Hacker News Reader

m1keilon I got hacked and Facebook banned me

> I really don't get why everyone here hates it.

Partly because comments like this.

m1keilon Terraform should have remained stateless

I wasn't suggesting that CMS fell from grace because they were being stateless. I was saying that when TF just started, these tools were in the right position to take lead over the IaaC space and didn't because the stateless model didn't fit. Take a look at Ansible's cloud modules, they tried.

TF's success, in my opinion, can be boiled down to:

a) Having a state - allowed them to provide declarative config with plan functionality

b) Choosing Go - removed the burden of installing or having to invest in self contained setup like they did with Vagrant & ruby.

I'm not a TF zealot. I hate my life every time I need to use it. And yet I know that there are no better alternatives out there. I'm sure there are some nice things in Pulumi or cdk-tf but I doubt switching to any worth the investment with existing TF project.

I would be glad to try and play with a tf-like project that works without state - "talk is cheap, show me the code".

m1keilon Terraform should have remained stateless

In what way? All these tools are "DSLs to API calls with idempotency guards" engines. This is exactly what a stateless TF would be. They all been extended with DSLs that allowed them to manage resources in AWS and other cloud providers.

These are in use but far cry away from popularity of tools such as Terraform, Cloudformation and others.

m1keilon Terraform should have remained stateless

> Ansible, Puppet, etc. don’t have intermediate stores of the hosts’ configuration, but then again they are used for different things.

Ansible, Chef, Puppet and co existed long before Terraform. If the stateless way would work better, these tools take over the cloud infrastructure space. But they didn't. To me it seems like a good sign that the their approaches didn't fit to infra.

Additionally, one of the biggest terraform selling points in the early days was the change plan feature. The ability to see the entire change that is about to happen as a result of a config change. I don't think it's easy to implement such thing in a stateless system.

Is it possible to create a stateless config for a subset of the resources/providers with a better functionality? Absolutely! Octodns seems like a good example. Another great example would be any of the serverless frameworks out there that do a much better job than Terraform at managing the lifecycle of the functions. But can this approach be applied to every provider and resource?

m1keilon Show HN: Bike – macOS Native Outliner

Are there any limits to the unlicensed mode? Is it a shareware or more in line with Sublime Text style?

m1keilon Virtual offices are not remote-friendly workplaces

Yes, companies with office cultures that change and become office-less won't change culture. They'll just adjust to the new engagement rules. I don't think there is a point trying to convince anyone to try doing it differently. These organisational behaviours are set in stone.

m1keilon SELinux is unmanageable; just turn it off if it gets in your way

I think SELinux can have its place on servers, but is a tough sell on the desktop.

m1keilon Ask HN: Best way to learn about computing history?

One resource I stumbled upon was The Dream Machine book. Very broad historic overview of computing history throughout last 70 years or so.

m1keilon O’Reilly Learning platform no longer as a benefit of your ACM membership

Wow their pricing gone through the roof. Few years ago they charged about 250-300ish. They provide lots of content but I wish there was a more tiered approach as I mainly use it for the books. At 500$ I think it will be cheaper for me just buying the books instead.

m1keilon A Foolish Consistency: Consul at Fly.io

Somewhat related question: Consul's deployment guide recommends against deploying a cluster across high latency networks, and suggests Federation instead. Did you had any issues caused by the high latency between servers and agents? Are all your Consul servers located in the same region?

m1keilon Grafana Mimir – Horizontally scalable long-term storage for Prometheus

I excluded the traffic because the price is basically 0. This is internal traffic and a bunch of HTTP requests. It doesn't cost us $3000 a month.

m1keilon Grafana Mimir – Horizontally scalable long-term storage for Prometheus

We are running Grafana and Prometheus on a single t3.xlarge instance with 150GB gp3 EBS.

Excluding traffic, it costs ~ $100 USD per month.

We are doing 10 second scrapes and currently have roughly 141k active time series. In Grafana Cloud it would cost...

15000 metrics for free. 126000/1000 * $8 = $882

Now here's the real kicker.. the pricing Grafana puts on their website are assuming 60 second scrape interval (1 data point/minute or DPM). If you are doing 6 DPM, that's $8 * 6 per 1000 time series!

So final bill.. drum rolls

126000/1000 * $8 * 6 = $6048

Yes. That's a 60x.

Now, sure, we don't get the scale, the backups, the SLA.. but we can live without it. And when Prometheus will start acting slowly, we will just bump it to t3.2xl, or spend some time and filter out some of the noisy metrics we might have around.

Btw, if you try to find any information about what is a "time series" or a "metric" on the Grafana's pricing page, good luck.

https://grafana.com/docs/grafana-cloud/metrics-control-usage...

m1keilon Fish 3.4.0

"Autosuggestions can now be turned off"

Finally. I should give it a try now.

m1keilon Vim Reference Guide

Oh, wow. This type of command discovery with fuzzy search and human readable description is what I've been looking for to enable sublime/vscode/atom/intelij cmd-shift-p type of functionality. This is a must IMHOfor a feature heavy editor nowadays. Thanks for the link.

m1keilon NPM package compromised by author: erases files on RU / BY computers on install

“Trust takes years to build, seconds to break, and forever to repair”.

m1keilon An update on AirTag and unwanted tracking

Airtags leverage the popularity of iPhone devices and use that, not a single phone. Given there's a high probability of someone in the surrounding with an iPhone, you don't have to have an iPhone so that an Airtag will track your movements accurately enough.

m1keilon What NPM should do to stop a new colors attack

> as long as package.json hasn't been updated, or update the lockfile if it has

There is a problem here: it will update the __entire__ package-lock.json file, regardless of the actual changes in packages.json.

Pinning doesn't help here if colors dependency is not your direct dependency.

So you can have a pinned library that doesn't pin colors.js. Now you make a change in packages.json (say adding or removing another unrelated package). You will end up with colors being bumped to latest.

m1keilon Pull Through Cache Repositories for Amazon Elastic Container Registry

Looks like only official Docker images from Dockerhub will be in the ECR gallery. "Other images are under consideration for the roadmap next year, along with authenticated private registries."

Meh.

m1keilon Pull Through Cache Repositories for Amazon Elastic Container Registry

Why is it the case?

That sounds like a political decision and not a technical one.

Looking at the gallery, the images I'm interested in seem to be built/uploaded by a different entity. Which is not great.

m1keilon I Love Arch, but GNU Guix Is My New Distro

> if the system can handle rollbacks it will be much more reliable than using the fs, as the fs knows nothing about actual state. It knows about blocks commited to disk. Usually they look the same, but not always.

Could you elaborate on this? If I have state that works on v1 and after upgrade to v2 the state is now non backward compatible to v1, how nix (or guix) can help? As far as I can tell, in such case a fs rollback is better solution.

m1keilon Amazon Managed Prometheus is now GA

This pricing man....

We have a small Prometheus running on t3.xlarge instance. Yes we don't have a redundancy or anything fancy, but it's fine, we can live without it.

It does 105k samples scrapes every 10 seconds. If I plug these numbers in I get... $1.5k a month before storage and query costs.

That instance costs us $150 a month? Redundancy is expensive but surely not 10x?

I'm sure folks will say "yes, but how much does it costs you to run it?". Well, that's the thing, it's practically free to run. Prometheus just works as long as you don't do silly things.

m1keilon Signal is experiencing technical difficulties

Why are you so frustrated? It clearly had issues, how would faster acknowledgment would make your day better? With limited resources I rather engineers to just fix the problem instead of spending time trying to give timely status updates.

m1keilon Operations is not Developer IT

The original thesis was better cooperation between developers and sysadmins (ops). It didn't focus on trying to make operations redundant or transfer every sysadmin into a SWE.

m1keilon State of netbooting Raspberry Pi in 2021

Indeed, you are right!

The explanation above was given by one of the Rancher staff members in one tech conference. It may be an alternative explanation that popped up with time.

In both the point is that k3s is "half of" k8s.

m1keilon State of netbooting Raspberry Pi in 2021

Fortunately Darren Shepherd came up with a novel idea of taking way the things he didn't want in Kubernetes and created a "distro" called K3s (3 is less than 8)

It's not that it is less, "3" is what you get if you take the character "8" and cut it in half vertically.

m1keilon NSA Kubernetes Hardening Guidance [pdf]

You don't use this guide as a bible but take it into account and compare with other common security advice in the field. If you get similar results it most likely a good list of advice.

m1keilon M1racles: An Apple M1 covert channel vulnerability

Oh, right. sorry, I sort of bailed on the whole FAQ thing when it was silly joke after joke but I get it now. It's the onion news of CVEs.

m1keilon M1racles: An Apple M1 covert channel vulnerability

This doesn't look like an issue that deserves its own website tbh.

m1keilon Behind the design of the fresh new Firefox coming June 1

Wasn't there a big redesign just recently?

m1keilon The Blue Hole in the Red Sea is the deadliest dive site in the world

Here's a good look of the famous arch crossed by a freediver: https://www.youtube.com/watch?v=hrXQbucZUDA

A real shame that this diving site is known for all of these avoidable deaths.