romeisendcoming

Amen.

And adding mandatory, recorded, voice commands for a subset of functionality.

You can avoid this issue through significant domain experience. Knowledge != smart. I find your assertions regarding assurance and networked computing disturbingly naive. If this 'fix' was simply altruism and a crying need it would be apparent to more of an audience than Google. This seems more like sheeps clothing and misdirection from Google - as usual.

This is an abuse issue at the DNS level, not a problem suitable for end user cosmetic witchery in the browser. Fix DNS abuse.

In this vein consider the robo and spam calls you receive.

Another product stream and company (and hype) I was never a fan of. Best thing they did was to rip off FreeBSD and the worst was break *nix compliant userspace + influence design UX and UI patterns for a new generation.

Never used it. Thought it was complete vanity and laziness as is much of social media.

Seemed lackluster to me. Adding code in a literally defined data structure failed to complete anything. with open() as f: ll = [f.(no help from here on out)]

Who says the struct has no other value? An ADT is the only place this approach makes any sense and these are not typically comprised of two values/references alone.

A interface devised just to unwind information from a two member struct is beyond 'cumbersome'.

I do exactly this. Granted I only have 50 chassis to deal with and can emergency boot to rescue via PXE. After 1st generation ILO and the enforced insecurity of vendor KVM options I saw the light.

Or someone can simply own your key holding device as you sip your beverage at the local hotspot or home wifi. Simpler to go after the secret privileged client than the server.

Right. But only bring up your jump server when needed from a CSP. The rest of the time unseen and mostly unknown.

Add a TLS auth channel to the portknock with a wait window and OTP and you are really in business with this approach.

So standardize on a non-standard port, document it and when you do have ssh probes assume it's targeted rather than just another l33t child running du-jour crack(x).

Moving to non-standard means more sophisticated discovery and possibly a more sophisticated attempt.

You control what fail2ban does with said log data and what actually gets logged. There are better ways than fail2ban of course but it's not the worst solution on the planet.

This is a silly opinion. Of course it's helpful and very useful when used in conjunction with other hardening measures.

Interesting you bring this up. Regardless of the provenance of packages and facility for installation you seem to be hinting that there should be a method to install specific service/feature sets to a system securely and without systems access.

I designed such a system which runs with appropriate permissions to a task, is modular, and accomplishes the provisioning via 'job' files submitted to a service endpoint. A user could describe the software they want installed. The SA performs due diligence on vetting software and designs a standard install module then generates a skeleton jobfile and provides it to the requesting user to fill in necessary details and submit. Wash , rinse, repeat.

Sure, especially when you VPN into a sacrificial subnet and need MFA to continue elsewhere into locked down application domains. OTOH I would leave ssh listening on a non-descript high port with MFA (key and OTP) enabled. No use worrying too much about that.

It's probably not safe to fork() from most frameworks threads (OpenMP) and is hard to make safe for complicated parallel processing. But if you control the flow of execution and minimize mutex and critical section(s) it can be done withal. Several examples of thread served queues performing user defined actions upon message receipt to include fork() + exec() come to mind.

You cannot serve the whole internet without cloud scale resources anyway. So what does it matter if your application is 10K/s less capable than an optimized version? You pay for another instance. For 5k more time and energy yearly you save .026 an hour. Congrats.

You can prefork. That is a tried and true method. And why do you need to create so many connections? Certainly you can architect the solution better than that.

Every open office plan or cowork office I've been in has made it almost impossible (coming from WFH) to concentrate and get things done. Having people visit to natter over things and the potential for shoulder surfing, surveillance, traffic capture drives me nuts. If you are an SA or working with private data cowork or public settings are not really an option.

Oh, I don't know. Gluing the programs together using RPC and REST seems to be working so well for everyone else. Why do you even need a shell or unix style pipelines, right?

Return status and data is a great argument for multiple value returns but it's simple enough to do in C. You just need an ADT and interface. Who hasn't done OO in C with mixed results?

Google and Mozilla at the forefront of C opposition. Instead we get walled gardens and unicorn solutions: every genius for himself.

In 1999 we were 'upgrading' to Evergreen 586s in K12 for a lucky few boys and girls. Good times and a lot of nothing going on. PIO4 and PATA with PCI buses clocked at 33 MHZ.

Can you imagine really trying to run 20+ year old tech in developer space? 8 - 10 MB/s throughput and 70 bogomips?

For my laptop(s) I tend to go with the best I can afford for multi-purpose development (because everything I do is HPC oriented or virtualized with a need for SMP vms) but I still have a Dell e6400 latitude that provides directory, dns and monitoring services for the in-house testbed. When it dies I have a celeron road warrior from WalMart ready to take it's place. Fit purpose to function to hardware.

Can attest to very little CPU performance loss via OpenMP applications over bare metal. Maybe as little as 5% for our use case (numerical modeling of weather impacts).

Agreed with your experiences. Identified my niche a long time ago in HPC and scientific development enterprise and core internet services (DNS, IP routing) + security (even though snake oil is big in sec now). The type of incompetence you describe doesn't flourish in these domains.

Article kind of mangles the relationship between software reuse (which _has_ been here for a long time) and specific language library, etc..management.

many years ago now systems administrators were tasked with providing a safe and sane environment for end user and developers by performing the exact due diligence that is described in this article. In the 'move fast and break things age' all this has been thrown to the wind and everyone decries the language manager code sprawl and breakage. Of necessity enterprises revert to 'immutability' as if it was a desirable and necessary deployment characteristic. This is an ugly time in IT.