Coldcard Bitcoin seed generators were compromised a little over a month ago because their version of /dev/urandom was completely insecure on some of their devices.
I don't grant the premise that per-transaction urandom reads are likely a meaningful expense to begin with but on modern Linux getrandom is a vDSO anyways. Even before the vDSO, getrandom was fast.
The application domain where this tends to get brought up as a problem is in large-scale simulation. I have no opinion about whether getrandom is fast enough for simulation, but here we're talking about cryptographic random numbers, not simply high-quality random numbers. If you want to use something like PCG for your simulations I won't dunk on you.
In addition to the overhead of a /dev/urandom read(), since my programs run in a chroot() sandbox, there’s the possibility that the file descriptor to /dev/urandom will no longer function—since chroot() is not part of POSIX, there’s no rigorous standard on how chroot() is supposed to behave with a given operating system.
getrandom() is another possible solution, but the problem with getrandom() is that it’s also not part of the POSIX spec, and my program needs to compile in an anally POSIX compliant system: While my programs use chroot() and setgroups(), both of which aren’t part of the POSIX spec, it has a configure time option to disable both chroot() and setgroups() so everything will compile as long as the underlying system follows POSIX.
The reason for this strict compliance with POSIX is because the changes to the C compilers (gcc and clang) between 2022 and 2026 made previous versions of MaraDNS have issues compiling everything, and, indeed, with these C23 changes to C compilers, unpatched djbdns no longer even compiles with a modern compiler. I changed everything to work with the new C23 spec, then I changed the compile flags to compile with a strictly compliant C99 compiler, but to get that to work, I had to make the program strictly POSIX compliant (with the exceptions of chroot() and setgroups()).
This way, should MaraDNS not compile in the future (remember: The post-C23 changes broke a lot of programs that used to compile just fine), it’s a bug with the compiler not following C99 and/or POSIX, and not a bug with MaraDNS.
Hence, my homegrown secure pseudo random number generator, so I can make strong random numbers while remaining POSIX compliant (we seed the PRNG before entering the chroot() sandbox). Of course, /dev/urandom is also not part of POSIX, but it’s on pretty much any modern *NIX, and trying to open /dev/urandom is not going to raise compile-time errors.
I don't think trading resilience for POSIX compliance is a good call, and I don't think "strong random numbers" is at all the right way to think about this problem.
The slop machine gives answers to your questions. It hallucinates so it's recommended to verify what it says. Shit in, shit out. If you have no idea whatsoever and can't use other sources to verify claims, well, get a different job I guess.
This entire comment section is almost entirely people bemoaning AI output, calling AI a "slop machine", and you posted your regressive religious screed against it as if it were something to be proud of, seemingly to the approval of others. nearly every comment section with AI involved is like this, and many comment sections where AI is not involved. It deserves pushback.
People are indeed proud of remaining humans and resisting becoming AI corp appendages that are lost in slop at their own expense. Get over it. Your pushback is exactly as religious.
When you're one of the people who finds TUIs inaccessible, "accessibility" isn't just a downside to be considered, it's table stakes. I think they're fine for one off toys for individuals and small groups, but if you're selling a product to the public, it ought to be accessible first and foremost.
We should get rid of ramps and handicapped parking at grocery stores too. If it’s such a large market someone can start their own accessible grocery store…
When you purchase a new laptop, you can choose a different manufacturer who may have a more durable product. When you have a framework, you're forced to buy the same component from the same company that made it poorly in the first place, if it's even in stock.
When you buy a framework, you are not forced to buy the same component from framework. You are free to buy a new laptop like you would if your laptop from Dell failed.
Like many others, I gave up on self hosting email when I realized Gmail and Outlook would always mark me as spam, if I even got delivered. DMARC and DKIM did nothing, I think the datacenter IP was just blacklisted. Ostensibly there are ways to get it unblacklisted but man what a pain the ass for the whole process.
Maybe I'm an outlier, but personally if a friend used ai to make me a gift like in TFA, I'd be pretty offended. Using AI shows that you didn't care enough to even think about it on your own. When I see a business use obviously AI generated imagery, I think "I'll stay away from them, they clearly don't care enough to do things the right way." It's a sign of disrespect and a lack of care. I know my partner thinks similarly, as do most of our friends. I don't think creativity is going anywhere long term, though perhaps there will be an awkward adjustment period while older people catch up to the new social norms.
I wonder how many parents are looking forward to the day their kids can just talk to a computer and have an LLM produce all the works. That'll be something to proudly hang on the fridge, yeah?
This thread inspired me and I made this prompt for you:
“A comic of a kid and his father standing in the kitchen. The father is pinning a page to the fridge with a magnet while the kid stands there, proudly watching. The page is an image depicting a comic of a kid and his father standing in the kitchen as the father pins a page to the fridge with a magnet.”
Edit: I decided that without effort, a gift can fall a little flat. So I took the time to process the prompt for you. I hope you like it! https://ibb.co/PsdDjDLy
That was good for a laugh. And of course it is so typically AI. Superficially pretty incredible, and then you start to spot the errors. And they are the kind of errors only an LLM would make, not a human.
Also a pretty great demo of why original content creators hate LLMs for stealing all their work.
> if a friend used ai to make me a gift like in TFA, I'd be pretty offended
As would I. Not only would that demonstrate they don't care, but it would also indicate that this "friend" simply doesn't know me at all, and therefore is an acquaintance at best.
What if I used no AI in writing it i.e. it was all heartfelt but used AI to literally edit a video together? The author says
"Two videos, with different stories, shared so many similarities that most people thought they were roughly the same.
Same similar tone of voiceover with cadence. Same cutscenes of flying over empty beaches, and navigating forest trees and stars/universe, and same narrative: after years of evolution scientists have yet to discover the power of such love with a national geographic tone in both (one of the videos even started with that logo)."
Which to me, just means the manually done cutscenes was a waste of time? In fact in most situations pre-AI you'd foist this task on "that one friend" who's good with Movie Maker or hire a hobby videographer. Now I offload to AI, why is that bad?
I think having Claude wholesale write a wedding speech is obviously silly, but the rest doesn't seem so black and white, just more Ikea-fication of consumer art.
>Which to me, just means the manually done cutscenes was a waste of time? In fact in most situations pre-AI you'd foist this task on "that one friend" who's good with Movie Maker or hire a hobby videographer. Now I offload to AI, why is that bad?
Because there's no value in something that you offload to AI without effort.
If it's something that anyone could do, without skill, why would anyone be impressed by that?
If someone says "if a friend used ai to make me a gift like in TFA, I'd be pretty offended" and not spell out what TFA means and make me ask ai, I'll be shaking my head
Ironically, I think that serves as an absurdist refutation of the argument. On the gift scale, the question is appropriateness, a measure of sacrifice, and a measure of thoughtfulness. Personally I'd find some kind of AI-personalised gift to be slightly less worse than buying me a Gift™ from a major chain store.
Best day was when my dad said he's good at Texas Hold'em, I said 1v1 me, I won, he said it's not realistic unless we play for $200, I agreed, I won again
If you don’t learn how to play every instrument, sing, and use your private plane to fly on location to film the music video then your soul ain’t even in it bro
I need millions spent, rainforests burned down, office complexes erected, ecosystems and lives ruined, layoffs - or it didn’t happen bro. It’s just AI
It's utterly mortifying. I would have been having an out-of-body experience if I was in attendance at such a wedding. If it had been my own wedding, I'd have been livid at the insult.
I can't even imagine doing this. It's not that hard to make a special video once you've collected the source material. It won't look professional at all, but nobody cares about that at a wedding.
I think broadly I'm in agreement that the censorship via blacklisting threats was unwarranted. That said, I also think we should keep in mind that this isn't some public forum made for adults to have discussions, it's a public block game server. I think it's more than reasonable to say that the average minecraft player is probably a child and one of the most popular servers being full of swastikas and racial slurs probably isn't good for children. Personally I think there was potential for some kind of middle ground, but I'm also not mourning the loss of the obsidian nazi builds too hard. The paradox of tolerance and all that. The vast majority of the anarchy spirit is still there, it's just slightly less edgy. It's hard to discuss in good faith because the advocates for lack of censorship here are largely people who want to spam the N word in chat all day or their unwitting allies. Ultimately, whatever the outcome (and I think the current outcome is at least /ok/), I've made peace with the possibility of losing minecraft as a medium for totally free speech. It's just a block game.
> I think it's more than reasonable to say that the average minecraft player is probably a child and one of the most popular servers being full of swastikas and racial slurs probably isn't good for children.
Maybe. They’ll encounter if eventually and if they are coddled too much they can’t handle it. I also think folks forget, or perhaps they were coddled, that kids already know about a lot of this stuff and when parents aren’t around say all the bad works and make very, very crude jokes. That’s what kids do. That’s what we did.
Sure, kids will encounter a lot of things, but there’s a difference between coddling and having conversations when the time is right (well, better - there’s rarely a correct time in any exact sense with kids).
Our kid is old enough now to have a good grasp on “world war 2 was bad, nazis are bad”, and if they were to hop on this server and then we have discussions surrounding ie the “obsidian swaztikas” mentioned above, I think it would go alright.
This kid is also smart, and emotionally aware, and actually a pretty cool dude. They can swear around us, and never in anger towards someone, and tbh they’ve said “oh shit” once while playing a game with us because they got spooked and last night during a run on Marathon they went “hey phatskat, I might use a swear word”. I asked what they wanted to say and why they were hesitant (since they know the rule that it’s ok generally), and they explained that swearing makes the “queasy” lol. A couple minutes later they went “ok, I’m gonna say it. Fuck yeah!”
All that is to say, I don’t feel like they’re coddled, and they also aren’t just going to grow up like I did in the Wild West of the 90’s internet. I saw a LOT of things I shouldn’t have, way too soon, and I also grew up in an environment where hiding that from my parents was the safest option. So yeah me and my friends swore and made off color jokes around each other because the adults would get mad, despite us learning a lot of the crude stuff from them and then Something Awful et al. In hiding it, I felt like the harder topics were absolutely not able to be broached with my parents, and looking back on it that sucks.
The way my partner and I are approaching it is to be up front and have the conversations we can at the kid’s level in a way that makes sense (eg age six: war bad, age ten: World War Two was a war about…).
There’s a middle ground between coddling and bootstraps, and it’s the kind of parenting I want to encourage others to do if they can.
You making the rest of the world foam padded because you don't want to control what your kid can access is gross. The rest of the world didn't have a kid. You did.
That’s a wild take tbh. In a different comment I did say that ideally the community would’ve taken action before MS had to step in. I don’t want to make the world “foam padded”, and in particular when it comes to fascism it should be stomped out wherever it appears, point blank. It’s a bummer that Microsoft came in and threatened to blacklist the server, and at the same time if you have a nazi in your bar and you don’t kick them out, you own a nazi bar.
Yes, my kids will run in to nazism in the wild, and I can’t control that, and if they ran into in a Minecraft server we’d talk about that and maybe even make an effort to clean it up ourselves - that’s what I think that community and frankly any community that doesn’t want to be a nazi community should do.
That’s a false equivalence and imo disingenuous - Nazis are understood by the broad majority to be “bad”. We, the public, don’t want nazis around - period. If I go to a bar and there’s a handful of obvious nazis there, I’m leaving because said bar has said “we’re ok with Nazis” and that’s a Nazi bar.
Most communists don’t hold abhorrent beliefs such as “Jewish people should be eradicated” or “the world belongs to the aryan race”, but a Nazi is a Nazi, there’s no grey area there.
1) that said bar knows everyone's political mindset, including those which haven't been made public;
2) that said bar actually treats said Nazi with decency;
Also, most communists hold the belief that there must be a violent revolution and the opposition should be executed, specially those of the tankie variety.
Edit: I have noticed you switched the count of Nazis from singular to plural ("if you have a nazi in your bar" -> "If I go to a bar and there’s a handful of obvious nazis") while proposing I'm being disingenuous. This might not have mattered to you, but the prevalence of an ideology is very important to whether a bar "is a Nazi bar" or "happens to have a Nazi".
3) “most” is doing some heavy lifting, and even so, you are showing the shades of communism. Nazism expresses an ideology of hate and racial superiority, it’s a completely different beast. (And yes I know that communism has been party to some ethnic cleansing such as in Stalinist Russia, however, that belief system of ethnic superiority is not inherent to communism)
1) fair enough, I was focusing on the original post;
2) disagree, the bar might be a pretty public place, so being allowed in is just the default; or they might have been personally allowed in, but is treated as the butt of jokes;
3) is it? "most" is pretty big group. If you take issue, we can replace it with "tankie". Also, does it really matter whether the motivations are racial or not? Mass murder is still mass murder, regardless of motivations.
Still, I feel like you are missing my main point. Having a Nazi, even if an obvious one, isn't enough for a bar to be nazified. It might be the trigger for that, but it might not. I argue that this "nazification process", which mirrors the "degeneration" process in libertarian literature, isn't a binary thing that should be treated this reductively.
I disagree on the “nazification” point, your main point, because fascism is the kind of insidious thing that can’t be allowed a foothold. To your point 2, even if the Nazis were allowed in to be the butt jokes, it’s still allowing them in and tolerating them.
If an establishment is aware of Nazis in their ranks and they aren’t condemning them, then they’re supporting them by way of not removing them. It’s the paradox of tolerance at play.
I don’t want to really derail into different aspects of communism, just want to say that most communists I’ve met or been exposed to only believe in violent revolution if peaceful revolution isn’t an option. Again, this isn’t, to me, an equivalent to the violent beliefs of Nazism.
I have to disagree on fascism being this insidious bogeyman. While I agree that they ought to be fought against, IMO this is reaching into red scare territory (which is fitting, given that both share a really close ideological root).
I also disagree that merely keeping a Nazi in your establishment is support for Nazism. Simply not removing a Nazi is no more than not removing a person, it doesn't speak whether the ideology will actually take root.
The paradox of intolerance, in its original form written by Karl Popper, is about discussions. In this context, intolerants are people who forego argumentation. Kicking a person, Nazi or not, who has been acting peacefully and has been engaging in argumentation isn't "intolerance against intolerance", it's intolerance proper. You may argue that you are trying to prevent a future situation with this, but unless it is a 100% guaranteed (which I argue it isn't), it's just plain intolerance.
Finally, bear in mind that there are more equivalences in beliefs than you think. Mein Kampf didn't speak anything about Jew mass murder (and it still happened), and most (as in, the ones you see "marxist-leninist" in their profile) socialists admit that a nonviolent approach is basically impossible. In the end, both ideologies share the willingness to dehumanize and murder their opposition (and for similar reasons, Nazi-brand racial hatred derives from the same core idea).
> Finally, bear in mind that there are more equivalences in beliefs than you think. Mein Kampf didn't speak anything about Jew mass murder (and it still happened), and most (as in, the ones you see "marxist-leninist" in their profile) socialists admit that a nonviolent approach is basically impossible. In the end, both ideologies share the willingness to dehumanize and murder their opposition (and for similar reasons, Nazi-brand racial hatred derives from the same core idea).
Spot on. It's interesting to me that we've failed to stomp out communist sympathies but I guess we didn't stomp out Nazi sympathies either.
Both are authoritarian ideologies that are incompatible with free expression, free trade, and free peoples. Yet people openly talk about being communists despite the above and despite the fact that tens of millions of dead precisely because of communist ideologies and failed economic policies. To claim that fascism and specifically Naziism is an insidious boogeyman means you should also claim the same about communism. Curious how some/many folks don't or don't seem to understand that.
Tbf, communism is indeed more broad than Hitler's Nazism, from pre-marxists to Proudhon ancoms (although a similar comment may be made about the common sense definition of Fascism), hence I changed scope towards traditional Marxist-Leninists.
It's more broad but I don't think that changes anything with respect to the destructiveness and need to stamp out the ideology. Nazism is just a flavor of either authoritarianism or maybe just a flavor of a broader racial/cultural superiority ideology. Typically in the west we reject the whole tree and not just some of the branches. I apply the same argument to communism. And you can certainly find more charitable interpretations where maybe some freedoms are still present, but you can do the same thing racial or cultural superiority ideologies or similar.
its sad ppl cant run their own servers without companies interfering. Was never an issue on games like CS. sure there was a lot of toxic ones but also rly nice ones. you cant moderate human nature. hiding it does no one any good either.
I don't understand why you're being downvoted for this. Microsoft should not be moderating privately-run servers.
Sure, on the realms or whatever they're called or whatever servers Microsoft do operate, fair game and good idea. But if I'm running a Minecraft server on my homelab it should be my decision what behaviour is acceptable within that server.
It's a case of some people making it worse for everyone. If people behaved on the server, MS wouldn't have intervened, which then wouldn't have made 2b2t cave on a what feels like a core ideal. It may only have chipped a corner of that ideal, but it still stings.
That said, I think it is inevitable for any anarchist server that gets large enough to end up in this exact situation. MS wasn't going to let one of the biggest and most famous servers of its most popular game be filled with swastikas. Even less so when it's so popular with kids.
In a funnier world, 2b2t would have said 'no', but I have a feeling MS would escalate, and that whatever email or whatever the admins got probably implied as much, so maybe that world wouldn't be funnier after all.
> That said, I think it is inevitable for any anarchist server that gets large enough to end up in this exact situation.
Agree, and I think it’s the community’s responsibility to decide what is and isn’t tolerable - even within anarchy. Forget MS, the (imo) proper response should have been the community actively choosing to deface and destroy the nazi stuff, or outright ban it from the moment it became a thing.
I agree that it's worth reading the original source and encourage all to do so. My takeaway however was that the majority had a much stronger body of evidence than the dissenters.
Many of us work on Java monoliths that started in the 2000s when it was in vogue and we still have to keep them chugging along on Java 8. Personally I'm familiar with all the new features that have come out in the last few years, but for my actual work, java is literally stuck in the past.
In this sense, Java is already the next Cobol. I usually ask one or two questions about class loading in interviews (of senior Java devs), the younger ones are frequently stumbling upon these, and they don't even understand why I'm asking this. Good old Tomcat days, when you could run out of PermGenSpace if you weren't careful :)
Good news is, Oracle extended extended extended support for Java 8 will not last forever, and eventually - if you work in a regulated industry - the company WILL have to pull the trigger.
On the other hand, "where there is muck, there is brass", so a little bit of legacy can be beneficial for some.
The problem in a large codebase is keeping consistency when upgrading.
I upgraded a codebase of approx 100 kloc from Java 7 to Java 8 a couple of years ago. As I didn't want mixed patterns for the same thing throughout the code base I replaced most of the loops with their streaming equivalent. I had the luxury of having the budget for doing so.
Mixing patterns of newer language features alongside older ones can make the code base hard to read.
Yeah, that would be a more nuanced take. The comments I'm indirectly referring to are people who are literally unaware of these features and talk confidently as if they do not exist.
For those unfamiliar, this implies they would have been able to override a presidential veto, so the administration backtracking is just saving the president the embarassment of a defiant congress/disunified party.
When Trump vetoed a drinking water project for Colorado that had passed both the House and Senate by unanimous consent they failed to override it. Don’t underestimate how afraid Republicans in Congress are of angering Trump.
Trump cares about winning, and appearing invincible, a lot. That’s why in close races, he only endorses near the end when he’s sure who’s going to win.
Update: found this explanation in a comment at the top of the (surprisingly short) Go file in the linked repo:
The target client is Netscape Communicator 4.51 (both the 40-bit export build and the 128-bit US build) with its clock set to the year 2000.
Go's crypto/tls cannot help: it dropped SSLv3 in Go 1.14, never accepted the SSLv2-compatible ClientHello that Netscape 4 sends, and never had RC4-MD5 or the 40-bit export suites. So this file carries its own tiny SSLv3 server-side implementation on top of stdlib primitives (RSA PKCS#1 v1.5, RC4, DES, 3DES, MD5, SHA-1). The server key is 512-bit RSA so that export clients can encrypt the premaster secret to it directly, without a ServerKeyExchange.
reply