10,031 karma · joined March 4, 2016
I have a blog: https://karl.kornel.us/
My HN handle is also my Twitter handle.
My work email is a!k!kornel@stanford,edu (with ! removed and , corrected).
Amazon Linux 2023 is affected; Amazon Linux 1 & 2 are not. Status updates will be posted to https://explore.alas.aws.amazon.com/CVE-2024-6387.html
EL 9 is also affected, but not yet released. The tracking task will update as things move along.
Linux consoles (the ttys that appear over local display or remote-access KVM, or the ttyS* devices that appear over serial ports and IPMI SoL) do not use sudo or su. Those consoles use a program like `getty`, or a window-manager; all those programs are non-suid programs that are started as root.
Your system should have a root password set, for logins via console.
The above tracking method works for containerized things. For virtualized things, it’s different: When a Linux system has nothing to do (all processes sleeping or waiting), the kernel puts the CPU to sleep. The kernel will eventually be woken by an interrupt from something, at which point things continue. In a virtualized environment, the hypervisor can measure how long the entire VM is running or sleeping.
I: Identifier, is an identifier. "Oh, that's a [a thing, or a location]."
N: Name, tells what the thing is. "Oh, that's the Sears Tower."
L: Locator, tells how to get to something. "Oh, that's at 233 S. Wacker Drive Chicago, Illinois 60606"
That was the second example to come into my head (the first was the Bank of America building in San Francisco), and I think it speaks to things that both* examples have changed their names! The Sears Tower is now the "Willia Tower", and the "Bank of America Center" is now "555 California Street".
And even place names don't stay the same! In 2019, Stanford University renamed "Serra Mall" to "Jane Stanford Way": addresses changed; building names did not.
Just goes to show why it's so important to implement redirects, and (in HTTP at least) why the "301 Moved Permanently" response code exists.
I help run an HPC environment that is spread across two data centers, one on-campus and one off-campus. The campus network is already spread across those two data centers, but the HPC environment also includes a couple of VLANs that are completely private.
So, our connection to the campus network is two 100 GbE campus-network ports in one data center, and I have two dark-fiber circuits (two fiber strands per circuit) from one data center to the other, which carry the private VLANs. One circuit is direct; the other goes via a third building.
The flexibility of the dark-fiber service means I can use the same 100GBASE-LR4 transceivers that I use for the connection to the campus network. I don't have to deal with weird transceivers (like single-strand single-lambda Bi-Directional 100 GbE), or custom wavelengths. UIT Facilities gives me a fusion-spliced and tested pair with an LC jack, and it Just Works™.
Stanford University IT (https://uit.stanford.edu) provides a large number of IT-related services, from desktop support, to networking, to analog & VoIP telephone, Kerberos, LDAP, AD, RADIUS, O365 & Google & Zoom, email, cloud, and more!
Within UIT, Middleware & Integration Services (MaIS) runs the Registries. Many central & distributed IT systems are fed by the Registries, which take information from disparate sources, and combine them into single views of Organizations, People, Accounts, Courses, Groups, etc.. MaIS provides XML & JSON APIs to interact with the Registries, as well as feeding information into LDAP. They also implement business logic, mapping student and employee careers into account & service lifetimes, group memberships, and more.
MaIS apps are almost exclusively Java (using Spring). Tomcat and the Oracle Application Express (Apex) platforms are used as middlewares. The database is, of course, Oracle (with PL/SQL). Knowing any of the following would be a plus: HTML5, JQuery, shell scripting, and SnapLogic.
MaIS are looking for three people:
• IT Software Developer: You'll be working on existing Registry code, fixing bugs, and implementing enhancements. More information: http://phxc1b.rfer.us/STANFORD28zQlx
• IT Software Developer (Oracle APEX): This is the same as the above position, but is focused more on our webapps than on our backend code. More information: http://phxc1b.rfer.us/STANFORDvMXQlz
• IT Systems Analyst: This is similar to the IT Software Developer, but you'll be spending more time talking with clients within the University, understanding their requirements, and coming up with solutions. More information: http://phxc1b.rfer.us/STANFORDw5aQm0
If you don't already live in the Bay Area, we provide a relocation incentive. Depending on where you live, we provide free transit passes. Unfortunately, if you don't commute, you will have to pay for parking for the days you're on-site (except in Menlo Park). There is some on-call around the holidays. We get a 403(b) match, good healthcare, and 30+ days off per year (holidays + vacation). All Benefits are all publicly documented at https://cardinalatwork.stanford.edu/benefits-rewards.
If you have questions, feel free to reply here or email me (the info is in my profile)!
> … a relatively small part of the API requires HTTP requests to be sent to generic S3 endpoints (such as s3.us-east-2.amazonaws.com), while the vast majority of requests must be sent to the URL of a target bucket.
I believe this is talking about virtual-hosted style and path-style methods for accessing the S3 API.
From what I can see [0], at least for the REST API, the entire API works either with virtual-hosted style (where the bucket name is in the host part of the URL) and path-style (where the bucket name is in the path part of the URL). Amazon has been wanting folks to move over to the virtual-hosted style for a long time, but (as of 3+ years ago) the deprecation of path-style has been delayed[1].
This deprecation of path-style requests has been extremely important for products implementing the S3 API. For example…
* MinIO uses path-style requests by default, requiring you set a configuration variable[2] (and set up DNS appropriately) to handle the virtual-hosted style.
* Wasabi supports both path-style and virtual-hosted style, but "Wasabi recommends using path-style requests as shown in all examples in this guide (for example, http://s3.wasabisys.com/my-bucket/my-object) because the path-style offers the greatest flexibility in bucket names, avoiding domain name issues."[3].
Now here's the really annoying part: The REST API examples show virtual-hosting style, but path style works too!
For example, take the GetBucketTagging example. Let's say you have bucket "karl123456" in region US-West-2. The example would have you do this:
GET /?tagging HTTP/1.1
Host: karl123456.s3.amazonaws.com
But instead, you can do this:
GET /karl123456?tagging HTTP/1.1
Host: s3.us-west-2.amazonaws.com
!!
How do I know this? I tried it! I constructed a `curl` command do to the path-style request, and it worked! (I didn't use "karl123456", though.)
So hopefully that helps resolve at least one of your S3 annoyances :-)
[0]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/RESTAP...
[1]: https://aws.amazon.com/blogs/aws/amazon-s3-path-deprecation-...
[2]: https://min.io/docs/minio/linux/reference/minio-server/setti...
Well, yeah. It's an article in the "Opinion // Editorials" section, by the paper's Editorial Board.
I remember, at least in the beginning, smaller systems were unable to provide their own sine wave, and would rely on the grid for that. And even today, if full net-metering were in place (with the possibility of export), I would expect the grid to still provide phase synchronization (when solar is not exporting), and a path to other consumers (when solar is exporting).
Same here, on the Peninsula of the Bay Area: Generation comes from generation owned or contracted by SVCE [0], which is then delivered via PG&E (both transmission and distribution).
Billing is handled by PG&E: My bill has a section for PG&E charges, and a section for SVCE charges. The PG&E section has a generation credit, that effectively removes any costs of non-SVCE power generation, leaving the costs of transmission & distribution.
So, about that… The Medallion Signature Guarantee is often obtained from an entity not involved in the transfer. From [0] on my post:
> We do not provide medallion signature guarantees for assets you're transferring out of a Bank of America or Merrill account (guarantees are typically provided by a third party not involved in the transfer or by the firm receiving the assets).
In a way, that's a good thing: By the time you've initiated this transfer, the receiving entity should have done their KYC. And the losing entity probably would not want to take the cost of the liability. Having a third party—one who has had you as a customer for some time—is a good layer of security.
For what it's worth, you may wish to consider a credit union, as it's less likely that a credit union would also own a brokerage.
That's OK, though, because the person making the stamp is keeping a lot of records, so they'll know what they stamped.
When I first got my Treasury Direct[1] account, I couldn't verify my identity using their online process, and so I had to mail in FS Form 5444[1]. My local credit union had "Medallion Service" as one of the reasons for booking an appointment (separate from "Notary"), and they were able to take care of it. As mentioned in the article, the person at the credit union asked me for a monetary value. As it was a new Treasury Direct account, I said "$10,000" (the maximum amount of Series I bonds you can get per calendar year).
And as implied in the article, my credit union had no problems issuing this, even though they were not involved in Treasury Direct in any way.
It's interesting, all the 'little' 'home-grown' ways of identity guarantee that pop up when needed.
[0]: https://www.bankofamerica.com/signature-services/medallion-s...
https://news.bloomberglaw.com/mergers-and-acquisitions/matt-...
You can get to the same content here:
https://www.bloomberg.com/opinion/articles/2023-02-16/the-se...
Which was previously posted to HN here:
I am surprised that the organizers did not catch this, though I don't know enough to know how much time the organizers had.
> For a 17 years old, even throwing together such work is already an worthwhile result. Teens is a golden age of compilation and remixing.
For kids, in general, if one kid makes a claim ("I made this," or "This game cartridge is mine") that turns out to be false, there is generally some sort of comeuppance. That could be as simple as the kid losing respect within their peer group, or it could be as serious as parents being informed about the kid commiting a petty crime.
This is important, because it instills society's values (such as they are) in the child. For example, what if kid A steals a game cartridge from kid B, and then kid B retaliates by shooting and killing kid A? That response is generally frowned upon, in most parts of the world.
In my opinion, it would be fine if "the child" was presenting a poster showing the current state of research in microbial recycling of plastics. That's a cool thing for a high school senior or college freshman to do. But to take existing research (stealing), manipulate images (lying), and cast it as their own work (stealing and lying), on a national stage, that requires an appropriate comeuppance.
Most routers do not put ping-processing in the "fast path". That is, instead of having the ping be processed by an ASIC, the ping gets processed by the router's CPU. And ping-processing is typically a lower-priority task. Because of that, you can't assume that the high variation in latency is because of Starlink.
I got a California REAL ID a few years ago, at my normal renewal time, for a few reasons:
1. I already had all of the necessary paperwork.
2. I was curious if the process would be very different (it took a ~5 minutes longer than a non-REAL ID, but that was it).
3. I thought it would count as a List A document on the Form I-9 (https://www.uscis.gov/sites/default/files/document/forms/i-9...)
On that last point, I was wrong: For the Form I-9, a REAL ID counts the same as a driver's license. Turns out, I'm not the only one who thought this (https://sdeahr.org/hr-blog/how-does-real-id-affect-employee-...).
As a result, I'm no longer in support of the REAL ID.
What's more, to get a US passport, you need to provide proof of identity. And for new adult applicants, the most common form of ID is a driver's license!
See the last paragraph of my post for a link to more info.