PhilipRoman

Total system power (as in, drawn from the outlet)

I didn't do any significant customizations, it runs Alpine Linux. Here is my powertop output:

    Summary: 139.6 wakeups/second,  0.0 GPU ops/seconds, 0.0 VFS ops/sec and 0.9% CPU use
                Usage       Events/s    Category       Description
            100.0%                      Device         Audio codec hwC0D0: Realtek
            480.6 µs/s      38.3        Timer          tick_nohz_handler
            469.0 µs/s      24.6        Timer          hrtimer_wakeup
            330.0 µs/s      23.2        Process        [PID 2121] [irq/132-iwlwifi]
            281.2 µs/s      10.1        Process        [PID 3278] containerd --config /var/run/docker/containerd/containerd.toml
             28.9 µs/s       9.5        kWork          toggle_allocation_gate
             52.4 µs/s       7.5        Timer          inactive_task_timer
            279.3 µs/s       4.6        Process        [PID 3279] containerd --config /var/run/docker/containerd/containerd.toml
            363.9 µs/s       4.5        Process        [PID 3306] containerd --config /var/run/docker/containerd/containerd.toml

The system as a whole spends around 95-97% of time in pc8 state.

I use an electrical outlet meter. It's roughly €10, the only annoying thing is everything rebooting each time I want to move it.

>N100 based computer draw 9W at idle

That number seems suspicious. Right now my i5-6500T server is idling at <5W and an N100 is supposed to be even more efficient.

No company today will let you run your own code on their server if the only thing that's sandboxing it are containers. On the other hand, every VPS provider happily lets you do whatever you want inside their VM/hypervisor. This should tell you all you need to know about the security guarantees of Linux containers compared to hypervisors.

Not american and have no idea what the situation there is like, but from election county maps it seems that the divide is much more fine-grained than you make it sound (nowhere near the sort of thing you see in Germany for example).

Slow compile times really mess with your brain. When I wanted to test two different solutions, I would keep multiple separate clones (each one takes about 80GB, mind you) and do the manual equivalent of branch prediction by compiling both, just in case I needed the other one as well.

It's a good optimization, but be careful with it since it's not 100% compatible with the normal behavior. A master connection (the first one you establish) will not be able to close until all other connections have done so. Not all software can handle this correctly.

As fallback, you can also just emit the character and see how far the cursor advanced via CSI 6n (try printf '\x1b[6n')

You're right. I review each one carefully, so here I mean only the real ones. It's still a massive amount of vulnerabilities, even after excluding obscure drivers or features that aren't used on headless systems.

It's a shame because the datagram paradigm is so much more elegant. In real world cases you end up having to emulate it by putting length prefixed data in TCP streams, reducing TCP timeouts, constantly reconnecting sockets (with the latency penalty), etc.

Really, the only thing that's missing from UDP is (optional) backpressure.

A lot of software can handle out-of-order datagrams with no performance penalty (like file uploads, etc.). This is especially annoying when you're operating in an environment with link aggregation where the interface insists on limiting your bandwidth to a single link.

Local privesc, don't care. If anyone still thinks that they can draw a security boundary anywhere with a shared kernel, they should really look at kernel CVE database (and be horrified). For every fancy titled exploit there are twenty that you've never heard of.

You can sort of do it if you carefully structure your program to restrict syscall use and then use some minimal and well audited syscall filtering layer to hide most of the kernel. But you really have to know what you're doing and proper security hardening will break a lot of software. To get a basic level of security, you have to disable anything with the letters "BPF", hide all virtual filesystems like /proc, /sys, disable io_uring and remove every CONFIG_* you see until something stops working. Some subsystems seem more vulnerable than others (ironically netfilter seems to be a steady source of vulnerabilities).

You don't have to write Make invocations by hand... It's just a tool that can be called from any editor or IDE (or by automatic file watchers). Environment variables aren't really relevant to Make either, unless you really want to misuse it as a command runner.

Agreed, they are great for messing around. I didn't want to bother with a proper patch panel so I just attached a bunch of them to my minilab and it's the best thing ever.

Not really relevant here, but this is actually exactly how it's done in embedded systems like Yocto, everything from gcc, make, etc. is built from source (I believe the host compiler is used in a 3-stage bootstrapping process for gcc).

And in these cases you really see the impact of internal dependencies (building rust/llvm takes around 30-40% of the entire build). The upside is that you can patch and debug absolutely any part of the system.

Do people not have different symbols for spaces/tabs in IDEs? I see people committing mixed or trailing whitespace but every editor I've used shows spaces and tabs clearly.

Agree about yaml though. I still have to look up how to align a multiline string every single time.

Socket based proxying is better for this, since you eliminate one point from your attack surface (if your proxy server gets compromised, it's just encrypted ssh/TLS)

One thing I would really like to see is the mathematical and/or notation with the tall single curly bracket (with nesting, when appropriate).

I've seen a bulleted list being used for both conjunctions and disjunctions within the same document and in both cases it was not obvious from context (it was related to conditions for receiving funding)

They're not really a moving target (since some distros ship ancient kernels, most components will handle lack of new syscalls gracefully), but the surface is still pretty big. A single ioctl() or write() syscall could do a billion different things and a lot of software depends on small bits of this functionality, meaning you gotta implement 99% of it to get everything working.

You can, in fact that's how Arch wiki suggests doing it: https://wiki.archlinux.org/title/DNS-over-HTTPS

Interesting, I've had the exact opposite experience. My oldest HDD from 2007 is still going strong. Haven't had even a single micro SD card fail in a RPI. I built some fancy backup infrastructure for myself based on a sharded hash addressed database but so far have only used the backups to recover from "Layer 8" issues :)

I had a look at my notes and so far the only unexpected downtime has been due to 1x CMOS battery running out after true power off, 1x VPS provider randomly powering off my reverse proxy, 2x me screwing around with link bonding (connections always started to fail a few hours later, in middle of night).

To be honest I never understood the purpose of RAID for personal use cases. RAID is not a backup, so you need frequent, incremental backups anyway. It only makes sense for things where you need that 99.99% uptime. OK, maybe if you're hosting a service that many people depend on then I could see it (although I suspect downtime would still be dominated by other causes) but then I go over to r/DataHoarder and I see people using RAID for their media vaults which just blows my mind.

Optimizing compiler technology was still in the stone age (arguably still is) when Itanium was released. LLVM had just been born and GCC didn't start using SSA until 2005. Egraphs were unheard of in context of compiler optimization.

That said, yesterday I saw gcc generate 5 KB of mov instructions because it couldn't gracefully handle a particular vector size so I wouldn't get my hopes up...

What? Diffs and patches are orthogonal to what tools you use to view or merge them. The format defined by TFA is not necessarily meant for human consumption either.

I think I would disagree on this one. While it would make some operations neater, I steer clear of any and all external file metadata for the simple reason that it is not portable (and never will be, because that would mean giving up the stream/pipe abstraction).

It also breaks a bunch of optimizations that browsers have implemented over the years. Compare how back/forward history buttons work on reddit vs server side rendered pages.

I use m4 with -P option and m4_changequote({{,}})

Personally I find it quite reasonable for code that you don't plan on changing any time soon.

Safety can mean many things. I'm fairly sure JVM will keep the C-level memory safety guarantee after an OOM, but you can still end up with Java objects in inconsistent states that will start throwing exceptions when you poke them.

The reason why these exceptions are so "unsafe" is that they can occur at any moment. Maybe you were in the middle of modifying some data structure which will enter an infinite loop the next time you touch it. It's a bit like signals in C where you have to be extremely careful about the APIs you use, except worse because exceptions unwind the stack. At least in C you can still safely call kernel syscalls regardless of userspace state.

You can do it via fallocate(2) FALLOC_FL_INSERT_RANGE and FALLOC_FL_COLLAPSE_RANGE but sadly these still have a lot of limitations and are not portable. Based on discussions I've read, it seems there is no real motivation for implementing support for it, since anyone who cares about the performance of doing this will use some DB format anyway.

In theory, files should be just unrolled linked lists (or trees) of bytes, but I guess a lot of internal code still assumes full, aligned blocks.

I think it would be enough to just have a widely supported hash://sha256... protocol with a hint of what host(s) is known to provide the object (falling back to something DHT based maybe). There is https://www.rfc-editor.org/rfc/rfc6920.html but I haven't seen any support for it.

Run iostat -c 1 and keep an eye on %steal column. IME these cheap VPS cannot be used for anything where response time is a factor. It's fine for static content if you put cloudflare CDN in front of it.