blorgle

Brave has built in adblocking and I think Firefox Focus does as well. No ads on YouTube.

Jeff Snider from Alhambra Partners routinely makes this distinction: https://alhambrapartners.com/2021/10/13/perfect-time-to-revi...

They have a great podcast: https://podcasts.apple.com/au/podcast/eurodollar-university/... and routinely appear on finance podcasts to explain this.

I used to work for a startup that quickly grew to become one of the biggest Lambda users in my country (according to AWS). The entire business was serverless, not just Lambda but backend DynamoDB, APIGW, Cloudfront, etc. There was maybe 2 EC2 instances in the whole company.

Having seen what that model of development can do from an operational/security/agility/scalability/efficiency perspective, I think the comments on HN about serverless saying "it's just CGI" or that they could do something similar without vendor lockin are honestly laughably ignorant. If you haven't messed with Zappa (https://github.com/Miserlou/Zappa) or Serverless Framework (https://www.serverless.com/) at least a little you are missing out.

Yeah, seems dumb "economist" thinking. The idea that "if someone gives up and walks away, everyone behind them benefits" is a absurd on two fronts.The stall owner clearly doesn't benefit from a lost sale. Mulled wine, mince pies and hot chocolate are not fungible. Maybe you are allergic to chocolate. Maybe mince pies make you gag.

Also, optimising for queue length only makes any sense in the described scenario if all stalls are owned by a single entity.

I'm not even going to touch the "only add something to your todo list if you are going to do it immediately" stupidity.

You shouldn't pass unescaped/untrusted input into a subshell but your suggestion doesn't solve for every case. It protects against ";" but not path traversal with "../../../../../foo/bar".

This issue with the backups happened to me as well. I managed to solve it by disabling iCloud Backup which deletes all the backups, then re-enabling it. I think essentially what happens is some stuff gets backed up, and even if you delete that stuff from your phone it's still retained in backups for some period of time.

network namespaces and any reverse proxy :)

It's not the inflation component which is killing real personal income (ex transfer receipts)...it's the bad modelling which is used to generate current estimates that are subject to revisions.

The revisions show the real picture, and it is not pretty.

See https://alhambrapartners.com/2021/07/30/inflation-estimates-...

When I had to do some pf work, googling around rendered this project which uses pf to provide network segmentation for jails and edge firewalling. Was quite useful learning reference:

https://github.com/sinner-/ansible-freebsdvps/blob/master/ro...

I grew up using Debian and later Ubuntu, longer than 10 years on those distros as a kid and into my career as a sysadmin/operations person. Ubuntu LTS was my main workhorse form about 10.04 through to ~14.04.3.

Late 2015 I decided I wanted a "Chromebook" style user experience where I could have a repeatable build of the base OS that could be thrown away plus a backup system based around duplicity to restore my homedir. I had used preseed to deploy large fleets of Ubuntu boxes at work so it was a natural option. But I decided a few things: Firstly, I was sick of LTS 3.x kernel. Secondly, if 16.04 and all other distros were adopting systemd I may as well go to the source and use a RH based distro. Finally, that preseed wasn't as good as Kickstart used in RH based distros.

So I came up with https://github.com/sinner-/kickstart-fedora-workstation to provide repeatable builds of Fedora the way that I like it. I've been happily using it since then (across 2 versions of Fedora and a hard drive failure)! The .ks file will be updated for F26 this weekend as it just went GA today.

This looks SO cool! Kind of like Erlang but at a different level, so you can model both inter-node systems (like Erlang) but also intra-node systems (like USB3 drivers)!

As someone who has been thinking a lot recently about SPARK/Ada and "free" formal verification, can anyone tell me how this language compares on that front? If I write a P program, do I get the ability to "prove" its correctness?

Spotify should consider implementing Consul :P

Even though there were two patches submitted in 2013 and 2014 to switch to ChaCha:

https://lists.freebsd.org/pipermail/freebsd-bugs/2013-Octobe...

https://lists.freebsd.org/pipermail/freebsd-hackers/2014-May...

:(

I was a team lead for an IBM operations team for 6 months in 2016. Aside from my first two days, I worked from home the entire duration of the role, based in Sydney. Most of my staff were in China, with handoff to the next shift in Europe (who were all remote staff as well).

I am a big fan of grsec, RBAC and sandboxing stuff. But let's be real here people! Those are good features on servers where there isn't a giant security black-hole called X, where any local exploit of the app can turn it into a compromise of the entire GUI system.

Look at the hoops that adversary resistance focused distros like SubgraphOS have to jump through just to mitigate the giant attack surface that X opens.

Until Wayland becomes the usable default standard, "Linux Desktop Security" is an anachronism.

> I don't think, or get the impression, that this would be used for full-system virtualization. It seems to be more targeted toward an AWS Lambda sort of usage pattern; a micro-VM that spins up to serve one API request, or to act as a long-running tiny daemon to do some housekeeping task. It looks like a fancy fork(), to me, rather than a competitor to Docker or LXC (and especially not KVM or Xen, which can run a whole Linux kernel in the VM).

Almost. With ZeroCloud (OpenStack Swift + ZeroVM + appropriate middleware), you should imagine Lambda+S3 in the same service! Your "function" executes much, much closer to the location of the data, it doesn't require "shipping" from the storage service to the compute service and back again. You can take in an object, perform a transform (e.g. text search, encryption, transcode, etc) and store the result as a new object.

If you think about it, it's kind of the future of large scale computing, immutable dataset + immutable compute, that can horizontally scale to huge numbers of nodes.

I have been following ZeroVM since it's inception and often go to the website and stare longingly at my screen thinking of amazing things it could do (when coupled with OpenStack Swift to make "ZeroCloud"). If you look at my HN comment history you can see multiple articles about "serverless" where I tried to tell people about ZeroVM.

But they got bought by Rackspace (who originally open sourced Swift) in late 2013, and then their github account activity dropped to 0 by early 2015. Rackspace has probably one of the worlds largest Swift deployments, so maybe one day they will do some cool things with ZeroVM ala ZeroCloud but for now the forward movement of the project seems dead or at least proprietary :(

Other interesting implementations of the same concept include Joyents Manta, which is also open source and actually probably more flexible than ZeroCloud (you can SSH into your container).

It doesn't matter whether you use WhatsApp, Facebook Messenger "Secret Conversations" or even Signal app (or PGP or any public key based communications system)!.

If you are not verifying key fingerprints out of band, then you are potentially vulnerable to a malicious server MITMing new sessions.

If you want secure end-to-end messaging, verify keys out of band, do not solely trust a 3rd party for key exchange!

Confirm, it's just a DNS block like previous attempts by the AU Gov to block stuff.

If you're on a Apple device you probably need to use VPN to specify an alternate DNS and either route your traffic through that VPN as well or just use it for DNS.

> First off, the replication thing. It is true that ES, C*, and Mongo replicate within their cluster mostly automatically. However, this is not without cost. It takes non-trivial amounts of network capacity, disk I/O, and CPU cycles to migrate shards from a failed (or downed) node to a newly stood-up node. Often, many GBs must be moved and for something like ES, where shard replicas reside on many different nodes, that means much of your cluster feels the impact of this. The cluster can heal, but healing isn't easy.

I'm talking about replication, not sharding though. If the data is actually lost then you have to bear the penalty of re-replicating it to match your replica count regardless, there's no magic wand here to do with "persistent storage". If the data isn't actually lost (e.g. due to CoreOS automagic reboots) then you absolutely should be putting the cluster into maintenance mode until the reboots are complete.

> As for Cinder, it's reliant on OpenStack APIs which (at least as of Juno) are reliant on things like RabbitMQ. We've seen a number of OpenStack failures due to RabbitMQ partitioning and split-brained scenarios.

Still pretty confused when you mention OpenStack. Cinder doesn't rely on OpenStack APIs per se, it provides an OpenStack API (for block storage). RabbitMQ clustering has longstanding issues with partitions which are mentioned explicitly in the documentation, nothing to do with OpenStack, everything to do with Erlang MNESIA DB. Any decent OpenStack team has learned by now to use singleton RabbitMQs with a master/slave configuration loadbalancer (i.e. haproxy) in front.

> We're also back to the disk-on-network problem again: SCSI backplane ---ethernet---> client will never be as fast as local disk.

Right. But wasn't the comment about persistent storage? You're never going to have persistent storage in your k8s cluster that magically avoids that problem, so not really sure what the point is here.

This doesn't really make much sense to me.

If your systems support software level replication (Elasticsearch, Cassandra, MySQL, MongoDB all do) then why do you need persistent storage? You just need container scheduling anti-affinity and enough replicas.

You only need persistent storage for systems which don't support that replication. Ceph can certainly be deployed as performant for DB workloads.

You say "Cinder has the stench of OpenStack" but Cinder is just a Python based webapp which povides an API to arbitrary storage backends (Ceph RBD, iSCSI, NetApp ONTAP, whatever). How can it be "better now"? It doesn't provide storage on its own. If your ops team was using the default "proof of concept" LVM backend then I could see how you might get a bad impression but that just means your ops team doesn't know much about OpenStack.

Am I missing something obvious?

This is some serious FUD, pretty standard for Newsweeks bitcoin reporting, which included harassment of Dorian Nakomoto.

This is probably an unpopular opinion on HN, but let's face it, P2P protocols like bitcoin are relatively easy to disrupt for nation state actors, especially the US!

For a relatively small cost, the blockchain could be flooded with bogus junk to DoS. The bootstrap mechanism could easily be MITMd to netsplit new nodes. Those are just technological mechanisms off the top of my head, which assume a perfect hypothetical cryptocurrency with none of the teething problems that all of the actual cryptocurrencies have.

ISIS could come up with "Terrorcoin" (which is the underlying vague threat of the article) but without any mechanism to transfer those coins to a fungible real world currency, it's useless anyway.

Go home Newsweek, you're drunk.

Coming from OpenStack land where Ceph is used heavily, it's well known that you shouldn't run production Ceph on VMs and that CephFS (which is like an NFS endpoint for Ceph itself) has never been as robust as the underlying Rados Block Device stuff.

They probably could have saved themselves a lot of pain by talking to some Ceph experts still working inside RedHat for architectural and other design decisions.

I agree with other poster who asked why do they even need a gigantic distributed fs and how that seems like a design miss.

If you're going to build serverless thing to take advantage of market hype why not at least try and build one that has data locality like ZeroVM/ZeroCloud (http://www.zerovm.org/zerocloud.html) and Manta (https://www.joyent.com/manta)?

Sounds like zerovm? http://www.zerovm.org/

OpenSSH in normal configurations will respond to all requests with an open socket regardless of whether that request is signed or not. Worst case scenario like OpenSSH Unprivileged Remote Code Execution, or Heartbleed style attack.

OpenSSH behind VPN technology like IPsec or OpenVPN (with TLS auth) means that only authorised (in possession of valid signing key) clients see the open socket.

OpenSSH does have "SSH certificates", but using VPN technology allows you to secure multiple internal services including those that don't support any encryption natively.

I personally don't think iptables or switching ports is a viable solution and always use the following policy:

All the internal services should never be exposed to the internet and only accept connections from signed packets using IPsec or OpenVPN with TLS auth.

Yes, this means more key management.

My 2c is that this seems like an interesting project, but at some point lots of important Ubuntu packages (especially daemons) will be rolling out with systemd unit files and so on, it will be a lot of work to maintain BSD init scripts. It doesn't seem like it will be so simple as running Ubuntu userland on the FreeBSD kernel.

I have been an avid reader since a young age and around the time I turned 15 I discovered and quickly became scornful of self help books.

However, one self help book which I recently discovered and completely changed my life is "Rewire your brain" (ISBN: 0470487291) which offers explanations of many things from a neuroscience perspective and includes some practical anecdotes etc.

I would recommend it to essentially anyone, and all I could think while reading it was "why is this book not mandatory reading for all humans?".

FWIW.

Quite interesting, thanks for your findings.

FWIW, in the same vein as CloudFormation but for OpenStack, there is OpenStack HEAT which is, IMHO, quite good.

Pure speculation but perhaps the issue at hand is that Terraform is trying to act as a generic infrastructure provisioning tool across many IaaS offerings.