Hacker Newsnew | past | comments | ask | show | jobs | submit | AcidBurn's commentslogin

Resolved in ingress-nginx v1.11.5/v1.12.1 neither of which seem to have been released yet.


Looks like the container images for both versions are now available:

  registry.k8s.io/ingress-nginx/controller:v1.12.1  
  registry.k8s.io/ingress-nginx/controller:v1.11.5
The Helm chart has not been updated yet, but it looks like you can use the new container images by manually specifying the updated image tag in the values file:

  controller:  
    image:  
      tag: "v1.12.1"


No evidence, but the fact that the "IngressNightmare" PR piece was announced before there were even PRs created to fix this smells like the team at Wiz leaked this before it was really ready.

Whether the scores are legit or not, the fact that this was such a botched disclosure process is not a good look for the Kubernetes project, of which this is a part.

Edit: According to [1], the team at Wiz show a responsible disclosure timeline. Seems like the Kubernetes project's process didn't work so well. If Wiz is accurately reporting what happened in their blog, these fixes (or the plan for them) was available a month ago, despite seemingly not having working PRs until today, after the security announcement?

Again, I really appreciate the work of the team to ship this, but this isn't a good look for the Kubernetes project itself.

[1] https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabili...


For the sake of completeness I will also mention that the updated Helm chart is now also available:

  ingress-nginx: 4.12.1


I believe HTTP has had this feature since 1999 as the Accept-Language header defined in the HTTP/1.1 RFC[0].

As for why it does not get used, MDN suggests[1] it's because changing it may lead to fingerprinting but there are likely other historical reasons.

[0]: https://datatracker.ietf.org/doc/html/rfc2616#section-14.4

[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ac...


I recently started self hosting calibre-web[0] which consumes a calibre database and provides a basic web interface for viewing and uploading books to it. The killer feature for me is that it can act as a Kobo sync server. It makes getting my entire library onto my e-reader a breeze.

0: https://github.com/janeczku/calibre-web


Ditto. I did the same for my partner for his Lego instruction booklet collection. He have over 150 sets and managing all of his Lego booklet (through Lego official app) and the official Lego website don't have every single booklet. And those PDFs are rather large file (averaging 40+MB, some are 100MB, a few is 200MB). It wasn't feasible to keep it all in his iPad due to the storage space. So I used my desktop to handles that for him. The best thing about calibre-web, it allows him to upload the PDF and edit the metadata directly in his iPad's Safari than depending on me to put it up for him (I don't mind doing for him, just that I have terrible time management.) For him, he don't have to do manual management and it is in one place.

Right now, I am trying to set up a scrapping the metadata from few sites in calibre (Import List plugin). Because LibraryThing, WorldCatalog and Amazon are usually scrapping for books. The thing is I don't know how to do XPath expression even I tried to read the guide. I couldn't understand how the hell it work. I can understand LaTeX, Homebrew, Chocolatey, Bash, CSS documentation just fine, but XPath I am just dumbfounded.


It does also allow for conversion of EPUB -> MOBI without using the calibre standalone application. calibre-web is now my primary interface to my existing calibre database file. I keep calibre ready/installed but haven't needed it in over a year


I'm using this for my 80k+ documentation library and couldn't be happier - so easy to share your library with other users.

Kudos for your project.


Other than Amazon Certificate Manager as moatra mentions (which I don't think let's you export the certificate), I don't think there is currently an option for free wildcard certificates.

As an alternative you could incorporate provisioning of a Let's Encrypt certificate for the new subdomain into your deployment process since the process is designed to be automated.


Current rate limiting wouldn't really make it possible, unfortunately.


Not if you have more than five subdomains, you have to wait for a week, like me.


... if you need a different certificate for each subdomain. You are limited to 5 certificates per domain per week, each of which can be valid for many subdomains. Bad if you want to be able to add them dynamically every time a new name comes up, but if it is a static set...


I used SubjectAltNames on my setup. One domain/one cert, though I only did 2 subdomains.


Will this work for syncing configuration between two computers running different OSes (Ubuntu and Windows)?


Yes of course! This is already working.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: