placardloop

The title makes it seem like this is a major or systemic issue, but the article content essentially says this was a one-off, potentially a mistaken omission that was fixed within 24 hours. The article itself even states that the Post routinely discloses its ties to Bezos in its reporting and this was an anomaly. I used to read the Post (I’m not a subscriber anymore) but I do distinctly remember seeing such a disclosure all over the place. Is this an attempt at outrage clicks?

Edit: people saying I didn’t read the article apparently didn’t read it themselves. From the article:

> The Post has resolutely revealed such entanglements to readers of news coverage or commentary in the past … since 2013, those of Bezos, who founded Amazon and Blue Origin. Even now, the newspaper's reporters do so as a matter of routine.

So at minimum the article disagrees with itself, but it seems the outrage bait is working hook line and sinker.

Edit 2: To try and be a little clearer here: the article is trying to (but in my opinion doing a really poor job of) make a distinction between the disclosures that the non-editorial WaPo authors do, and the disclosures that the editorial authors do, with the assertion that the editorial authors are worse at it.

This is Amazon we’re talking about, it was probably Perl.

There is nothing in that article that mentions either devops or 40% of any team or role being cut. It doesn’t corroborate anything.

Within AWS this role falls under the Systems Engineer job family. It is not a devops role, and its involvement in events like today would be the same involvement as every other SWE at Amazon.

Just do a quick google search for that “40% of devops laid off” and you’ll see that it’s actually an old article from months ago that multiple people, including AWS employees, are saying is bullshit and unsourced.

edit: found another source that says this 40% number came from an AWS consultant that worked with customers to help them be better at DevOps, and it was 40% of their specific team that was laid off. Even if it were true, it has nothing to do with the internal operations of AWS services. This is why it’s important to understand the information you’re sharing before making judgements off of it.

Misunderstanding the things you are linking does not mean you proved anyone wrong.

AWS does not have dedicated devops roles. All AWS SWEs are expected to take oncall shifts and respond to incidents, manage build pipelines, etc rather than having specific devops people to do it for them. The article you linked claiming 40% of them were fired is total junk. You can believe that or not, I don’t care.

The last one is a ProServe role, which is a consulting role that spends their time working in customer environments, which is where they may encounter terraform. It does not mean anything about internal use of terraform.

AWS doesn’t even have a “devops team” nor even any devops job roles. AWS also does not use Terraform (which is what the article says everyone was replaced with) at any significant scale, so this article is similar junk.

> One of the benefits of Litestream 0.5.0 is that there’s now an official litestream Docker image. All of my previous Docker containers required a lot of boilerplate to download the correct version of Litestream and make it available in my container, but now it reduces to a single Dockerfile line

There’s been an official Litestream container image for over 3 years at this point (since version 0.3.4, it’s at the same Docker Hub as 0.5.0).

Homelabbing is a hobby for most people involved in it, and like other hobbies, some people dip their toes in it while others go diving in the deep end. But would you say it’s “overkill” for a hobbyist fisher to have multiple fishing poles? Or for a hobbyist painter to try multiple sets of paintbrushes? Or a hobbyist programmer to know multiple programming languages?

There’s a lot of overlap between “I run a server to store my photos” and “I run a bunch of servers for fun”, which has resulted in annoying gatekeeping (or reverse gatekeeping) where people tell each other they are “doing it wrong”, but on Reddit at least it’s somewhat being self-organized into r/selfhosted and r/homelab, respectively.

Ahh you’re right, there are some that just initiate a connection via something like Session Manager, but those connections where AWS initiates the connection for you are logged in CloudTrail, even without data events, and root doesn’t give you any ability to directly SSH into an instance outside of those methods (you cannot, for example, use root to find out what the private keys are for logging into an instance) so we’re back to the fact that any such access would be auditable.

SSH is totally irrelevant here. Having AWS root account access doesn’t give you any ability to SSH to or otherwise access running instances. You could access data on those instances by cloning the EBS volumes or modifying build pipelines or changing network access or similar, but these would all show up in CloudTrail even without data events enabled.

For S3 objects, you don’t necessarily need data events to identify if tampering happened. S3 objects are immutable as well, so if any changed you would see that reflected in the creation date and new hashes that S3 attaches as tags, which you can correlate with application logs to see if they match up or not. It’s not as simple as data logging, sure.

But you’re also missing the key component here that they did not say they only just enabled CloudTrail logs, they’re saying they just now enabled CloudTrail log alerting. We don’t have any idea if data events were enabled or not, or if things like flow logs were enabled or not, or what other investigation tools they have running at the application layer. However, even if none of existed, there’s still a lot more audit-ability of events that happen in an AWS account than you’re implying, even the root account.

CloudTrail logs for the last 90 days are enabled by default, cannot be turned off, and are immutable, even by root. If you view this “event” as starting when Arko was supposed to have their access terminated, that’s within the 90 day window and you can indeed trust the logs from that period.

You can still generate the QR code in the desktop and scan it with your phone camera. The device receiving the file does not have to be the device that scans the code.

Of the big three cloud providers, only GCP uses containers for customer isolation, and they do so with the supervision of gVisor. It’s certainly possible to do container isolation securely, but it takes extra steps and know-how, and I don’t think anyone is even considering using gVisor or similar for the type of developer workflows being discussed here.

AWS and Azure both use VM-level isolation. Cloudflare uses V8 isolates which are neither container nor VM. Fly uses firecracker, right?

This topic is kind of unnecessary for the type of developer workflows being discussed that the majority of readers of this article are doing, though. The primary concern here is “oops the agent tried to run ‘rm -rf /‘“, not the agent trying to exploit a container escape. And for anyone who is building something that requires a better security model, I’d hope they have better resources to guide them than the two sentences in this article about prompt injection.

The public land situation in the western US is vastly, vastly different from the situation in the east. Just like you’re saying comparing the US to the UK are two different situations, you also have to treat parts of the US separately.

Almost all of the US’s public lands are west of the Rockies. If you live in Colorado, California, Oregon, Washington then you can basically throw a rock and hit some public lands. East of the Rockies, you can go your entire life without ever even seeing public lands.

https://www.backpacker.com/stories/issues/environment/americ...

Again, this isn’t at all in the scope of restic’s docs. If you’re using S3 as the storage, it’s on you to understand how S3 works and what permissions are needed, just like it’s on you to understand how your local file system works and file permissions work if you use the local file system as a backend.

If you don’t understand S3 or don’t want to learn, then that’s fine, and you can pay the premium to tarsnap for simplifying it for you. But that’s your choice, not an issue with restic.

If you think differently, have you submitted a PR to restic’s docs to add the information you think should be there?

That’s because restic is not opinionated about where and how you store your backups. Restic provides a nice interface to create the backups, and then lets you choose where you want to store them (and how access to them is managed), be it locally or via SFTP or S3 or many other backends. Any security properties related to S3 are not in the scope of what restic is meant to do.

It’s pretty simple to enable versioning and object lock on your S3 bucket, but it is another step if you’re using restic. Sure, if you just want all of that taken care of for you, you can use tarsnap, but you’re paying a 5x+ premium for it.

The other nice thing about restic is that since it’s just the client-side interface, it allows others to provide managed storage. Borgbase.com is a storage backend that is supported by Restic that supports append-only backups, and is cheaper than tarsnap.

The pricing isn’t due to AWS. Even if you used standard S3 and paid for data retrieval for your entire backup every single month, tarsnap is over 3x the price of just using S3 yourself. The markup on tarsnap is wild.

Using something like restic or borgbackup+rclone is pretty much the same experience as tarsnap but a fraction of the price.

Your condescending appeal to emotion does nothing to change the facts. My family and I too lived through the winter storm, going multiple days without power. It doesn’t change anything about what I said. The national-vs-local-grid topic is a red herring, as even the non-Texas grids were without power. If you want to actually change things, you need to acknowledge these facts rather than letting yourself be controlled by emotion.

One of Rick Perry’s signature accomplishments as governor of Texas was that he implemented a few policies mandating the expansion of renewable energy, and also a massive initiative called the Competitive Renewable Energy Zone that funded building high voltage transmission lines that connected population centers in North and Central Texas to the open land in West Texas, which is what enabled massive boosts in wind farms being built in west Texas.

Every single state surrounding Texas was also suffering from power outages due to the winter storm in 2021, despite all of those states being part of the non-Texas interconnections. The outages in those states weren’t as bad, but even if Texas was better connected to them, there’s no guarantee that they would have had any power to share.

Nearly 15% of Irelands population was without power for multiple days earlier this year due to a storm. And the Iberian peninsula blackout that happened just in April was one of the biggest power blackouts in the history of the world. And those are just the ones off the top of my head.

This feels like you’re applying absolutes to a massive industry with wildly varying standards for peer review and work product.

I was a consultant for years at a Big4 and I can personally attest to a lot of the stuff I was producing as a 22 year old going straight to the client leadership with zero oversight or review from my higher ups. Whether something got extensive quality checks was dependent on the type of work, notoriety of the client, and of course personal management styles of the partners involved.

In several of my projects, nobody on the team had experience with a particular topic, including the senior management, but the client was all told we did. The juniors on the project were then expected to put together product and deliver it, and none of it was reviewed by the higher ups (not like they had any expertise in it to provide feedback anyway).

This is true for the act of launching VMs, but it’s pretty reductive towards the entire suite of important features that Proxmox provides like clustering, high availability, integration with various storage backends, backups, and more that qemu doesn’t.

If you’re on iOS, the app “Strong” is a really simple but great tracking app. On Android there is “FitNotes” which is a little bit more barebones, but still really functional. I have tried Jefit a few times and think it’s great but ended up using these other ones because of their simplicity.

AWS really shot themselves in the foot with naming everything “Amazon Q <insert suffix here>”. The Q that’s in the console is completely and entirely different from the “Q Developer” and other AI products that AWS is launching.

The Q Developer CLI, Q Developer IDE plugins, and now Kiro are pretty much just wrappers around Claude Sonnet 3.7/4, and work just as well as them.

Which is kind of ironic since the Amazon Q Developer CLI (which is essentially Claude Code with a slightly different wrapper) was released long before Claude Code and seems to mostly be flying under the radar.

These AI reports are just an acceleration of the slop created by similar human “researchers”. The real root cause of this is that most security “professionals” have been trained to do the bare minimum of work and expect a payday from it.

There’s an entire industry of “penetration testers” that do nothing more than run Fortify against your code base and then expect you to pay them $100k for handing over the findings report. And now AI makes it even easier to do that faster.

We have an industry that pats security engineers on the back for discovering the “coolest” security issue - and nothing that incentivizes them to make sure that it actually is a useful finding, or more importantly, actually helping to fix it. Even at my big tech company, where I truly think some of the smartest security people work, they all have this attitude that their job is just to uncover an issue, drop it in someone else’s lap, and then expect a gold star and a payout, never mind the fact that their finding made no sense and was just a waste of time for the developer team. There is an attitude that security people don’t have any responsibility for making things better - only for pointing out the bad things. And that attitude is carrying over into this AI slop.

There’s no incentive for security people to not just “spray and pray” security issues at you. We need to stop paying out but bounties for discovering things, and instead better incentivize fixing them - in the process weeding out reports that don’t actually lead to a fix.

This is like someone in 1800 saying “at the end of the day you still have transportation needs and it’s hard if not impossible to beat horses and carriages in terms of cost”.

Literally just do a google search. There are advancements every day that improve upon evaporative cooling to make it use less and less water and energy, and alternative methods other than evaporative cooling.

This particular site is being built basically in the parking lot/backyard of a steel mill, so it sort of is brownfield. I have a hunch that “empty cornfield” is just the author using some artistic freedom instead of saying “an empty field in the Midwest”.