HNHacker News
TopNewBestAskShowJobs

bdd

708 karma · joined May 18, 2010

days: cryptography at meta. evenings & weekends: computers, electronics, radios (NG6E)

https://bdd.fi

submissionscomments
bdd··on Unlocking high-performance PostgreSQL with key memory optimizations
Works on this Postgres 17.7:

postgres=# show server_version; server_version ------------------------------- 17.7 (Debian 17.7-3.pgdg13+1) (1 row)

postgres=# SELECT sum(blks_hit)/nullif(sum(blks_hit+blks_read),0) AS cache_hit_ratio FROM Pg_stat_database; cache_hit_ratio ------------------------ 0.99448341937558994728 (1 row)

bdd··on IPv6 adoption just shy of 50%; 49.76% on 26th July
IPv6 adoption visualizations from others:

- Meta: https://www.facebook.com/ipv6/

- Akamai: https://www.akamai.com/security-research/ipv6-adoption-visua...

- Cloudflare: https://radar.cloudflare.com/adoption-and-usage

bdd··on What does "supports DRM and may not be fully accessible" mean for SATA SDDs?
> Indeed where the DRM error message comes from https://github.com/torvalds/linux/blob/ffd294d346d185b70e28b...

That's for compact flash cards. Based on the kernel message from the StackExchange post we can tell it isn't a CF. So it's not coming from the line you linked, but 11 lines below.

bdd··on What does "supports DRM and may not be fully accessible" mean for SATA SDDs?
I don't think in this very case it has anything to do with digital rights management. It detects an Intel SATA SSD, SSDSCKJF360A5L a disk that supports ATA Trusted Send/Receive commands used to interface with on-disk encryption features. Specifically 5B to 5F (reference: https://wiki.osdev.org/ATA_Command_Matrix).

To make things even more confusing, kernel refers to the command between 5C and 5F with the acronym TPM, and requires `libata.allow_tpm=1` command line parameter to be passed to allow issuing them. (kernel source reference: https://github.com/torvalds/linux/blob/v6.12/drivers/ata/lib...), which has _nothing to do_ with the trusted platform module TPM, just another TLA clash.

Here's the original commit from 2008. The naming is very likely through misassociation. TCG: Trusted Computing Group is most known for creating TPM specification. Another thing they work on is the OPAL specification for self encrypting drives. Author possibly clumped them into the same thing. https://github.com/torvalds/linux/commit/ae8d4ee7ff429136c8b...

bdd··on Nix – Death by a Thousand Cuts
I believe https://github.com/nixos/nixpkgs/pull/372196 fixes this if you are using systemd-networkd. It was merged to master last week and made it to unstable branches (https://nixpk.gs/pr-tracker.html?pr=372196).
bdd··on Meta built large-scale cryptographic monitoring
If you want to read more about cryptographic key wear out, Soatok wrote an excellent explainer on this a few years ago https://soatok.blog/2020/12/24/cryptographic-wear-out-for-sy...
bdd··on Magic Wormhole: get things from one computer to another, safely
> if you want a non-Python runtime for some reason [...]

Magic Wormhole project has its own alternate implementation https://github.com/magic-wormhole/magic-wormhole.rs, which is also used by delightfully designed GNOME and Android apps; [Warp](https://apps.gnome.org/Warp/), and [Wormhole](https://play.google.com/store/apps/details?id=eu.heili.wormh...), respectively.

bdd··on Defcon: Preventing overload with graceful feature degradation (2023)
Yes. And that was 4 years ago. Must add that figure does NOT include static asset serving path.
bdd··on I2c-USB-hub: An i2C Controllable USB 2.0 Hub
> I'm not sure if KVM switching can be controlled over DDC but it's likely.

They do. Here's my shell function that helps me switch between DisplayPort-1 + USB uplink cable to the host AND USB-C cable with DisplayPort Alt Mode+Charging+uplink to display's USB hub.

  # x0f: DisplayPort-1
  # x1b: USB-C
  DDC_SOURCES=("x0f" "x1b")

  switchkvm() {
    local vcp_input_src="x60"
    local current next src
    current=$(ddcutil -t getvcp ${vcp_input_src} | awk '{ print $4 }')
    for src in "${DDC_SOURCES[@]}"; do
      if [[ ${src} != "${current}" ]]; then
        next=${src}
      fi
    done
  
    if [[ -z ${next} ]]; then
      echo "No eligible alternate input in \$DDC_SOURCES" >&2
      echo "\$DDC_SOURCES=(${DDC_SOURCES[*]}); current=${current}"
      return 1
    fi

    ddcutil setvcp "${vcp_input_src}" "${next}"
  }
bdd··on Retrieving 1TB of data from a faulty drive with the help of woodworking tools
Dunno. This works for me without damaging the parts, pads, or traces. Your link is for PCBA reflow ovens. Talks about minutes long of exposure. I'm using a Atten ST-862D hot air station with questionable temperature and airflow accuracy. For an M.2 drive I'll probably soak 225 for 15 seconds 3 times the size of the chip areas in circles. Hit my memory-1 button to go to 400 and focus on the chip for 3 seconds. Hit memory-2 to go down to 300 and one up arrow for 325 for 5 more seconds while watching nearby caps' solder pads and ensuring they don't fly away. ¯\_(ツ)_/¯
bdd··on Retrieving 1TB of data from a faulty drive with the help of woodworking tools
Reflowing the controller worked for me twice for now. Once with an Intel Optane drive that worked without issues for 3 years and started overheating one day. And another one from a fanless machine that used an mSATA drive that chose to die on a Sunday, with no spare mSATA disk lying around. In both cases I went for short hunting under a microscope, looking for that one guilty shorted cap, yet finding none. It was the controllers with "tired" BGA solder balls, which could use some tender loving care of 225°C (soak) -> 400°C (peak) -> 325°C (hold) reflow.
bdd··on The Messaging Layer Security (MLS) Protocol
Katriel Cohn-Gordon is also a Meta employee.
bdd··on Threads, an Instagram app
Seems like only available in certain locations.

You can play with the `gl` query parameter in the URL. Yours is for Italy ("it"). It's available in other continental Europe locations like: de, fr, be, es, pt, at, cz, pl. While not yet released for majority English speaking countries (us, ca, uk, au, nz) with the exception of Ireland (ie).

I don't have any insider information even though my employer is Meta. I learned about this release from HN.

bdd··on LoRa: Field Testing Antennas
Tangent: U.FL connectors. Gawd, they suck. I was pleasantly surprised to see U.FL removal tool in the write up. The female connectors have at best 10 mating cycles in my experience. By using the such removal tool you may get dunno 20 if you are super careful. I killed GSM and GPS antennas with single or second try detaching.

From wikipedia article of Hirose U.FL:

Female U.FL connectors are not designed with reconnection in mind, and they are only rated for a few reconnects (approximately 30 mating cycles[5]) before replacement is needed.

bdd··on Monitoring tiny web services
Metrics scope is the logical grouping of assets you are monitoring. Explained in detail here https://cloud.google.com/monitoring/settings along with a video.

Web console allows check intervals of 1, 5, 10, or 15 minutes.

bdd··on Monitoring tiny web services
Google's uptime monitoring also allows writing JSONPath checks, so one can monitor HTTP 200 JSON responses semantically.
bdd··on Monitoring tiny web services
You can get free uptime monitoring from Google Cloud. The limit is 100 uptime checks per monitoring scope, which may mean either a project or an organization based on how you configure IIUC. https://cloud.google.com/monitoring/uptime-checks. The checks are ran from 6 locations around the world, so you can also catch network issues, that you likely cannot do much about when you're running a tiny service. My uptime checks show the probes come from: usa-{virginia,oregon,iowa}, eur-belgium, apac-singapore, sa-brazil-sao_paulo

Another neat monitoring thing I rely on is https://healthchecks.io. Anything that needs to run periodically checks in with the API at the start and the end of execution so you can be sure they are running as they should, on time, and without errors. Its free tier allows 20 checks.

bdd··on Vintage Startup Employee Swag?
You can find old logo, obscure internal project or team name t-shirts of Google and Facebook with little to no effort if you can visit thrift stores in Bay Area or Seattle.

Every single time I stop by a Goodwill or Savers to drop off things, I go inside to check if I can find some vintage tech books. Every single time, in almost every store, on my way to the the bookshelves, I caught glimpses of t-shirts or fancier puff jackets clad with FB, Google, Twitter, Netflix, Dropbox logos.

bdd··on United States IPv6 adoption over 50%
FWIW as a content provider to mobile heavy eyeball networks, Facebook has been clocking US v6 adoption consistently over 50% since Sep 2018.

Traffic stats encompass all Facebook properties, FB, Instagram, WhatsApp (hence India topping adoption charts), Oculus, and all smaller things that used some kind service delivery tech of Facebook infrastructure (DNS, web—not limited to CDN, MQTT, etc)

https://www.facebook.com/ipv6/?tab=ipv6_country

bdd··on Summary of the AWS Service Event in the Northern Virginia (US-East-1) Region
no. it wasn't a "bad bgp update". bgp withdrawal of anycast addresses was a desired outcome of a region (serving location) getting disconnected from the backbone. if you'd like to trivialize it, you can say it was configuration change to the software defined backbone.
bdd··on We're seeing an ongoing attack against our primary network provider
Does Fastmail actually have multiple providers?

One of their mail exchangers, web site, SMTP, POP, and IMAP servers are all on the same /24, that belongs to NYI (AS11403) and according to the BGP table is not multihomed.

Historical DNS records from last two years also show they weren't changed.

I guess, "primary" is still a technically correct qualifier for the "sole" provider.

bdd··on Apache Mesos to be moved to Attic
These jobs had their allotted quotas, per team, giving them above >70% utilization in their logical slice of the cluster. E.g. video processing team gets 20,000 nodes globally. They stack (co-locate) their tasks (interpret: set of processes) however they want.

Granted Twitter operated one big shared Mesos+Aurora offering for everything*, the whole cluster high utilization wouldn't give much flexibility to absorb load, or do reasonable capacity planning (which was an entire org in itself) when you own and operate those machines and data centers. I can't comment much on the 20-30% figure given in MesosCon, it's been more than 5 years since I was last privy to these figures.

bdd··on Apache Mesos to be moved to Attic
Twitter. From generic caches to ad serving; from stream processing to video encoding, all high utilization applications of either one or multiple schedulable resources.
bdd··on Have I Been Facebooked?
If "Who can look you up using the phone number you provided?" setting wasn't set to "Everyone" in your privacy settings, then your phone number wouldn't be visible to the scraping campaign that was the source of this.
bdd··on IPv6 Adoption Visualization
Facebook has an IPv6 adoption dashboard as well. https://www.facebook.com/ipv6

We clock India at 66.06% and US at 59.37%

bdd··on Organizations Using the D Language
Facebook was using D for rather important components at the time of linked tech talk.

As of today, there's only one important looking thing left implemented in D.

So...

bdd··on Solarwind, Fireeye, Microsoft and Cisco leaks are offered for sale
Looks like they used Njalla (https://njal.la) a provider that seems to focus on "privacy aware" domains and virtual private servers hosted in Sweden.

According to their FAQ, when you register a domain name through them, they own the domain but they respect the agreement between them and the customer to let the customer have "full usage rights".

They seem to provide rather fun named name servers. Reads "you can get no info".

    dig +short ns solarleaks.net | sort
    1-you.njalla.no.
    2-can.njalla.in.
    3-get.njalla.fo.
They accept a bunch* of cryptocurrencies and then PayPal.

[*]: "Bitcoin, Litecoin, Monero, ZCash, DASH, Bitcoin Cash, Ethereum"

bdd··on AT&T Fiber in the SF Bay Area is flipping bits
Dane Jasper, CEO of Sonic, which resells AT&T's fiber service in some areas where they don't have their own fiber, responded to a tweet asking if he could help with pushing this to a remedy with AT&T:

> Yep, we are engaged. And they are clueless. Huge challenge to find someone who really has ability to troubleshoot."

https://twitter.com/dane/status/1336111107430207488

bdd··on Backblaze Hard Drive Stats Q3 2020
Ah. That'd actually be useful I think.
bdd··on Backblaze Hard Drive Stats Q3 2020
Publishing SSD reliability of datacenter setups would yield no useful information for everyday consumers. See my comment at https://news.ycombinator.com/item?id=24840914. Neither load nor the operating environment of such reports will be anything remotely similar to everyday consumers' use and environments.

In 2015 Facebook published* its study of flash memory failures at scale. By all means it's a terrific paper (of course I'm biased) but I think it was irrelevant not only for consumers but pretty much 99% of the flash users in the industry.

[*] http://users.ece.cmu.edu/~omutlu/pub/flash-memory-failures-i...

Page 1 of 3Next →