brian_cunnie

It was my service that the agent used: nip.io / sslip.io

OpenAI emailed me to let me know that their agent used my service to break out of test containment. OpenAI was quite polite (shout-out to Steven), and let me know they'd keep the name of my service out of the blog post.

nip.io is a simple DNS service: when queried with a hostname with an embedded IP address, returns that IP address, e.g. 127-0-0-1.nip.io → 127.0.0.1

The nip.io service is airtight with one exception: the "_acme-challenge" subdomain. In that case, rather than returning the IP address (or whatever record was queried), nip.io would return an empty "answer" section but an NS authority & not authoritative. In other words, nip.io would delegate DNS queries to that IP address.

That was the escape hatch.

In a couple of weeks I'll close that escape hatch. It was originally intended as a mechanism to allow savvy uses to procure wildcard certs (e.g. "*.64-176-22-9.nip.io") from certificate authorities such as Let's Encrypt. But experience proved that the it was an undue burden trying to support unsophisticated users attempting to procure a wildcard cert. "Wildcard certs are not supported" became my new mantra.

But I had neglected to remove the old code.

(the late Roopinder Singh created nip.io, and he was a good guy. I miss him)

> For me it's that writing code is really enjoyable, and delegating it ...

This.

On my fun side project, I don't accept pull requests because writing the code is the fun part.

Only once did someone get mad at me for not accepting their pull request.

My work has IPv6, and my home has IPv6.

If I need to connect to my home Fedora machine from work, a simple "ssh fed.nono.io" works just fine — I don't need to activate my Wireguard VPN; I don't need to worry about address space collisions.

Thumbs up on Concourse CI: I like seeing all my builds at once on any easy-to-read dashboard. That’s why we switched from GitHub actions: the dashboard.

> ascetic tech monks where we did this for the love of the work and not purely for status or money

And this is not limited to 2010s! My father worked as a software engineer in Poland in the 1960s, and the communist party had a problem: every profession had at least one member of the communist party except the programming profession. But the Polish programmers weren't interested in joining, not even with the perks of a bigger apartment or cars. Finally they got one programmer to join the communist party, but he wasn't interested in programming, and only became a programmer so he could join the communist party & get the perks.

> not a single person has ever said to me "I'm doing this for the love of it".

I'm doing this for the love of it.

Maybe "love" is too strong a word, but I certainly "like" what I'm doing, and I "like" computers, and I have a computer side project that I "like" doing and don't get paid for. Heck, when I was a summer student at IBM I couldn't believe they were paying me for something that was so fun!

Measuring oneself as an engineer by the title of the salary band you're in is a disservice.

I remember at Bell Labs they had one title: MTS (Member of Technical Staff). You were an engineer, and that was that. (disclaimer: there were a handful of DMTSes (Distinguished Member of Technical Staff)).

No one said, "I'm an E7" or "I'm a Staff Engineer II". Those statements strike me as distasteful. And begs the question if we're being suckered by Human Resource's gamification of work.

I worked at a company, Pivotal Labs, where everyone's title was "Pivot". It made for an egalitarian workplace. That changed after the acquisition, and we got titles. My proudest moment? Not when I was promoted from Senior Engineer to Staff Engineer, but rather the after-hours work I did with Dimtriy to expand our offering to include IPv6.

At my current startup, there are no titles, and I'm grateful for that.

Sometimes I log into the root account to see the billing information.

I created an "administrator" account, but apparently it can't see the billing information, including the very-important amount of remaining cloud credits.

Maybe I could spend time fiddling with IAM to get the right privileges, but I have more pressing tasks. And besides, on my personal AWS account I only log in with the root account.

> [IPv6] only exists in datacenters

My experience is different: Comcast has been doling out IPv6 addresses for at least a decade, at least in San Francisco.

My T-Mobile phone gets IPv6 addresses.

My work and my swim club also have IPv6. It's pretty awesome.

A year ago I changed my CONTRIBUTING document to say that I don't accept pull-requests on my very modest open source project (a special purpose DNS server)

I like coding, but am not fond of reviewing other people's code.

Also, the few PRs I received weren't up to snuff: for example, they included code changes but not tests. If they included tests, they weren't comprehensive. And they never included documentation changes.

I typically get a takedown notice a couple times a week, usually from my registrar (Namecheap) or from Netcraft, about 100 so far.

I keep a public (transparent) list of takedowns, on a public repo on GitHub. The commit messages are the logs. [0]

I have a way to dispute: raise a GitHub issue. I've only had two people dispute: one was legit, and I unblocked him, and the other ran a WordPress site which he didn't know was compromised. I did not unblock him. [1]

Please don't judge me harshly for honoring the takedowns immediately, but I do so because the remedy is simple: register your own domain, and don't rely on my nip.io / sslip.io service (which maps IP addresses to hostnames as a convenience for developers, e.g. 127.0.0.1.nip.io → 127.0.0.1).

Dealing with takedown requests is the least pleasant aspect of running FOSS project. I want to spend my free time coding, not blocking phishers, scammers, and grifters.

[0] https://github.com/cunnie/sslip.io-blocklist [1] https://github.com/cunnie/sslip.io/issues/100

> I have personally been bitten once (about 10 years ago) by btrfs just failing horribly on a single desktop drive.

Me, too. The drive was unrecoverable. I had to reinstall from scratch.

Agreed. It takes more than a few developers to support older operating systems.

At my old job we supported only two versions of our software product, Tanzu Operations Manager versions 2.10.x and 3.0.y), and we cut new patch releases every few weeks (similar to Apple's cadence). Bumping dependencies was a pain. Well, usually it went fine, but sometimes you'd hit a gnarly incompatibility and you'd either pin a Ruby package to a known version or try to modify the code just enough to make it work without making a major change.

If I had to put a number to it, I'd say it cost us 2 developers to keep our older product line consistently patched, and our product was a modest Ruby app, much less complicated than an entire OS.

> you can make a one-time donation of $5 to a charity of your choice ...

The Alcoholics Anonymous San Francisco website had to implement CAPTCHAs on their website because scammers were making one-time donations to make sure their stolen credit cards were still valid. Every morning we had to invalidate a dozen obviously-fake donations.

I don't think a modern firewall can MiTM HTTPS TLS without triggering a "Warning: Potential Security Risk Ahead" (Firefox) or "Your connection is not private" (Chrome).

Edit: typo

Good point! I've also played almost a year's worth of World of Warcraft — it happened organically!

Thought-provoking piece, but I think it ignores one key item: we naturally gravitate to doing what we love. We don't need to write them down. I never wrote down, "build a dual-stack homelab with a handcrafted firewall and a 10Gbe fiber backbone with multiple VLANs and subnets and two virtualization hosts and a 12TB TrueNAS server, and DNS and Minio and DHCP and k8s." Of the hundreds of hours I spent on my homelab, I don't think I ever wrote down a "quest" or "goal".

Similarly, I love swimming in the open cold water, but I never wrote down, "Swim from Alcatraz twice". It wasn't necessary. It happened organically.

Fedora 45?! Dang, I only upgraded to Fedora 40 but days ago.

> As though students from different generations didn't do exactly the same thing about the Gulf, Iraq, Afghanistan and Vietnam Wars.

I remember protesting at Penn in '85 ('86?) to persuade the trustees to divest from companies doing business in apartheid South Africa. And you know what? The trustees divested.

My brother's college roommate became an actor instead of a lawyer.

Now fifty-seven, he confided, "I think I made the wrong decision."

I consume about 67 mL of olive oil per day; I buy 6 liters of olive oil every 90 days. I'm type II diabetic, diet-controlled, which means I have to get my calories mostly from fats because I'm on a restricted carbohydrate diet.

> unix being a thrown out the car window by AT&T at speed

I beg to differ; when I was at AT&T in the late eighties we tried to enter the computer business, on the PC side with Olivetti, and on the UNIX side with the 3B2 minicomputers made with our own chips running System V UNIX. I even had a 3B2-200 in my house for a couple of years.

Entering a new business is hard: although the engineering was solid, we didn't have a saleforce trained in selling computers, and we didn't have a rich ecosystem (Oracle! Ingres! Informix!). AT&T didn't throw UNIX out the window, but found that capitalizing on UNIX was hard.

> rules as written/rules as followed

As a bicyclist in San Francisco, if I follow the rules as written, I cause traffic. Cars expect me to blow through four-way stop-sign intersections, and if I stop and wait for the cars, the drivers get confused & don't want to go (afraid of hitting me, I suspect).

In terms of right of way, the rules as followed seem to be pedestrian > bike > car.

> suggest a downward spiral involving substances first.

Anecdotally, as a person in San Francisco who's been in recovery 23 years, all the people I know who were once homeless became homeless because they were abusing drugs and alcohol. Sometimes mental illness was at play, too.

There's a strong selection bias in my sample set — they're all alcoholics/addicts (thankfully in recovery, thankfully housed).

I couldn't make changes to my USPS (United States Postal Service) account for years because it kept flagging my last name, "Cunnie", as an obscenity.

> Regarding migrating to new issue tracking systems, "not maintaining history" is absolutely a critical fail at that org

Sometimes it's not a critical fail; sometimes it's a permissions issue: only a small subset of developers have access to the original ticket.

The fix is simple: write good commit messages. Don't assume the person reading the commit message has access to the ticket.

> doctors are prescribing it left and right while there is money to be made

I think that's painting with a broad brush the motivations of doctors. Case in point: when diagnosed with diabetes, my doctor suggested attempting a modified diet before she'd prescribe medications (such as ozempic). She got no money from a modified diet.

Furthermore, I don't think she would've gotten any money had she prescribed medication; in the US, there's a "Medicaid/Medicare anti-kickback statute" [0]

I suspect that those motivated by money would be more inclined to pursue a lucrative career in finance rather than the long, arduous, and expensive path of becoming a doctor.

[0] https://journalofethics.ama-assn.org/article/it-legal-physic...

I must admit I'm at a loss about this IPv6 hate. I love IPv6.

I love that (almost) every IPv6 subnet is a /64. Just this morning I assumed an IPv4 subnet was a /24, only to discover it was a /20, causing me to spend a couple of minutes re-working.

I love that (almost) every IPv6 is a /64 because you'll never have to widen a subnet because you started of with a /24, but then after your office grew to 200 people you had to switch to a /20. And no matter how automated you are, there are always some important devices that have static IPs and that you have to reconfigure manually.

I love that every IPv6 client gets a routable IP. This means NAT isn't necessary. NAT is a clever hack, but we've grown so accustomed to it that we've become blind to its failings. I've had to trace packets coming out of a corporate NAT, then into an AWS ELB (Elastic Load Balancer) back into a different NAT. With the IP address remappings, it's awful

IPv4 NAT can also lead to IP address collisions. Your home subnet is 192.168.0.0/24? And so's your work? Good luck VPN'ing in.

I like that IPv6 has an abundance of IPv6 addresses—I don't need to share the ports on my sole IPv4 address to 5 different machines.

> there were like 5 updates of OPNsense in the last year where different IPv6 issues were fixed (and others have been introduced)

That's a bummer. I've been using FreeBSD + pf at home for years now, and it's been smooth sailing.

> my ISP only hands out /64-Prefixes, and these are also dynamic, which makes configuration more difficult

Comcast/Xfinity hands out a /60, which means I get 16 x /64 subnets. And they haven't changed my subnets in at least four years. Pro-tip: when you change firewall hardware, keep the same MAC addr to keep the same IPv4, keep the same DHCP Unique Identifier (DUID) (/var/db/dhcp6c_duid on FreeBSD) to keep the same IPv6 subnets.

I like the article, but I wish there had been an "Abstract" or "Executive Summary" at the top so that I'd be spared having to read the entire article to find out the results. I'd like to have seen something along the lines of the following:

"We found Hetzner's ARM64 offering, specifically the CAX21 with 4 cores, 8GB at $8.40/month, to be a performant and cost-effective alternative to x86_64-based solutions."