gbrown_

> My point is that if it were designed from the ground up with the hard security boundary in mind, would we have ended up with containers in the first place?

Yes. The only difference is the Linux based systems and tools as opposed to Zones or Jails were the first pivot to a developer focused view rather than that of the sysadmin. This utility is why containers gained critical mass, not because the security focused foundations of other implementations was an impediment.

I see the author is replying here so I just wanted to say I enjoyed following the Formality posts on your blog and updates on GitHub and hope there's time for more of that in the future. Wishing you all the best with this project!

As an aside it may be a convenient reference if you laid out the history of Formality/Kind as I think a large portion of your target audience already knew about Formality. The rename gets a little lost in IMHO, at first glance at least.

Camille Fournier has some excellent talks on rewrites I'd recommend anyone that came here looking for guidance check out https://www.youtube.com/watch?v=2TbwdxFxOtY

We have a bunch of HDX 3D Pro VDIs at my current place and I second this.

Whilst others have mentioned their application is architected to cope with this I wanted to echo the sentiment. This post feels very much like a “draw the rest of the owl” meme.

I know there are many ways the same thing can be done in the shell but there are so many problems here. Please take this as feedback and not harsh criticism (I know there's comment section on the blog but I'd rather not give my e-mail to yet another website).

    > cat /etc/passwd | sed 's/\([^:]*\):.*:\(.*\)/user: \1 shell: \2/'

Besides the needless cat this is clearer in awk, a tool you mention just prior.

    awk '{FS=":"} {print "user: " $1, "shell: " $NF}' /etc/passwd

    > $ ls | xargs -t ls -l

Beware files with whitespace in their names.

    > find . | grep azurerm | grep tf$ | xargs -n1 dirname | sed 's/^.\///'
    >
    > ...
    >
    > for each of those files, removes the leading dot and forward slash, leaving the final bare filename (eg somefile.tf)

No it doesn't it returns the names of parent directories where files ending in "tf" are found and where the path also includes the string "azurerm".

    > $ ls | grep Aug | xargs -IXXX mv XXX aug_folder

Ew.

   mv *Aug* aug_folder/

Though now the issue of whitespace in path names is mentioned. Another minior point here is that with GNU xargs at least when using -I -L 1 is implied, so the original example is equivalent to a loop.

    > $ ps -ef | grep VBoxHeadless | awk '{print $2}' | xargs kill -9

    pkill VBoxHeadless

You acknowledge to avoid SIGKILL if possible so I don't know why you put it in the example.

    > $ sudo updatedb
    > $ sudo locate cfg | grep \.cfg$

    locate '*.cfg'

No idea why sudo is used when running locate, also it takes a glob so the grep here can be avoided.

    > $ grep ^.https doc.md | sed 's/^.(h[^])]).*/open \1/' | sh

Now this is just nutty.

    > This example looks for https links at the start of lines in the doc.md file

No it doesn't, it matches the start of the line, followed by a character, then "https".

The sed then matches start of the line, followed by a character, starts a capture group of the letter "h" followed by a single character that is not "]" or ")", closes the capture group and continues to match anything.

The example given will always result in "open ht" for any hit.

Then there's the piping to sh. You mention like to drop this to review the list. I'd suggest focusing on extracting the list of links then pipe to xargs open. If you get a pipeline wrong you could unintentionally blast something into a shell executing anything which might be very bad.

    > Give Me All The Output With 2>&1

    &> stdout-and-stderr

But each to their own.

    > env | grep -w PATH | tr ':' '\n'

   echo $PATH | tr ':' '\n'

or

    tr ':' '\n' <<< $PATH

Edit: I know the formatting of this comment is terrible, I think quoting the sed example caused the rest of the comment to be marked up as italics so I indented it along with the other quotes as code.

Not sure why the article links to some runtimejs copy of musl [1]. It's quite old (2014 vintage) to the point where the referenced code is no longer present upstream [2].

[1] https://github.com/runtimejs/musl-libc/blob/master/crt/x86_6...

[2] https://git.musl-libc.org/cgit/musl/commit/?id=6fef8cafbd0f6...

I should start by saying my Vim config is reasonably minimal, but I'm highly skeptical of this making plugins noticeably faster. How much time are plugins spending executing Vimscript vs executing external tools?

Funnily enough OpenSSH are switching scp to use the SFTP protocol https://www.openssh.com/txt/release-8.8

These bootstrapping compilers [1][2] as well as the posts here [3].

[1] https://github.com/smtlaissezfaire/bcompiler

[2] https://github.com/ras52/bootstrap

[3] https://www.muppetlabs.com/~breadbox/software/tiny/

Just submitting part 2 of this as I stumbled across it after having played around with write ELF files by hand. Never knew about the Hunk format and I think the author makes some interesting points.

Yeah I'm pretty familiar with most keyboard offerings. I'm just not keen on the Atreus' lack of a surrounding case/the key caps themselves being the edge. I know it's only an atheistic quibble but I guess I'm fussy like that.

It's a shame they couldn't get hot-swapable switches to work [1]. I have an ErgoDox with MX Browns which hasn't seen the light of day for a while. If I were to make a large outlay again on a keyboard I'd want to buy with the switches I now know I want or no switches and fit them myself. TBH I could take a soldering iron to my ErgoDox I just haven't had the motivation.

As an aside I've always wondered why the Katana60 [2] didn't have much interest as it seemed like a reasonable regular to full ergo in-between and IMHO more comfortable than something like a Planck. Though whilst I have tried the Plank I've not actually tried the Katana60 IRL. Looking forward to keyboard meetups again the post COVID future.

[1] https://twitter.com/kinesisergo/status/1470446358372896772

[2] http://xahlee.info/kbd/katana60_keyboard.html

Discussion from the post of this on Backtrace's blog at the time.

https://news.ycombinator.com/item?id=28068015

I certainly agree with your points, though the original task is a textbook example of where awk shines.

    awk 'BEGIN {FS=","} /cake/ {print $2, $3}' *.csv > cakes.csv

Unsurprisingly I disagree with the post's description of awk being an "advanced command".

McIlroy strikes again!

It still seems to be NaR here https://posithub.org/posit_standard4.12.pdf

GitHub repo: https://github.com/RUB-SysSec/gadget_synthesis

Heavily truncated title to fit within character limits.

Well the "-s" is denoting the subject but yes "-E 'set escape'" is the mitigation fail2ban are employing though it should be noted that this is specific to Mailutils. Many (most?) other mail(1)'s use the -E option to mean don't send messages with an empty body which left me very confused when I first read your comment so had to do some digging to understand it.

Upstream has changed the behavior as a result.

https://savannah.gnu.org/bugs/?60937

Kind of surprising as many *nix utilities that can shell out will offer "secure" modes to disable such an ability.

Since the move to Clang/LLVM the compiler in OpenBSD has been pretty up to date.

This is one of the cleanest blog designs I've seen in a while, will certainly be taking some inspiration from it.

> kernel operations are faster than userland operations

Call me a pedant but this grinds my gears. The speed my CPU will carry out instructions is not determined by if it's in a kernel or user context. Avoiding making switches between those contexts certainly means less work though.

Dev discussion and diff for those interested.

https://reviews.freebsd.org/D30170

It was a convenience but one I can live without. Purely from a LOC view ripping out features from browsers is something I welcome.

TSC stuff is always fun, the blogs [1] and presentations [2] from Circonus have been my favorite pieces on this. In fact Circonus and Theo Schlossnagle along with alumni Heinrich Hartmann and Riley Berton all have excellent presentations out there for anyone interested in motoring.

[1] https://www.circonus.com/2016/09/time-but-faster/

[2] https://www.youtube.com/watch?v=xqocAHGoBAg (from around 19:20)

> are often called "cosmic rays".

No! This exact issue is a classic example because at one point the fault was attributed to cosmic rays by Sun before the true cause came to light. As another commenter has said, terminology matters.

It is not a "well-known term", it is a cliché.

Can't say I really like the title as it comes across as an absolute statement whereas the bit flip could have happened for any number of unknown reasons.

I saw a similar take on Twitter and whilst root causing such things (especially when it's a single occurrence) isn't always possible, shrugging and saying "cosmic rays" should be the last thing to posit not one of the first.