HNHacker News
TopNewBestAskShowJobs

p932

58 karma · joined April 15, 2015

doing things with computers.
submissionscomments
p932··on Origami is yielding new applications in spacecraft, architecture, and medicine
Briefly mentioned in the article is Erik Demaine (http://erikdemaine.org/).

You can find a lot of resources on his website among which lectures on the topic of Origami folding and algorithms. http://courses.csail.mit.edu/6.849/fall20/lectures/

p932··on Ask HN: Do you manage your family's digital safety?
E-banking security. Configured a dedicated hardware laptop with default network policy outgoing to denied. Manually configured a very limited set of IPs for the banks sites used (no DNS server allowed, static resolution in /etc/hosts) and OS packages. Second step (or factor) done on a dedicated phone hardware too (no sim card used). Automatic browser startup at session open with tabs open for the banks website.

Been operational for a few years. Minimal maintenance. Great peace of mind.

p932··on Sick of spending time on Auth, we built an open source 'Stripe for Auth'
Worth to mention in the same area regarding authorization engine with APIs is OPA [1] which is relying on a Datalog inspired language: Rego.

I agree with you that authorization is lacking a set of standards allowing interoperability. The only known practical one XACML, has not seen wide adoption. OPA through its design and API allow useful feature for Enterprise use cases for which Styra [2] (founder of OPA) is selling a solution based on those APIs.

Note: I am not affiliated with Styra in any way.

[1] https://www.openpolicyagent.org

[2] https://www.styra.com/

p932··on Highly Evasive Attacker Leverages SolarWinds Supply Chain
Your quote seems to be describing what Microsoft observed from the attackers on the compromised machines with SolarWinds Orion not how the software was compromised in the first place.

See detailed version: https://msrc-blog.microsoft.com/2020/12/13/customer-guidance...

> In actions observed at the Microsoft cloud, attackers have either gained administrative access using compromised privileged account credentials (e.g. stolen passwords) or by forging SAML tokens using compromised SAML token signing certificates.

> Although we do not know how the backdoor code made it into the library, from the recent campaigns, research indicates that the attackers might have compromised internal build or distribution systems of SolarWinds, embedding backdoor code into a legitimate SolarWinds library with the file name SolarWinds.Orion.Core.BusinessLayer.dll.

p932··on Software supply chain security
Is there any initiative in this direction towards applying this pattern on big dependency management tools (e.g maven, pip, npm)?
p932··on Software supply chain security
How this compares with https://github.com/theupdateframework/notary?
p932··on Software supply chain security
How this pattern/toolset protect against supply chain compromises of the dependencies used to build the "Datadog Agent" itself?
p932··on Software supply chain security
Thanks for the links. Do you know how this toolset helps to mitigate/prevent what is called in the GitHub blogpost "Supply chain compromises". Quickly checked around and couldn't find anything that applies to the dependencies of applications/binaries before they land into the target runtime (i.e k8s).
p932··on Show HN: k3sup – get Kubernetes and helm apps in
Disclaimer would be welcomed that you are author at Kontena and working at the company selling this propriety tool.
p932··on Virtual Kubernetes
Currently if you have only access to a namepsace on a shared Kubernetes cluster without cluster wide admin control you won't be able to:

- Create cluster wide RBAC ClusterRole or ClusterRoleBinding

- Create or get access to cluster-scoped resources (nodes, CRD)

- Use custom webhooks for example using sidecar injection

Many of the things that complex Kubernetes deployments are doing nowadays.

p932··on Virtual Kubernetes
Gardener project focus is orchestration of multiple Kubernetes clusters on IaaS cloud providers, whereas k3v focus on running a dedicated control plane over an existing Kubernetes cluster. Some overlaps but different project's goals.
p932··on Ask HN: Resources for blind developers and sysadmins?
Sorry about a bit off-topic and not directly answering your questions but your story resonated with my experience. Maybe it might help you or not :)

I've had surgeries on both my eyes for retinal detachment before I was 22 years old (30ish now). I am now handling myopia of -16 due to bad eyes and post-surgery effects. I don't want to insinuate that you have the same conditions but I dealt with similar symptoms. Sudden loss of vision, dark circles and dark drops passing in the vision is a scary and distraught feeling.

The thought process you describe happened to me as well and is still in-progress. Dealing with the fact that having such issues "early" in life poses questions and anxiety for what might happen later. I kind of navigated over the years with two ways of dealing with this. First as you today with the ideas of pro-active actions to prepare for the day I might go blind: learning braille, using a computer without or very poor sight and thinking about possible career transitions.

I was lucky enough that the surgeries went well and my sight "kind of" stabilized. Over the years I adopted a more "optimistic" approach. Even with a bad start, it is still only a possibility and not a certainty to become blind. I decided to live my life as fully as possible with my current sight and avoid to end-up in a anxiety circle about it. Who knows I might still have my sight for life. And by the time it might deteriorate, technology and medical science will have improve, thus hopefully increasing the chances in treatment, tools and possibilities.

Good luck for everything.

p932··on Show HN: Airmash – Multiplayer Missile Warfare HTML5 Game
You should definitely get a proper plane ;). k
p932··on Intel Pulls Out of OpenStack Effort It Founded with Rackspace
Apparently RedHat does:

http://www.serverwatch.com/server-news/red-hat-growing-milli...

https://investors.redhat.com/~/media/Files/R/Red-Hat-IR/docu...

p932··on A $14 “ergo” keyboard from surplus parts
Datahand are also an alternative to traditional keyboards: http://octopup.org/computer/datahand
p932··on The death of optimizing compilers [pdf]
Some bits of Fran Allen in Coders At Work book: http://www.codersatwork.com/fran-allen.html

"We were making so much good progress on optimizations and transformations. We were getting rid of just one nice problem after another. When C came out, at one of the SIGPLAN compiler conferences, there was a debate between Steve Johnson from Bell Labs, who was supporting C, and one of our people, Bill Harrison, who was working on a project that I had at that time supporting automatic optimization. The nubbin of the debate was Steve’s defense of not having to build optimizers anymore because the programmer would take care of it. That it was really a programmer’s issue"

"We have seriously regressed, since C developed. C has destroyed our ability to advance the state of the art in automatic optimization, automatic parallelization, automatic mapping of a high-level language to the machine. This is one of the reasons compilers are . . . basically not taught much anymore in the colleges and universities. "