neopallium

This story (on two different websites) was posted twice [0],[1] about a month ago.

[0] is by the same author as this post (Erik Voorhees CEO of Shapshift).

[1] is by "E. Gün Sirer"

It doesn't seem to have any new content.

0. https://news.ycombinator.com/item?id=11550765

1. https://news.ycombinator.com/item?id=11565823

I have read that the GFW will also try to fingerprint a server if packet analysis shows that it might be a VPN.

VyperVPN has a stealth protocol (Chameleon) which tries to obfuscate the VPN connection to make it look like other types of connections. Other VPN providers might be doing the same thing.

When I first came to China about 3 years ago, I tried using a VPN service but it wasn't reliable and connecting was always slow. So I tried running my own OpenVPN server on a VPS in HK (different provider [0]).

What I found at that time was that the GFW seemed to detect the VPNS's TLS connection and delay some packets which caused the connection setup to timeout. I even created my own obfuscating TCP tunnel (written in Lua) and tunneled OpenVPN through that. The obfuscation made OpenVPN work much better.

I still had latency issue when doing a long download. I later found out that the latency issue was caused by my VPS provider having a 2Mbit bandwidth cap on traffic to China from the server (they don't say anything about this limit or how much it would cost raise the limit on their website [0]). Also I found that if I apply the 2Mbit rate limit on the VPS server, then latency didn't go sky high (slowly growing to 10 or 12 second ping times before dropping again). It has only been in the last 3-4 months that I have known about this issue and moved to a new provider.

I started using ShadowSocks because it uses a protocol that doesn't have any easy to detect fingerprints (all of the data in the protocol is encrypted), so it doesn't really need obfuscation to hide the connection from the GFW. Also ShadowSocks creates many connections (one for each proxied connection), so even if the GFW delays some of the packets, it will not cause a stall of all connections.

But I think the biggest thing that I like about ShadowSocks is that it doesn't need time to setup a VPN connection, the tun0 device and routing rules. So when my laptop connects to a different WiFi network, everything just works (except I sometimes need to reset the DNS tunnels, but I could automate the reset).

0. http://www.vpshosting.com.hk/

I don't need a lot of server resources for the proxy. So the cheapest server is more then enough. The real issue is getting good latency & bandwidth to sites outside of China.

What I am paying for good latency & bandwidth on that server is cheap compared to other providers.

Hong Kong is very close to me (Guangzhou), so latency is low (around 9-10ms).

Here is the latency I am seeing right now:

1. Ping to DigitalOcean VPS server in San Franciso: 270ms

2. Ping to 36cloud.com VPS server: 10ms

3. Ping from 36cloud VPS to DigitalOcean VPS: 160ms

4. Proxy running on DigitalOcean VPS server in San Franciso: 274ms, DL: 3Mbits, UL: 4Mbits

5. Proxy running on 36cloud.com VPS server: 178ms, DL: 8Mbits, UL: 5Mbits

The last two are from using speedtest.net with the same speedtest server in SF. So the VPS in HK save me almost 100ms of latency. which greatly improves browsing speed.

I have found using ShadowSocks [0] to work best for me here in China. VPNs create one connection for all traffic (which is easier for China's GFW to detect/block/slow down). ShadowSocks creates a new TCP/UDP connection for each connection that it proxies.

My setup:

Cheap VPS server in Hong Kong [1] (5USD/month, 512 RAM, 2Mbit port) running the ShadowSocks server (libev version). I have upgrade the port to 20Mbits for an extra 10USD/month. The port could be upgrade to 50Mbits for 25USD/month.

For DNS I use ChinaDNS [2] to automatically filter out bad DNS results from China's censorship. It works by sending DNS queries to all multiple DNS server at the same time (give it a few local DNS servers and foreign DNS servers). The foreign DNS connections are tunneled through ShadowSocks.

ShadowSocks can work as a Socks5 proxy, tunnel or transparent proxy [3]. Socks5 is the easiest to use and can even do DNS lookups on the server. I use the transparent proxy [3] option, since it allows selecting which traffic should go over the proxy.

The socks5 option will try to proxy localhost & lan conections to the proxy server.

An optimized list of subnets can be generated using bestroutetb [4]. I load the subnets for China (can private LAN) into an ipset hash and use iptables rules to exclude those subnets from going over the proxy.

ChinaDNS [2] and bestroutetb [4] could be used for VPNs too. This could be used when trying to access different services (US, UK, etc..) that don't allow access from outside their country. Use one VPN for US and another for UK, then use bestroutetb [4] to build subnet lists for each country route traffic over the correct VPN.

0. https://shadowsocks.org/

1. http://www.36cloud.com/

2. https://github.com/shadowsocks/ChinaDNS

3. https://github.com/shadowsocks/shadowsocks-libev/blob/master...

4. https://github.com/ashi009/bestroutetb

edit: fix formatting and port prices.

Here is a list of compilers that can generate C code for different languages:

https://github.com/dbohdan/compilers-targeting-c

How about a Canadian citizen living in China? Is the requirement mostly about paying taxes?

  Name: Robert G. Jakabosky
  Location: Guangzhou, China
  Remote: Yes
  Willing to relocate: Maybe
  Technologies: C/C++, Java, Lua, Node.js, Javascript/HTML/CSS,
    MySQL/Postgres/MongoDB, JIT/Compilers, FIX protocol, ZeroMQ,
    FreeSwitch/Asterisk, Docker
  Résumé/CV: https://cn.linkedin.com/in/neopallium
  Other profiles: https://github.com/Neopallium,
    http://stackoverflow.com/cv/neopallium-34934
  Email: rjakabosky@sharedrealm.com
  Wechat: robert2051

Full-stack developer. Worked with stock market datafeeds (BridgeFeed,FIX,Activ Financial) for about 7 years. IVRS/VOIP using FreeSwitch/Asterisk. Implemented a JIT/static compiler for Lua [0][1].

I am a Canadian who moved to China about 3 years ago. Anyone else around Guangzhou/Shenzhen/Hong Kong? I am interested in meeting others around here.

0. https://github.com/Neopallium/llvm-lua

1. https://github.com/Neopallium/slua

The article is about https://www.leapin.eu/ and https://e-estonia.com/

Those two sites don't seem like an april fools jokes.

1. Why can't the "ip_local_port_range" be changed? Wouldn't increasing the range help with short lived connections?

2. What is the maximum limit on active connection?

From what I can tell. It is using IPTables rules, netfilter queue, IPSet to maintain mapping of client connections to backend servers.

So it seem the kernel is doing most of the work to handle the connection. The load balancer isn't really proxying the connections.

GCC (>=4.8) & Clang now have Address Sanitizer support for fast memory error detection. About a 2x slowdown [1].

0. https://github.com/google/sanitizers/wiki/AddressSanitizer 1. https://github.com/google/sanitizers/wiki/AddressSanitizerPe...

I agree with what you said. I was just relating the experience I had.

We also had two large (U8) Compaq ProLiant servers that we used to run Oracle DB. We didn't have any problems with them, and only replaced them with newer faster Dell servers later. The redundant PSUs and hot-swap drives were the main reason we ran our database on them (one master, the other a standby slave). Those server were later used for our beta site (used for staging/development).

We later ported the backend Java service to C++, which most likely would have run fine on the UltraSparcs, but I think we had already sold them or returned them back to the vendor. I really wished Sun's UltraSparc T1 & T2 CPUs had taken off. I think they could have really good CPUs, but it was hard to compete with x86 because of all the software that was already compiled/optimized for the x86 architecture.

For us it was important to be able to fix problems quickly. Having to call in a service tech. to fix a hardware problem just increased downtime. Also we just had really bad luck with the IBM Netfinities, all 4 servers had a bad motherboard which failed in each server at different times. After that we didn't have any problems with them.

Personally I prefer to deal with generic hardware that I can service myself when a problem happens. But for some companies, it is better to have managed hardware with service contracts.

A company I worked for about 10 years ago had an IBM s/390 mainframe for about a month. Our manager at that time had previously worked for IBM and was trying to move the company over to hardware managed by IBM.

The biggest selling point was redundancy in the hardware being able to handle CPU/RAM/Disk/PSU failures without taking down the Linux VMs running on it.

Our workload was network bound, not much CPU or Disk IO load.

We ended up using generic Intel PCs (some custom built, some Dell and some IBM Netfinities). We had more down time with the IBM managed Netfinities, then with the custom built rack mount servers.

Back then we also had some Sun UltraSparc E3500 & E6500s, but we found that the Java VM (from Sun!) was much slower on the UltraSparc CPUs then on Intel CPUs.

I find it interesting that we had much better results from generic no brand rack mount servers then most of the expensive "enterprise" class servers.

Note: This was over 10 years ago.

Anyone have more recent experience with servers in a self-managed DC or co-location? It seems most companies/developers now use cloud/vps/hosted servers.

There is also my SLua [1] compiler. It compiles Lua to C code.

1. https://github.com/Neopallium/slua

First of all even a simple program like that will have standard libraries mapped into it's address space. Your program is reading from a region of the processes address space that has the binary code for the memcpy() function.

On linux you can dump a processes address space mapping from file "/proc/<pid>/maps". Or to see an example just run: cat /proc/self/maps That cat command will dump the address space mapping for that instance of the cat command. If you run it multiple times it will show different address ranges because of a security feature (ASLR, address space layout randomization).

Also you shouldn't use fprintf or printf to print 1 char. printf will try to look for format characters in the "string" you are passing it. It would be better to use fputc(*p, stdout), then you don't even need to call memcpy() or the "onechar" array.

If you set "p" to a block of allocated memory, then your program should segfault shortly after reading past the end of the memory. How many bytes you can read past the end of the allocated block of memory depends on how the memory allocator manages pools of memory and it's own bookkeeping information is stored.

You haven't had to reboot your home computer for 2 years? Nice!

Genes/DNA is just information that copies it self. Human intelligence is another process for information (ideas, culture, language, technology) to reproduce at a faster pace.

Does information/ideas have wants? Does it want to be copied?

Ray Kurzweil's book "The Age of Spiritual Machines" [1] describes this in more detail.

Why do you think machine intelligence can't develop a need/want for anything? True AI wouldn't need to be programmed, it would be able to learn like humans do, by observing others. Our genes do not control all of our behavior. We learn from our parents and those around us. Why do we want money/cars/iphones/gold/etc..?

1. https://en.wikipedia.org/wiki/The_Age_of_Spiritual_Machines

Most AIs do have genes in the form of digital DNA. GA (genetic algorithms) are commonly used to evolve digital brains.

Any high-level intelligence can learn to want something.

Basic drives that exist in animals and humans is just the basic need for survival.

It is our human level intelligence that allows us to want to change our environment for our own enjoyment. Most of what we do now is not required for basic survival.

If we create true generic AI (i.e. can learn like a human does from just interacting with it's environment), then it will be much more human then we might want.

If you want to know how true AI might develop, then think about how a human child develops. We train/teach children what is right and wrong. But we also teach them the value of work (making money).

We have history to tell us what happens when you take a group of humans a treat them like slaves. How do we expect to create true AI that wouldn't see the injustice of working without some compensation? Just because AI's brain is digital and not biological doesn't mean it will not be able to develop a want for something.

It would be nice if most of the package manager and basic shell commands could be kept out of the docker image too. I think this would require a utilities image that could be mounted during the build of the docker image. Some images would still require a shell for startup scripts or other tasks, but they can include them when needed.

tcpdump is just for filtering and capture. BPF allows dropping packets based on complex matching rules.

I would say that BPF is closer to iptables rules then tcpdump.

Quote from the README: .... The aim of this tool is to help creating BPF rules that will match (and drop) malicious traffic.

I haven't used BPF before, because I haven't had a need to yet. But I have been very interested in BPF for some time now. I hope more tools are made to make it easier to use BPF.

There is a bug that causes invalid output when the input file is larger then the BLOCKLEN. Set BLOCKLEN to 4096 and run the program on the test input file [1] (compare with output file [2]), to see the problem on a smaller input file.

The bug happens when read_sequence() is called with partial data saved from the last sequence, since (size == read) the first fread() will be asked for 0 bytes which causes the read loop to end early (n == 0).

1. http://benchmarksgame.alioth.debian.org/u32/iofile.php?test=...

2. http://benchmarksgame.alioth.debian.org/u32/iofile.php?test=...

The videos on both Firefox 17 and Chrome 24 worked for me on Linux.

> (though, imposing memory restrictions is much harder).

I developed an Emergency GC patch [1] for Lua 5.1 (Lua 5.2 come with this feature). With this feature it is easy set a per Lua State/script memory limit. The Emergency GC feature is needed to allow a custom allocator to force the GC to run when the script is at it's memory limit. My EGC patch has been in use by the eLua [2] for years to help run Lua scripts on Microcontrollers with as little as 64Kbytes of Ram.

Also Lua is fine for large projects [3].

1. http://lua-users.org/wiki/EmergencyGarbageCollector

2. http://www.eluaproject.net/

3. http://prosody.im/

Here is a project that is using the TL-MR3020 (which is very similar to the 703N) using solar/wind power + rechargeable battery to build environment tracking stations: https://apollo.open-resource.org/lab:argus

epistasis called manual management of huge pages a "royal pain in the ass", which is why I suggested trying transparent huge pages since they are easier to work with (i.e. no code change).

I would be interested in seeing some benchmarks that shows the affect of using huge pages of different sizes with hash tables or other data structures.

Here is a memory bandwidth benchmark that uses huge pages (only uses the default size which is 2Mbyte on my system): http://blogs.utexas.edu/jdm4372/2010/11/11/optimizing-amd-op...

It only sums the values from 32 million doubles (about 256Mbytes of ram). So it is only useful as a memory read speed benchmark. But is does show a lot of different ways to optimize memory bandwidth (prefetch, large pages, sse).

You could try to turn on transparent hugepages:

echo always >/sys/kernel/mm/transparent_hugepage/defrag

echo always >/sys/kernel/mm/transparent_hugepage/enabled

For more details see: http://lwn.net/Articles/423584/

Gigabit Ethernet is mainly used as a control network. Each FPGA has 4 RocketIO links (2-3Gb/s) and they are directly connected in a 2-D torus of point-to-point links. The RocketIO network is used for nearest-neighbor communication patterns. For reduction operations such as global sums, they call back to the host CPUs for MPI reduction operations to be preformed over the GE network.

Also one of the main goals was to build the supercomputer from commodity parts and "plug-in" FPGA cards, so they most likely had to go with FPGA cards there where available and maybe cheaper then the latest/greatest.

The paper would have been more interesting if they had compared this machine to other types of supercomputers then just CPU clusters.

The Lua interpreter (pure ANSI C), both the core VM and the public C API for modules are well written. http://www.lua.org/