Are you sure you have that right? Chrome and curl have probably been used in a _lot_ of crimes?

Think of it more like writing a wormable exploit. If you unleash something like that, you will be found criminally liable, even if you didn't personally approve every machine getting popped.

What are ancient usb connections? Type A? B?

How are you going to download photos from your USB Nikon camera to your USB iPod Photo if you don't even have a UC-E6 to 30-pin dock connector cable?

Mini-B cables can be somewhat hard to find.

There was also the Micro-A which I found on some dev boards. I think the Arduino Due (Arm Cortex M3 chip) used one for the USB host port as well as an Atmel Arm uc board.

Also that weird, really small USB connector that was found on some early digital cameras. I think Kodak was a big user of it. Sorta looked like a narrower and taller version of the Mini-B. Maybe the Mini-AB but that doesn't look like it. I have one in my box at home.

Old digital cameras just used non standard usb shapes so they are almost impossible to find now.

Ah, they were proprietary then. I thought they were an early standard that lacked a 5th pin.

Since school started this year, I bought both my kids TI-84 plus CE calculators. Both were being sold cheap because “no charging cable” (uses a mini-B) while I had a dozen in a box.

I wish that happened a lot less as I have entirely too many old cables.

I hold on to my precious few mini-Bs. They also seem to have a tendency to break.

There are lots of companies that provide low end services for free to attract people who may now or in the future be decision makers at large companies.

For better or worse, the free plan that Cloudflare has provided me for 10 years for my 20-30 hobby/personal domains has gotten them several hundred thousand dollars in business.

indeed, typically by using their huge cash piles to build a moat around them, so no small new player has a dream of competing.

This is why I refuse to give any money to AWS/GCP/Azure or anyone who runs on them.

You should avoid giving them money because they're 50 times more expensive than the competition, not because of that.

I'm pretty sure that's impossible nowadays, at least avoiding everything that runs on AWS.

Repo suggests that they're running their own (rate-limited) DERP servers.

edit:

Which are probably tailscale's, as it's under tailscale/ github org?

Database?

I think maybe the right answer is to have a standardized, curated group of libraries pegged at some sort of LTS release that only backports security fixes. However, someone would need to pay for creating and maintaining this -- and then you wonder where the money would come from?

someone tried doing this for rust, but the reaction was that it was vibe-coded/low quality.

https://github.com/rust-stdx/stdx

https://news.ycombinator.com/item?id=48571266

Note that there are baby versions of this that are uncontentious, for example

https://blessed.rs/crates

this is missing the LTS release. but it is a curated group of libraries that are relatively uncontentious to recommend.

That or potentially fast tracking merging popular libraries into the standard library. Or at least concepts from popular libraries. Basically all the "most downloaded" crates on the Crates.io front page should be candidates for merging into the standard library.

https://crates.io/

Good ideas are pulled into the standard library.

https://crates.io/crates/once_cell

https://doc.rust-lang.org/std/cell/struct.OnceCell.html

Not everything should be eligible for this treatment. Certainly not an HTTP library or something without extremely widespread applicability.

Nearly all of my projects used once_cell, so it's good to see that pulled in. I wouldn't want to see anyhow, thiserror, anything opinionated, or anything domain specific in the std. That's a weight you have to bear forever.

Remember how long Python 2 -> 3 took, and look at the ancient and awful stuff in Python 3's standard library. Rust is not the right language for this.

2GB is so tiny it's almost irrelevant when talking about analytics?

Here's the entirety of the Caddy config to reverse proxy something with managed tls certs. I feel like it's not that big a deal?

  photos.example.com {
          reverse_proxy 127.0.0.1:8080 {
                  header_up X-Real-IP {remote_host}
          }
  }

caddy passes on the source IP by default so it's even easier than that

    photos.example.com {
        reverse_proxy 127.0.0.1:8080
    }

the immich documentation covers this as well as nginx, apache and traefik https://docs.immich.app/administration/reverse-proxy

Heh... I self-host Immich with Caddy, and it's more complex, really. Caddy runs in podman, there are firewall rules to allow traffic in and out and proper dependencies in systemd units and a readme that covers all that. Exactly the point OP is making.

All because we forced TLS on everyone instead of solving the JS injection problem in some other alternative way. Like... legal, maybe?

I self-host immich and just did apt install caddy + the config above, it can be that simple

I don't know what you're on about. Just run Caddy and it does it all for you.

That is exactly what I am talking about.

You say caddy. The next person will say nginx-proxy-manager. The next will say DNS challenge let's encrypt behind wireguard VPN. The next will say Traefik. The next will say CloudFlare tunnels.

Everyone has their preferred solution and its always the best and simplest.

As a one-person-scale selfhoster that has wrangled Apache and nginx before, I'm also saying go for caddy straight away.

Just commenting to represent the NPM referrers that you mentioned, since it seems most HN users are Caddy enjoyers

As the next person on this post, I second Caddy

Ok I'll bite again.

Do you want a caddy service embedded with every web app you self host or are you running a single one serving all your apps?

From my understanding if you want acme http challenges to just work with let's encrypt you probably need to use a single, separated caddy to front all your apps.

In that case if I ship a caddy service pre configured to do TLS termination with my app it's just more trouble for you no?

Fair enough, http is enough - I anyways have one caddy to rule them all. However, if your app is picky about reverse proxying, e.g. headers, please add a sample caddy config. It's often the first thing I'm looking for if I'm trying out a tool and want to host it under a subdirectory before configuring a subdomain.

No, HTTP is not enough, I submitted a couple HTTP-only links to HN lately, they got flagged within half an hour, even HN crowd can not open HTTP links anymore ;-)

That's not really HN's fault but all modern browsers will warn the user before accessing an http site with a security warning.

My point was not to use http only as a finished solution, but to let the admin front the http-only service with their TLS termination solution of choice.

We are talking about hobbyists here.

... Of which (TLS terminators) caddy is IMO the easiest for hobbyists, as was the starting point of this subthread

I already commented on this twice here, but here it goes again:

I self-host Immich with Caddy as TLS terminator, and it's far from obvious.

They all run on a small N150 PC in my closet, the same PC serves as my internet router. Both Immich and Caddy run in podman-compose, and there are firewall rules that allow incoming traffic to Caddy and outgoing traffic from Caddy to update certificates. There's also a tricky setup of Systemd dependencies that make sure podman networking and firewall rules play nicely together and with other system config, like the bridge for the 2.4Gz range internal Wi-Fi and for external 5Gz Wi-Fi 6 card.

If not for the LLM help, I would have spent many days figuring out all the rough edges of this setup.

Which is exactly the point OP is making. Hobbying webhosting is hard nowadays.

I posted this in a sibling thread, but it's also appropriate here.

I self-host Immich with Caddy, and it's complex, really.

Caddy runs in podman compose next to Immich, there are firewall rules to allow traffic in and out and proper dependencies in custom systemd units in case podman networking goes bust after firewall rules are reloaded and a readme that covers all that.

Exactly the point OP is making.

Just provide a docker compose file.

What it shows is that there are a big number ofeasy options if you want to.

Nah he's entirely right. Serve http, let the user do https.

If you want to put caddy in front of yours? Great it works.

For me, running a much larger setup? Great, it also works.

For users who never expose it beyond an IP address on lan? Great it also works.

I don't think there really _is_ an equivalent at Walmart?

Walmart bakes fresh bread too. I get it Walmart sucks but they do have everything that a normal supermarket has, including fresh hot food, bakery, deli.