cremp

> resources don't use SSL

Huh? DNS is hit even if the site is SSL. Unless the site has HSTS, and you've got to the site before; DNS poisoning is very much doable.

How is that the company's fault?

Wendy's would probably hire anyone. Just saying that even flipping burgers is better than ranting on the internet wrt feeding your family.

I've done it; and my primary argument to family and friends is time attack vectors.

The real reason though, is because I can, and I like saying my computers are more accurate and precise than their phones.

> Configuring Wi-Fi

That alone will negate any benefit of running a stratum 1. You lose the precision and accuracy over wifi. Jitter on intranet with the pi as a timesource would be magnitudes greater than the GPS link.

This goes to show that HP itself doesn't know what they're doing.

On over-provisioning resources:

Your CPU load won't be 100% on all VMs all the time; if it is, you need to scale out anyway. Unused CPU is wasted CPU. With memory, KSM reduces burden anyway; and again. Unused RAM is wasted RAM.

SSD vs Spinny:

> the host’s fast SSD was pretty much useless, as it had to wait for the 10-times slower HDDs

Huh? Host SSD is meant for the host, not guests, so why is there any 'wait'?

Hold on...

> My examples primarily use Windows

Well... There's your problem...

> Their technology is stuck in 2009

If it ain't broke, why fix it?

Do you really need tens of files for a hello world? No. No you do not.

Best practice:

Just don't install Nodejs. Just don't.

> Wrap common utilities as npm packages

That's how you get things like isEven, isOdd... Leftpad anyone?

Obligatory Google: https://www.google.com/teapot

Abbyy FineReader is far and away the best we've ever used. Nothing comes close in the space.

Tesseract requires piles and piles of training, which you may or may not have.

I used to love YNAB, until they went to the web-based, and threw away their fat client.

This only proves that they have had your financial data since they moved to the web client, and probably sell that juicy data.

I'd be more wondering how many were/are used for phishing campaigns.

If I'm reading it correctly, they can date wines based on the amount of radiation given off by them, and line it up with a chart for amount of radiation the atmosphere took in during events.

How could you properly date a bottle if it was in Fukushima during the event, vs a 1960's bottle during the Cuban Missile Crisis?

> the levels of cesium-137 are barely detectable, and even then, only if the wine is destroyed.

So nothing to see here, move along.

> I came to the conclusion that the best way to address this was zip ties

I'd be wary of that, since someone of enough stature, could squish the gel down enough and feel the plastic ends, which wouldn't be too comfortable.

> current trend in web development

Why on earth are you using whats popular instead of the correct tool for the job?

To be clear, you absolutely can abandon node, and should.

Said it before, and I'll say it again.

Why the flagnar do hardcore believers/users of Node insist that everything is perfect with their package management; let alone any of the bad programming practices that Node idolizes?

This is what... the 4th major incident in the last 6 months with Node and npm.

Anyone who tells me they use Node will instantly get put on their own sandbox and vlan. You just can't trust that the code they run is legit, even if they wrote it.

Thanks for being forthcoming; and I do appreciate the post. I'm partially venting, and I've been using AWS for a while. Vendor lock-in can be a pain in the rear sometimes.

A lot of the gripe I've got with these posts is that they seem somewhat incomplete. Hard to say things if you've only been messing with it for a week, and don't have a lot of the ins-and-outs of the services. That being said, I've spent at least 2 years diving into lambda and weird issues with it.

I'm not an employee of Amazon, and so my understanding can be off-base as well.

Lambdas are just managed EC2 instances. Each lambda code is stored in an AWS controlled S3 bucket; and on initial execution (cold start) pulled down, and run in their own chroot jail. I've dealt with java lambdas the most, and I can say that they take your zip, and run the jail inside the zip. They keep your java process open, and just call the handler on each call (warm start.) Each concurrent call can start another jail on another managed instance; getting the cold start time again.

You can get cold starts by uploading a new zip, or changing any of the lambda compute parameters.

The Golang works in a similar way, jails the zip, and keeps the program running, calling the handler as invokes come in.

I haven't done the python, node, or .NET enough to know if those are the same principles; I'd assume they are.

Interestingly, API Gateway really is just Cloudfront. Cloudfront is just the AWS managed API Gateway.

They do. After the cold start, things are just run in memory.

Java for example will keep your static variables and such in memory, and keep /tmp until you haven't called the lambda for a while.

With GoLang, they call start your program, and just call the handler method as required.

Each and every one of these posts from Cloudflare is direct targeting and completely biased. Should be noted that their response times are indicative of them being far fewer hops away. Unless they can run in the same DC, or even make the RTT fair, their 'Webpage response' metric is utterly useless.

Notice how they admit that they don't know how lambda really works. They switch between lambda@edge and Region-based lambdas, and don't seem to be able to be consistent with it.

Java Lambdas have horrible cold start times, and I'm not seeing any of this reflected anywhere in their report.

> Our Lambda is deployed to with the default 128MB of memory behind an API Gateway in us-east-1

Well duh the lambda is slower; it's going through API Gateway, and that does authentication processing as well.

All in all, these blog posts from Cloudflare are turning me off from them entirely, because they aren't even saying 'yeah, AWS got us beat in this case here.'

Because debt collectors have literal exceptions to harassment laws.

Hold on, lets just buy the competition so we can rack in more enterprise clients. :/

With my experiences with RedHat, The only thing I've gleamed from it is that they are a mess with packages, and are their own 'standard.'

None.

SS7 itself is bad, and proven time and time again that it can be used maliciously.

> just type npm i -g npm@latest

Isn't that the same command what caused a lot of headache a few months ago with changing directory permissions? With the response being, don't run latest unless you want to break things.

So Cloudflare workers are faster than AWS lambdas with a lot of home court advantage. Not like they will actually say anything is faster than their product.

Lots of self-promotion; yet doesn't even touch the fact that AWS lambdas (both @Edge and in region) have cold-start times (among other things.)

Considering they won't give you any real data they have on you via the 'download your data' function they've had for a while; I highly doubt it.

Seems more like a PR move than anything to me.

I do the same thing.

My SO's response is generally along the lines of 'I'm fine with it, because it isn't in the hands of anyone I know. If you go out and buy that information, that's creepy and scary because you know me.'

I've started coming to terms with the fact that I won't be able to convince her of anything with privacy; because she isn't a technical person, and just like users; they won't care how/why/what cost so long as they can do what they want.

P3P; which Microsoft still puts into IE, and they were the only ones to use the 'standard.'

Just like many 'standards,' each company has their own, and follow it, though nobody outside of them do.

Funny because the whole 'we don't spy on US people.'

And now the 'whoops, we actually did, and are deleting them now, so nobody can cry foul.'

They got their use out of them, and to make sure and current(?)/future lawsuits won't have data; just delete it.

Or treating it like any other database; and just using it because its 'popular.' Those 'developers' who do that (use popular just because,) are just the people who stain the title.

I don't think it is about compliance or security at all; just developers that aren't competent.

> 2.6 million plaintext passwords

Anyone who is actually competent knows hashing at a minimum; and it costs nothing to implement, both time and money wise.

All of this, because Johnny over here read a tutorial on how to make your own app.

The downside of development is that, you do get these people who 'stain' the title, because they just read it and followed blindly instead of actually learning.

Or a payment for the pretty whitepaper you get to read.