Hacker News Reader

Launch feels like just yesterday! https://news.ycombinator.com/item?id=9935458

Artemis2on Ask HN: Does anyone use an alternative to a password manager?

Dashlane can change your password on a lot of sites. Unfortunately they do it server-side.

Artemis2on Critique My Plan: API Key for Authentication

You can automatically apply policies such as expiration and manual rotation to API keys/tokens. You can’t really do that seamlessly for username/password combinations.

Artemis2on IPvlan overlay-free Kubernetes Networking in AWS

Try this: https://jvns.ca/blog/2017/10/10/operating-a-kubernetes-netwo...

Artemis2on HashiCorp Vault 0.9

I talked to their Enterprise sales team back in June about two missing features: Kubernetes auth and KMS-based auto unseal. They mentioned that nothing was in the works at the time, and it’s nice to see this feedback (assuming this is not a pure coincidence) incorporated so quickly in v0.8.3 and v0.9. Now I just need to be able to afford the Enterprise plan!

One interrogation I have is that if I ever want to integrate cloud auto unseal into Vault and make a pull request, what is the incentive for Hashicorp to allow the merge? Wouldn’t it only remove value from their paid product?

Artemis2on Kured – A Kubernetes Reboot Daemon

I recently learned about a CoreOS-specific operator for that purpose: https://github.com/coreos/container-linux-update-operator. In standard CoreOS installations, once system updates are installed, the node is automatically rebooted using a semaphore. Instead, this uses the Kubernetes API to drain the pods from the node for a clean shutdown.

Kured has a feature to stop reboots if there are triggered Prometheus alerts; that’s a nice touch.

Artemis2on Bitcoin mining uses more energy than Ecuador – but there’s a fix

I have found this article’s quality to be extremely low. The “fix” mentioned in the title is proof-of-work, with an explanation that spans one full sentence. According to the author, the annual electricity consumption of bitcoin mining is estimated to be 27.03 TWh. To compare, we have a very scientific “that’s still peanuts compared to the energy use of the internet”. Recall that the bitcoin network processes approximately 3 transactions per second when running in full gear.

I dug up this report [0], which seems to be one of the most recent estimates of datacenter energy usage (US only unfortunately). The estimated energy usage for datacenters in the US is 70 TWh in 2014, and estimated to be 73 TWh in 2020.

So bitcoin uses approximately ⅓ of the energy the Internet uses in the US. That is far from “peanuts”.

0: https://eta.lbl.gov/sites/all/files/publications/lbnl-100577...

Artemis2on Square announces the Register, a $999 point-of-sale device for larger businesses

I don’t think Apple could sell transaction data:

> Apple Pay retains anonymous transaction information such as approximate purchase amount. This information can’t be tied back to the user and never includes what the user is buying.

https://www.apple.com/business/docs/iOS_Security_Guide.pdf, page 38.

They don’t have much information that the issuing bank/card network do not have already.

Artemis2on Square announces the Register, a $999 point-of-sale device for larger businesses

Not really. The token merchants/payment processors get is very easily trackable across transactions. It is a bit harder to link to a real card number though.

Artemis2on Security Incident – DNS Breach

We have a two-man rule for such accounts: one person (or one group) is responsible for the password, and the other has the 2FA secret on their Yubikey. The other rule is to not use these accounts; as an example use use root AWS accounts once or twice a year when we need to fill in their forms.

Artemis2on Security Incident – DNS Breach

We do use Dashlane and GPG for sharing secrets. In this article’s case I would bet that nobody changed the account’s password because (i) it’s no one’s responsibility (ii) they do not want to disrupt someone else’s workflow.

Artemis2on Security Incident – DNS Breach

Cloudflare will not let you have individual users without the (unspecified) “Enterprise” pricing plan. Even on the Business plan, we get to copy/paste one password around the team. Great for security.

Every other service (especially that critical!) we use gives it away with the actual service. I really dislike this about Cloudflare.

Artemis2on Paw – macOS HTTP client for testing and describing APIs

Paw is worth the money. I have been using it for two years and I really enjoy working with it. The UI/UX is lightyears ahead of everything else I have tried. I haven’t used Paw for Teams but it seems expensive, especially for existing license holders.

Artemis2on AWS bastions and assume-role

It’s not what you think. It’s more about disclosing business-related data or metadata (e.g. customer names, last time a customer logged in) than technical information (e.g. internal service names, minor debug information).

Artemis2on Gluon – Deep Learning API from AWS and Microsoft

Curious to see what HN thinks of this. Are Amazon and Microsoft going against Google and Tensorflow? Will we see Gluon Processing Units on AWS and Azure in the near future?

Artemis2on Announcing Microsoft Edge for iOS and Android, Microsoft Launcher

Why are you comparing the latest version of Chrome to Edge 12, which according to Wikipedia was last released August 27, 2015?

Artemis2on Stripe Elements: Pre-built UI components to help you create checkout flows

True, didn’t realize they had pulled the block. Would be interesting to know how the decision was made with respect to user privacy (vs. breaking sites). I don’t know which other extensions may block Stripe.js unfortunately!

Artemis2on Stripe Elements: Pre-built UI components to help you create checkout flows

No, because PCI DSS considers using iframes to host card entry fields cannot impact "the security of the payment transaction": https://www.pcisecuritystandards.org/documents/Understanding...

Artemis2on Stripe Elements: Pre-built UI components to help you create checkout flows

It could be because tracker-blocking plugins (I use Ghostery) have started blocking Stripe.js. This is because they are now recommending to include it on every page of your site for fraud protection, which is a use case of user tracking: https://stripe.com/docs/stripe.js#including-stripejs.

Artemis2on Facebook Lies

Quite looking forward to GDPR forcing Facebook to actually remove all records they have on me. It’s a pain to implement for businesses, but it’s ultimately the right move.

Artemis2on Slack Closes $250M Funding Round at $5B Valuation

This should cover guest members for you: https://slackhq.com/new-improved-ways-to-manage-guest-accoun...

Artemis2on Prime Day 2017: 12.9M DynamoDB requests per second

Something I appreciate very much with AWS is how much dogfooding Amazon does. In contrast, Google has said in the past that GCP is not used by Google engineers (and it shows, occasionally GCP goes down but actual Google products do not!). There is also no clear indication that Microsoft is actively using the public deployment of Azure.

Artemis2on Android Oreo

https://www.android.com/security-center/

This page says 8 billion a day, which seems inconsistent. Also how many apps are there on the Play Store to scan that many?

Artemis2on Serverless Raspberry Pi Cluster with Docker

Scaleway has a good array of ARM cloud offerings: https://www.scaleway.com/armv8-cloud-servers/

Could this work for speeding up builds of ARM images and then deploying locally?

Artemis2on SoundCloud is here to stay

I think they desserve a pass on this one, media made it sound like they were on the brink of imploding in the past few weeks.

Artemis2on Fork a distributed Postgres database with Citus

Definitely not good for PCI DSS. Requirement 6.4 reads:

  Examine policies and procedures to verify the following are defined:
  • Development/test environments are separate from production environments with access control in place to enforce separation.
  • A separation of duties between personnel assigned to the development/test environments and those assigned to the production environment.
  • Production data (live PANs) are not used for testing or development.
  • Test data and accounts are removed before a production system becomes active.
  • Change control procedures related to implementing security patches and software modifications are documented.

Artemis2on Hcrknews.com (Flagged / Censored content can be seen)

Besides the flagging, I really like hckrnews as a daily reader. The ability to see immediately what is new since my last visit (and to tune the number of posts I want to see) is a huge timesaver.

Artemis2on Amazon Reviews

I was checking if http://amazon.reviews existed. Indeed it does, and its sole purpose is to redirect to this page.

Artemis2on The Man Who Picked Victorian London's Unpickable Lock

As usual, there is an excellent 99% Invisible episode: http://99percentinvisible.org/episode/perfect-security/

Artemis2on Two new open source projects to make Kubernetes easier to use in production

Nice to see Heptio releasing some very accessible tooling to the community. We’ve solved the Ark use case with continuous etcd backups + EBS snapshots but this looks cleaner and more agnostic. Sonobuoy could easily replace our manual testing on brand new Kubernetes deployments (after upgrades, or when porting configuration to other platforms).