pktgen

This is caused by bufferbloat, which you can read more about at https://www.bufferbloat.net/projects/bloat/wiki/Introduction.... The good thing is it's easy to fix.

On your upstream side (i.e. data you send out to the Internet), you can control this by using a router that supports an AQM like fq_codel or cake. Rate limit your WAN interface outbound to whatever upstream speed your ISP provides. This will move the bottleneck buffer to your router (rather than your DSL modem, cable modem, etc., where it's usually uncontrolled and excessive) and the AQM will control it.

Controlling bufferbloat on the downstream side (i.e. data you receive from the Internet) is more difficult, but still possible. You can't directly control this buffering because it occurs on your ISP's DSLAM, CMTS, etc., but you can indirectly control it by rate limiting your WAN inbound to slightly below your downstream rate and using an AQM. This will cause some inbound packets to be dropped, which will then cause the sender (if TCP or another protocol with congestion control) to back off. The result will be a minor throughput decrease but a latency improvement, since the ISP-side buffer no longer gets saturated.

You should read Naked Capitalism's excellent 5-part series about Uber's viability:

Part 1: http://www.nakedcapitalism.com/2016/11/can-uber-ever-deliver...

Part 2: http://www.nakedcapitalism.com/2016/12/can-uber-ever-deliver...

Part 3: http://www.nakedcapitalism.com/2016/12/can-uber-ever-deliver...

Part 4: http://www.nakedcapitalism.com/2016/12/can-uber-ever-deliver...

Part 5: http://www.nakedcapitalism.com/2016/12/can-uber-ever-deliver...

> ... the Naked Capitalism post about their inevitable doom is gaining attention ...

Not only am I glad that post is gaining attention (the entire series is excellent), I'm glad Naked Capitalism is getting attention. It's my favorite finance blog.

Hansmeier actually got into ADA trolling after the porn thing dried up. Of course, he couldn't even do that "honestly" (if there was such a thing): https://www.techdirt.com/articles/20131110/23180225191/turns...

Hilariously:

> "We consider ourselves to be an advocacy association more than we consider ourselves a law firm," [Paul Hansmeier] said. "With the porn reputation, I wanted to shift my focus and focus on something more positive. We're really focused on doing it right so anyone who hears about us says, 'Yeah. This is the right way to go about it.'"

> "Have no money to pay it back" applies to many companies (including many banks) that borrowed money and to many house owners, too. Would you conclude they have no intention of paying it back, too?

The question isn't whether the loan was paid back, it's whether there was an intent to pay it back at the time the loan was taken out. Many of those homeowners foolishly believed their house would appreciate at 20% per year indefinitely (and many lenders were telling people this to convince them to take out loans).

That's my thinking as well. He would have known that there wasn't a chance in hell he could ever pay that back, nor could he reasonably have believed this situation might change in the future. I would expect this, combined with the amount, extravagance, and opportunistic nature of this whole thing, to show intent to defraud. (But I don't know much about Australia's legal system.)

> He did nothing to defraud the bank or mislead it. He simply had access to a large line of credit, and used it. If the bank wants it's money back, that's a civil matter, not a criminal one. It's their responsibility to ask for it back.

He was drawing on this line of credit, which he knew he was legally obligated to pay back, without ever intending to pay it back. That sure seems like fraud to me.

There is a difference between taking out a loan with the intention of paying it back, but not being able to pay it back due to some circumstance (you lost your job, had a medical emergency, business failed, or something like that), and taking out a loan without ever intending to pay it back. One is a civil breach of contract; the other (at least in the US) is criminal fraud.

In addition to OLPC, Open Firmware was used on PowerPC Macs.

> $3,000/month plus extra traffic costs.

As if their existing margins on bandwidth aren't high enough.

> 1. Those customers who were stolen from will get to participate in the mother of all class-action lawsuits. The settlement will be outlandish. Juries hate huge corporations that screw the little guy, and the lawyers on both sides know it.

Nope, since they have a mandatory binding arbitration clause. See http://www.nytimes.com/2016/11/24/business/wells-fargo-asks-....

> Customers which the article goes on to name as Google and Facebook. Although, I cannot find any corroborating evidence to support this claim. Supercomuting 16 is now over, and I see no other articles detailing how "Intel is playing favorites with Skylake Xeons in a way that will shatter the industry status quo." SemiAccurate is literally the only site I can find professing this scenario.

SemiAccurate has a pretty good track record with these kinds of rumors and analysis. They're not right 100% of the time, but they're right enough that it's clear they aren't just making things up.

> The bandwidth costs are so far out of line with what the network transfer actually costs, it just feels like price fixing between the major cloud players that nobody is drastically reducing those prices, only storage prices.

Yes, it makes me wonder. For many applications, the ridiculous bandwidth costs will be substantially higher than compute costs, so it makes no sense that nobody in this supposedly competitive market wants to compete in this area.

> There are several providers that offer a unmetered 1gbps line PLUS a dedicated server for ~600-750/mo. Providers like OVH offer the bandwidth for as little as 100/month. ( https://www.ovh.com/us/dedicated-servers/bandwidth-upgrade.x.... ) I am just not sure how amazon can justify a 160x price increase over OVH or a 30x increase over dedicated server + transfer.

OVH and other large volume providers are probably relying on the fact that many customers won't use 100% of their purchased capacity, but even taking that into consideration, AWS/GCE/Azure bandwidth pricing is insane.

> From our perspective: yes, we don't feel comfortable letting untrusted users run side by side without a sandbox.

That's what I figured. I still wonder what other large providers (SoftLayer, OVH, etc.) do about this. Unfortunately, I suspect the answer is "nothing, we just hope/assume nothing will happen."

> In this context though of GPU compute, you are just talking sporadically to a PCIe attached device directly.

I know; I'm familiar with passthrough. It's not completely "free," but the overhead is very minor. I don't think anyone will be able to complain with a straight face about its performance. :P

I was about to write the same thing. The CPU won't be damaged, but it may underperform. The bigger concern would be other components, especially motherboard VRMs which seemingly tend not to have any thermal failsafe (on occasion, there are reports of them catching on fire).

> We wouldn't give someone a raw, unfettered machine in our datacenter (and I hope you wouldn't either!).

I think you're alluding to security issues with renting bare metal hardware to potentially untrusted customers, right? I've often wondered about the security implications of that - think backdooring BIOS/UEFI or other component firmware. But there are many large providers that rent dedicated hardware without a hypervisor. Are they just ignoring these concerns, hoping that this kind of tampering would be rare anyway?

> What is your concern with virtualization in this context?

I'm not the parent poster, but performance was probably the concern. There's still some (marginal, these days) overhead with virtualization in general, and VT-d specifically.

I assume you mean Parallels in the first paragraph? I use Fusion and have never seen an ad in it.

> The positive I see in the so-called gig economy is far more flexibility in employing underutilised labour.

That flexibility is nothing more than shifting risk from the employer, who is most able to handle it, to the employee, who is least able to handle it.

> This was by no means an accident.

Thank you for pointing this out. I keep seeing comments to the effect of "Wells doesn't make any significant profit from opening bogus accounts (unused accounts are typically unprofitable to the company), so the executives couldn't have wanted this." These comments reflect a misunderstanding of modern executive compensation and the incentive structures set up for executives in large companies like this.

What happened here is called control fraud [1], and it started at the top. Stumpf repeatedly bragged to investors about Wells' supposed cross-selling abilities, and these representations were priced into Wells' stock (being good at selling would suggest future growth). Because a higher stock price maximizes his own personal compensation (and his cash compensation, i.e. bonus, as well), the incentives down the line were set to maximize this metric. Tolstedt was in charge of the retail unit and her own compensation was substantially based on this same metric. This continued down to the low-level branch employee level, where the perverse incentive structure and ability to hire and fire (and threat of such) was guaranteed to produce massive fraud. The company and its shareholders do not benefit from this (they are victims, essentially); the responsible executives do, since this increases their personal compensation.

[1] https://en.wikipedia.org/wiki/Control_fraud. You should read more about what William K. Black (former federal S&L regulator during the S&L crisis, at the Office of Thrift Supervision and its predecessors; Keating Five whistleblower; and current economics & law professor at UMKC) has to say on this topic in general.

Thank you for providing what information you can.

I'm a game server operator. I'm not currently running anything, but I probably will in the future. We used to receive volumetric L3/L4 floods all the time from booters. The good thing is these were always just dumb kids, not sophisticated attackers, so they would be easy to filter with a simple ACL (often they were targeting some random port we don't use, so a simple rule set of "accept whatever UDP and/or TCP ports we use, drop all else" would be effective). There were a few providers who would set up these ACLs, but they were only effective up to a few Gbps and would null route past that.

If I get back into this, I will give GCE a try with GCLB in front for, effectively, ACLs. In my experience it's a near certainty that any reasonably popular game server will be attacked (very often as retaliation for banning someone for cheating). I'd imagine your mitigation capabilities for a small-time game server customer paying a few hundred a month would be different than a large corporate client paying 5 figures, but I'd still like to try GCE for this as it seems like the best bet (besides OVH).

I realize Krebs seems to be using Shield, not vanilla GCP, but I'd like to know the answer to this as well.

Krebs' article describes two attack methods, fake HTTP requests and a simple volumetric flood of GRE packets. L7 mitigation clearly isn't part of GCP's service. The GRE packets should be a different story -- if the customer isn't using GRE, they should be able to drop this traffic easily using the GCE firewall or GCE load balancer.

The vulnerability report at http://www.securityfocus.com/archive/1/532239 suggests the GCE firewall is, or at least was as of May 2014, ineffective against such an attack (even if your firewall rule set will drop the problem traffic). But it also says the GCE load balancers do not have the same problem. Krebs didn't mention how much of the 600+ Gbps was GRE, but let's say a GCE load balancer was configured to pass through only TCP/80 and received 100 Gbps of non-TCP traffic. Would the load balancer function as intended and drop all of this with no interruption to legitimate TCP traffic, would Google null route you, or something else?

The far more significant cause of the Great Recession was outright fraud. Watch https://www.youtube.com/watch?v=ClfBxWPkBKU and other videos featuring William Black (a former bank regulator from the S&L crisis days).

Some Intel NICs (at least the 10G ones, but some Googling suggests some 1G as well) support SCTP checksum offload. Also, the checksum is a CRC32C and the SSE4.2 CRC32 instruction can calculate these really fast.

Do something like Google's new authentication process - rather than asking for the username and password on a single page, ask for the username only with a "continue logging in" button. There's no need to actually ask for a password.

Yep. Basically, the ones who use it incorrectly are subsidizing the ones like myself who (ab)use it correctly.

Credit Karma's scores and "recommendations" like that are jokes. Of course Credit Karma wants you to have 20 credit cards - they hope you get them through their affiliate links!

Yep. I just applied for a few, and here's what I got:

- 70,000 Marriott points which I estimate to be worth about $700, based on the equivalent cash price I'd have paid for the hotel rooms (which I do have plans for)

- $890 in cash bonuses

- 50,000 ThankYou points which are worth $500 cash (the trick is to request mortgage or student loan redemptions, which can be made out to the bank in which you have a checking account, and then just deposit it in your account. The redemption value is higher this way than with the normal cash option.) or more for travel (probably will just take the cash as I have enough airline + hotel points right now).

The tilt towards cash or cash-redeemable bonuses is intentional, as I have enough points of various types to support my travel plans.

One other 'danger' I've seen some fall into is valuing their points based on the cash value of whatever they redeemed them for. For example, it's common to see people redeem airline miles for a ridiculous $10,000 ticket, and then claim they got 10c/mile or whatever based on that price. In my opinion, unless you would have paid $10k cash for that ticket had the points not existed, you haven't gotten 10c/point; you've gotten $(price you would have paid for a ticket) / $(pointsRequired).

I have to spend a little over $10k to get these bonuses, which will be almost entirely in manufactured spend. I'm most certainly not spending a single penny more than I would have spent if credit cards didn't exist at all.

It's also worth adding a few statistics:

- Total credit card debt I've ever held in my life beyond the grace period: $0

- Total interest I've ever paid in my life: $0

Why wouldn't an IRS-prepared return do the same? You'd still have to look at the numbers and handle your payment/refund.

Most taxpayers don't have enough deductions to itemize, cash jobs, or side business income. You'd still have the option to file a return if there's additional income or deductions the IRS doesn't know about.

Also, I believe mortgage interest is reported to the IRS.

It's clear they have significant influence on this matter.

> A racket is a service that is fraudulently offered to solve a problem, such as for a problem that does not actually exist, that will not be put into effect, or that would not otherwise exist if the racket did not exist. (http://en.wikipedia.org/wiki/Racket_(crime))

Can someone explain to me how this description does not apply to Intuit?