praseodym

The overview of the Kubernetes control plane (API server, controller manager, scheduler and etcd) in this article is completely incorrect. In reality, only API server connects to etcd and all other components talk to the API server to do their job.

For example, if the controller manager, by talking to the API server, finds out that the number of running pods is not equal to the number requested in a ReplicaSet, it will create new pods to satisfy that request. The scheduler will notice (through the API server) that these new pods are pending and will try to schedule them to a node. The Kubelet, running on that node and connected to the API server, then notices that it is supposed to run this new pod and starts it. All of this is based on reconcilation towards some desired state.

There is an ‘error inspection’ proposal for Go 2.0 which will hopefully solve this issue: https://go.googlesource.com/proposal/+/master/design/go2draf...

The proposal has been partially accepted and implemented in Go 1.13: https://github.com/golang/go/issues/29934#issuecomment-48968...

How does Hydra compare to other OIDC server implementations like Dex and Keycloak?

No it does not. It will only show that dialog if the page returns anything different than the expected response, exactly like a captive portal would.

Some free advice: reduce the number of shards! Each shard comes with some state management overhead.

The soft limit is currently at 1000 shards per node, but you should be aiming at 25-50GB of data per shard.

Recent containerd versions have CRI support built in, so Kubernetes (Kubelet) can use it directly.

Looks like it:

  $ clang -O2 -target bpf -Xclang -target-feature -Xclang +alu32 -c sub32.c
  $ llvm-objdump -S -no-show-raw-insn sub32.o
  
  sub32.o: file format ELF64-BPF
  
  Disassembly of section .text:
  0000000000000000 sub32:
         0: w0 = w1
         1: w0 -= w2
         2: exit
  
  $ clang -O0 -target bpf -Xclang -target-feature -Xclang +alu32 -c sub32.c
  $ llvm-objdump -S -no-show-raw-insn sub32.o
  
  sub32.o: file format ELF64-BPF
  
  Disassembly of section .text:
  0000000000000000 sub32:
         0: w3 = w2
         1: w4 = w1
         2: *(u32 *)(r10 - 4) = r1
         3: *(u32 *)(r10 - 8) = r2
         4: r1 = *(u32 *)(r10 - 4)
         5: r2 = *(u32 *)(r10 - 8)
         6: w1 -= w2
         7: w0 = w1
         8: *(u32 *)(r10 - 12) = r3
         9: *(u32 *)(r10 - 16) = r4
        10: exit

This is exactly why Elasticsearch has a soft limit of 1000 shards per node since version 7.0: https://www.elastic.co/guide/en/elasticsearch/reference/7.0/...

This benchmark used 4605 shards (5 per index) on a single node, which is way above the recommended number.

Also, to prevent oversharding, the default number of shards per index has been changed to 1 in 7.0.

> some AEADs (including AES-GCM) suffer catastrophic failures of confidentiality and/or integrity when two distinct messages are encrypted with the same key and nonce. While the requirements for AEADs specify that the pair of (key, nonce) shall only ever be used once, and thus prohibit this, this is a worry in practice.

Could anyone explain what this catastrophic failure entails? Do both messages suddenly get decryptable, or is the entire AES key compromised?

NVMeOF (NVMe Over Fabrics) comes to mind, having multiple NVMe drives (mostly PCIe x4) + networking (100GbE uses x16 PCIe) consumes a lot of PCIe lanes.

Also note that current two-socket AMD Epyc servers use 64 lanes from each CPU for inter-CPU communication, so the entire server has only 128 lanes (out of 256) left for peripherals.

From the article:

> London has infamously suffered the largest fatberg specimens, one about 15 semi-trucks long, mostly made up of cooking grease and now partly exhibited in a museum. New York City has largely avoided the monstrosities by removing unwanted items before they enter the plant [..]

Isn’t the problem the blockage in the sewers to the treatment plant itself?

They have open sourced it (https://github.com/elastic/elasticsearch/tree/master/x-pack/...), but you cannot (legally) use it without a paid subscription. Same goes for PDF and PNG reports in Kibana.

Monitoring is available in the free subscription, which cannot be used by SaaS providers. And now that we have an alternative: the Elastic monitoring plugin is pretty neat, but the Open Distro Performance Analyzer looks way more powerful. I’ve had the Elastic monitoring UI and a regular ‘perf top’ open with still no clue as to why Elasticsearch was eating CPU (relative to the query load). It looks like Performance Analyzer brings far more to the table.

Last year Elastic opened up the source code of their commercial X-Pack offering: https://www.elastic.co/blog/doubling-down-on-open. This means that these components (security, alerting, etc.) are now available in the GitHub repository, but they are covered by the proprietary Elastic license instead of the Apache 2.0 license like the rest of the software. Some of the proprietary parts can be used for free, some need a paid commercial subscription. None of them are true open source (free as in freedom), though.

However, this is also when Elastic started muddying the waters (to quote the AWS blog post). Most of the new features across the Elastic stack that were added in the past couple of months (Index Lifecycle Management, APM UI, Infrastructure and Logs UI, Kibana multi-tenancy, Kibana Canvas) are not added to the Apache 2.0 codebase but are only available in the free-but-not-open version. These features can be used for free with the Basic subscription (no registration needed) but only under the terms of the Elastic license.

And this Elastic license is where AWS feels the pain. It clearly prohibits SaaS offerings:

> You agree not to: [..] use Elastic Software Object Code for providing time-sharing services, any software-as-a-service, service bureau services or as part of an application services provider or other service offering (collectively, "SaaS Offering") [..]

(from https://github.com/elastic/elasticsearch/blob/6.6/licenses/E...)

The license is very similar to moves that MongoDB and Redis made recently. Only Elastic is just now doubling down on adding new (and highly demanded) features to their proprietary offering.

The IndexStateManagement plugin is basically the same thing as Index Lifecycle Management (ILM) which was introduced in beta form in Elasticsearch 6.6. ILM is under the Elastic license though, so it’s not free-as-in-freedom, but the feature is included in the free-as-in-beer basic license.

https://www.elastic.co/guide/en/elasticsearch/reference/6.6/...

6.6.1 is the latest stable release. 6.5.4 was released 19 december 2018 [1], so they’re not too far behind, though.

[1] https://www.elastic.co/blog/elastic-stack-6-5-4-released

You’ll want mechanical ventilation (with heat recovery) to prevent that: https://en.wikipedia.org/wiki/Heat_recovery_ventilation

I don’t think either language is fundamentally more secure than the other.

That being said, the Node.js ecosystem feels more immature than Python’s. The common practice of using microdependencies means that an average project has countless dependencies with varying levels of support — it’s all but impossible to make sure every one of those dependencies is properly maintained.

The framework/library churn rate seems to have decreased though, so that’s certainly good from a security standpoint as well.

From a security standpoint, the attack surface of Node.js and whatever libraries are used to make `npm start` happen is a lot larger than plain Nginx.

From a general usability standpoint, a Node.js container with all build dependencies will surely turn into a bloated several hundred megabyte Docker image — an Nginx image with just the built static files is a lot smaller.

It is a bad idea to use a full-blown Node.js web server to serve some static content. A better solution would be to build the app in one container and then build another Nginx container to serve it. This container can then be hardened (run as non-root, use a read-only filesystem). An added benefit is that Nginx uses fewer system resources (~10 megabytes of RAM will work just fine).

We’re running such a setup in production; a sample Dockerfile can be found on https://github.com/WISVCH/docker-nginx.

To add to that: a QKD with one-time pad[1] is proven secure. However, because many QKD implementations have low secret key rates (the highest in research is 10Mbps[2]; most commercial implementations do only a few Kbps) you won’t be doing high-bandwidth communication using that method.

[1] https://en.m.wikipedia.org/wiki/One-time_pad [2] https://www.toshiba.co.jp/about/press/2017_09/pr1501.htm

QKD does defend against active man-in-the-middle. Working from the premise that qubits in general cannot be cloned (the no-cloning theorem), a protocol can be devised that can detect tempering by an adversary with unlimited computational power and technological abilities. BB84[1] is such a protocol, which is also used in commercial QKD products.

Of course it doesn’t defend against attacks on the devices, buildings or people; these are likely higher ranked risks than crypto attacks for many organisations.

[1]: https://en.wikipedia.org/wiki/BB84

That research quantum network has a different purpose. Quantum key distribution (QKD) as mentioned in the article has been commercially available for a number of years now (for example by ID Quantique [1]). These products rely on having a direct connection, i.e. a single fibre line without repeaters or other ‘interruptions’. This limits their range to about 100km (20dB attenuation).

The research network in The Netherlands is more ambitious than that. The researchers’ goal is to build a true quantum internet, with ‘quantum repeaters’ that allow connections over longer distances [2]. These quantum repeaters work on the principe of quantum entanglement generation and purification to achieve quantum teleportation of qubits to allow end to end communication [3].

If you’re interested in learning more about this, I can highly recommend the free edX course by TU Delft and Caltech on quantum cryptography [4].

[1]: https://www.idquantique.com/quantum-safe-security/overview/q... [2]: https://qutech.nl/roadmap/quantum-internet/ [3]: https://en.m.wikipedia.org/wiki/Quantum_network#Quantum_repe... [4]: https://www.edx.org/course/quantum-cryptography-0

The GNU units tool has support for currency conversion as well: https://www.gnu.org/software/units/manual/html_node/Currency...

Debian Stretch was released June 2017 and Ubuntu 18.04, well, in April 2018, so its not too surprising that they ship with different Python versions.

I do find it surprising that Linux distributions don’t always choose upstream LTS versions for their releases, it just feels like a big waste of effort to backport fixes across many versions.

It does depend on your dataset. In my experiments, Zstandard did outperform XZ/LZMA in terms of compression ratio, but not by much. However, the massive improvement in decompression speed is what won me over.

Subject Alternative Name has explicit differentiation between IP address and DNS names [1].

And fortunately the fallback to the the common name (CN) attribute that does not have this explicit differentiation was deprecated since 2000 in RFC 2818, and more recently also by both Chrome and Firefox [2,3].

[1] https://tools.ietf.org/html/rfc5280#section-4.2.1.6 [2] https://www.chromestatus.com/features/4981025180483584 [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1245280

They are. Kubernetes has abstractions at exactly the right layers (e.g. Service to create a load balancer) so that you can exchange configs between cloud providers.

There can of course be some difference in the capabilities that each cloud provider supports (e.g. not all load balancer implementations may support UDP) but the abstraction is definitely there.

Title is wrong: they have unlimited private repositories for free, but for a maximum of 5 users per project.

Microsoft actually stopped offering invidiual updates two years ago, citing high complexity and slow update scan times as problems. Instead, they moved to monthly rollup patches that supersede all previous updates.

https://techcommunity.microsoft.com/t5/Windows-for-IT-Pros-M...

The repair experience for MacBooks (not iOS!) is abysmal, even at Apple Stores. Whereas other vendors (HP, Dell, Lenovo) will happily send you customer-replaceable parts (keyboards, disks, etc.) or a technician for on-site NBD repairs even with their standard warranty plans, Apple requires you to buy Apple Care (~10% premium) and then you still have to wait for appointments and repairs at the Genius Bar. This can easily take a week or two, and they do not provide a loaner devices so you’re without your computer for the duration of the repair. I’ve been told that there are professional Apple Care plans that do provide them, but they come at a (even higher) price.