helper

The option comes up for me on the lock screen.

No. Lambda charges you only for when your application is actually handling request (or other events). That isn't an option with Fargate.

Thanks!

What does "Cloud Run on Google Kubernetes Engine" mean? Is there anything beyond the idea that a plain docker container can run on Cloud Run or on GKE?

From a developer perspective, deploying a docker container with a plain http server is much more appealing than the hoops you have to jump through to use the lambda custom runtime stuff. I hope this gets AWS to provide a docker on lambda option.

The author of this service didn't think it important to provide the ssh key and based on the comments in this thread people have already signed up for this service without caring about the key. So yes, I think even people who would use this service mostly can't be bothered to manually update their known_hosts file.

Registration over ssh is cute but not safe from MITM attacks. Even if the ssh key was published somewhere (which as far as I can tell it isn't) you would be dependent on people manually adding the key to their known_hosts file which you can't reasonably expect most people to bother with.

What do you want me to read?

Because it doesn't solve the problem the author is trying to solve? The goal of this is to be able to produce backwards compatible tar.gz files that can be served from a docker registry that also can be on demand streamed instead of predownloaded.

If they just wanted a S3/GCS fuse filesystem there are plenty of open source options out there.

There's a really interesting book about the NTSB investigation into flight 427 called "The Mystery of Flight 427: Inside a Crash Investigation". If you like the story behind root cause analysis of engineering failures (and aren't squeamish about plane crashes) its a great read.

This is the CAB Forum rationale for serial number entropy[1]:

> As demonstrated in https://events.ccc.de/congress/2008/Fahrplan/attachments/125..., hash collisions can allow an attacker to forge a signature on the certificate of their choosing. The birthday paradox means that, in the absence of random bits, the security level of a hash function is half what it should be. Adding random bits to issued certificates mitigates collision attacks and means that an attacker must be capable of a much harder preimage attack. For a long time the Baseline Requirements have encouraged adding random bits to the serial number of a certificate, and it is now common practice. This ballot makes that best practice required, which will make the Web PKI much more robust against all future weaknesses in hash functions. Additionally, it replaces “entropy” with “CSPRNG” to make the requirement clearer and easier to audit, and clarifies that the serial number must be positive.

[1]: https://cabforum.org/2016/03/31/ballot-164/

Interesting. Here's an article describing the changes: https://9to5google.com/2019/02/15/google-chrome-detect-incog...

> Beeing GDPR compliant is not rocket science.

Its also not free. Rational companies will apply a cost benefit analysis to GDPR compliance and some of them will determine it is better to block EU visitors than to do the GDPR work.

Blockchain, literally just a merkle tree..

This is a really great exploration of this vulnerability.

It makes me sad that lxc doesn't get more love. LXC has had unprivileged containers as its default for 5+ years now. Its a really solid tool set that has mostly been passed over for lack of marketing.

They are working on it: https://git.zx2c4.com/wg-dynamic/about/docs/idea.md

Its not hardcoded, its just the default server. You can specify your own via a cli flag.

Its interesting that pass[1] uses GPG and was created by the author of wireguard, Jason Donenfeld. I wounder if he would build it differently if he were starting today?

I feel like the one thing that keeps me from abandoning GPG completely is the general lack of smartcard support in any other system. Are there any examples of using yubikeys to store your libsodium keys?

[1]: https://www.passwordstore.org/

Its never been part of the stdlib, its part of x/crypto. They also aren't going to remove it, just deprecate it.

We use wildcard certs (*.example.com) so each customer can have vanity-customer-name.example.com domains. I think our model is fairly common for multi-tenant domain name segregated systems.

They have supported TLS termination for https connections for a long time. This adds support for TLS on TCP connections. The NLB load balancer also allows you to keep the same set of pubic IP addresses for your load balancer endpoints.

The nextmuni predictions are pretty good for buses that are already running on the route. The predictions break down as soon as it has to estimate when the next driver is going to actually start the route.

If an account that doesn't have this feature turned on is hijacked, the hijacker could turn this on to permanently lock out the owner of the account.

I tried it today with my speaker and it worked.

We have customers that batch upload data to our cloud service. We originally only offered HTTPS uploads but found a significant number of our customers really preferred SFTP workflows. My best guess as to why is that WinSCP provides a comfortable UI paradigm and there isn't an equivalent (well known) windows GUI for doing HTTPS uploads.

Our SFTP server is written in go and exposes a VFS that has nothing to do with anything on the local file system. It doesn't even allow you to download the files you just uploaded in the same session.

Of course things like the recent libssh CVEs should make anyone exposing non-standard ssh services to the internet a bit nervous.

We've been using gRPC since late 2015 for communication between IOT devices and cloud hosted servers. We chose gRPC for the following reasons: bi-directional streaming support; TCP connection multiplexing; mutual authentication with client TLS certs; a large company backing it so that it would likely continue to be supported in the future.

In other words gRPC fit our use case nicely and if it didn't exist at the time we would have built our own crappy protocol ourselves.

I think gRPC is great for server-to-server communication and use cases where you need bi-directional streaming. I would not use it for an externally facing API. I would not recommend it for browser-to-server communication unless you are already using gRPC other places in your stack. If you want the IDL you can use protobufs over plain HTTP.

GraphQL solves a very different problem and I would generally not consider it as an alternative to gRPC.

One place where PAKEs are widely deployed is in enterprise wifi networks that use PEAP/MSChapV2 password auth. MSChapV2 is really terrible and basically requires you to store passwords with weak hashes (or in cleartext).

Its nice to hear that there are PAKEs that are not tied to specific password hashing functions.

The syntax seems to be inspired by awk more than c.

Got it. Thanks.

I don't see ssh as an option there?