Hacker News Reader

sebcaton How io_uring and eBPF Will Revolutionize Programming in Linux

Apart from Linux hw support for things at work, I implemented a fairly simple pseudo-device for establishing TCP connections from a process in capability mode on FreeBSD. The device driver has support for a denylist to disallow connections to specific IP ranges. It has multiple syscalls wrapped into one ioctl, and sockets opened from the device always had TCP_NODELAY, O_CLOEXEC and SOCK_NONBLOCK set. Worked pretty well for its intended use case.

https://github.com/sebcat/yans/blob/master/drivers/freebsd/t... https://github.com/sebcat/yans/blob/master/drivers/freebsd/t...

sebcaton I reverse engineered McDonalds’ internal API

Quip worth thinking about[1] from the twitter thread[2]:

> it's incredible to me that a $5 digital ocean box can serve traffic for 200k unique visitors and yet there's startups out there who deploy their landing pages with kubectl

[1] IMO [2] https://twitter.com/rashiq/status/1319462542163496960

sebcaton Releasing software to the fleet far too quickly broke stuff

> making it hard to do the wrong thing" is more or less my entire design ethos when it comes to software, particularly developer tools.

See also poka-yoke: https://en.m.wikipedia.org/wiki/Poka-yoke

sebcaton Apple engineer killed in Tesla crash had previously complained about autopilot

The exposure time and the dynamic range of the sensor affects the visibility of the person in that video - it is very likely that a non-distracted human would have performed better.

The vehicle was equipped with both radar and lidar. The victim was detected as an unknown object six seconds prior to impact, and at 1.3 seconds prior to impact when the victim entered the road the system determined that emergency braking by the driver was required, however the (distracted) driver was not alerted of this.

sebcaton Ask HN: What has your work taught you that other people don't realize?

My SO and I recently bought a house with a garden and some trees (pine, spruce, poplar, beech, one apple tree), at the outskirts of a village, close to the woods.

Working on the house has so far given me a lot of satisfaction (also some stress and shorter days). Any work we do on the house is work done for us. We can't do everything ourselves. We hired an electrician (a friend) to do some electrical work and got a company to do floor grinding in one of the rooms. Her father helped us oiling the floor, my father helped us when we redid the insulation in a part of the house (still ongoing). We planted some garlic and some raspberries. We're going to plant some strawberries soon (not really the right season, but we got them for free).

Working on your own house and garden could be an alternative to a career change if you feel the need to work with your hands.

sebcaton Wasm3 – A high performance WebAssembly interpreter in C

AVR32 with JEM does this to some extent for Java.

http://ww1.microchip.com/downloads/en/devicedoc/doc32000.pdf

  3.   Java Extension Module
  The AVR32 architecture can optionally support execution of Java bytecodes by including a JavaExtension Module (JEM).
  This support is included with minimal hardware overhead.

EDIT: Not by implementing the ISA verbatim, but still neat though

sebcaton Kotlin vs. Java

Had this happen in production in a third party library we used many moons ago. Sysop came and asked us why we did six figure DNS lookups over a short period of time (24h? Less? Don't remember).

Would probably have gone unoticed at most AWS/GCP/Azure shops today.

sebcaton How to Buy a Private Jet

https://aviation-safety.net/wikibase/220512

Beechcraft Bonanza A36TC

sebcaton The Factorization of RSA-240

Tcl (libtommath): https://tio.run/##DY85akMBEEOv8utUGmnWswRXxp0L4wUCIWf/mVLD6E...

sebcaton Burned-Out Flash Trips Up Older Teslas

Why are logs (which I assume is not something the car needs in order to function) written to the same eMMC as the firmware?

sebcaton Sweden's 100 explosions this year: what's going on?

> These areas will have to be bulldozed down and rebuilt IMO

They did that in the 60s-70s with a part of Malmö, an area called Lugnet. That area was improved because of the gentrification that followed. The people who used to live in Lugnet (mostly working class) moved out to newly built areas further out from the city center (Rosengård for example). Those areas are problematic today.

sebcaton Software Architecture Is Overrated, Clear and Simple Design Is Underrated

Data Flow Diagrams as described in "Structured Analysis and System Specification" (Tom DeMarco) are lightweight and provides a common way to describe a system with a focus on the flow of data.

The book also goes into detail on how to apply it. e.g., the value of having simple diagrams and have separate diagrams to break down the more complex processes in detail.

It's not rocket science, but I have found it helpful in the past to communicate ideas or existing designs.

sebcaton Ask HN: Read any good books lately?

150 pages into The Fountainhead at the moment. So far, I can highly recommend it.

sebcaton Create FreeBSD Current OpenStack Image on OVH Public Cloud

It's possible to build FreeBSD images for amd64 with nginx and a small but fairly complete base build at about 70 MB by just tweaking src.conf and a MINIMAL kernel with virtio built in. I do this for virtualization on DO, Vultr and my own bhyve machine. YMMV.

sebcaton The Horror of Microsoft Teams

No one is asking ”What’s Microsoft?” though.

sebcaton Dwindling CPAN Releases

Perl is a prerequisite for Autoconf as well (not for the generated configure scripts though, thankfully). It would be nice to not have that dependency.

sebcaton A2-class microSD cards offer no better performance for the Raspberry Pi

Heat and power (think PoE class) are other constraints to take into consideration.

sebcaton The C standard library function atexit is broken

What if the OS could map a shared object that resides in one section of memory into the virtual address space of multiple processes?

sebcaton Love It or Hate It, Java Continues to Evolve

Especially on 32-bit JVMs. Still have nightmares.

sebcaton REST and GraphQL framework to build API-driven projects

PHP-FIG brought PHP back to life from my point of view.

sebcaton Free Public Transport in Estonia

Is it free even if you have to pay for it?

sebcaton Efficient IO with io_uring [pdf]

> One aspect was that get_user_pages doesn't give you a linear block of memory. I wrote the grotty C code to dequeue messages from the non-linearly-mapped circular buffer. The message headers could straddle page boundaries, so I copied those out into temporaries before working with them. I think there was some attempt to avoid making unnecessary copies of the bulk data.

Open question: would it have helped to have a CMA[1] region managed by a kernel module and mapping that memory/regions of that memory to user-space using remap_pfn_range[2] instead?

[1] CMA documentation file: https://lwn.net/Articles/396707/

[2] https://www.kernel.org/doc/htmldocs/kernel-api/API-remap-pfn...

sebcaton Writing Exploit-Resistant Code with OpenBSD

Reposting this from the other day: https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/

Paper: https://www.cl.cam.ac.uk/research/security/ctsrd/pdfs/201406...

"Motivated by contemporary security challenges, we reevaluate and refine capability-based addressing for the RISC era. We present CHERI, a hybrid capability model that extends the 64-bit MIPS ISA with byte-granularity memory protection."

sebcaton Some Were Meant for C (2017) [pdf]

The BERI CPU, the CHERI ISA and CheriBSD has an interesting approach to this, where they have capability-based addressing at the pointer level, supported by hardware.

https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/

sebcaton Application-Level Logging Best Practices

Another best practice: Please do not use logging as an excuse to avoid implementing proper error propagation in libraries or utility code.

Bad:

  void something_failable(void *data) {
    if (!is_valid(data)) {
      log_err("invalid data"); 
    }
    
    /* ... */
  }

Less bad:

  int something_failable(xxx_t *ctx, void *data) {
    if (!is_valid(data)) {
      return xxx_err(ctx, "invalid data"); 
    }
    
    /* ... */
  }

sebcaton Building Fast Interpreters in Rust

> Before making this in Rust we experimented with a Go and also a Lua implementation

Lua or LuaJIT?

sebcaton What should go into the C++ standard library (2018)

I like the absence of a package manager at the language level and the embracing of shared objects and stable ABIs by using the OS package manager. Missing a library? Just install it, and list it as a dependency in the .spec-file, or whatever packaging system you use.

sebcaton Best Startups to Work for in Stockholm

> Sweden has a major problem with housing, so you can forget renting an apartment in a major city — you will spend roughly 18 years on a waiting list to be able to rent anything in the centre of Gothenburg. This isn't hyperbole.

You can forget a first hand contract from the municipal housing agencies. Second hand contracts and/or private landlords still work - but watch out for scams.

sebcaton Moving from Go to PHP Again

> It doesn't sound like they were using MultiViews at all but some rewrite rule that rerouted all requests ending in .srv to a shell script in /bin

The request to a.srv (in their example) was only authorized because a request to /index.html/a.srv looked like a request to /index.html to the auth module because the auth module did not check PATH_INFO. The request was then passed to the ssid daemon (not shell script) over a UNIX socket.

a.srv ended up in PATH_INFO because index.html existed.

The developer(s) of the auth module only checked SCRIPT_NAME and index.html was valid for unauthed users.

sebcaton Moving from Go to PHP Again

Caveat: there are cases where this behavior has resulted in vulnerabilities. e.g., CVE-2018-10661[1]. So if you ever want to implement your own auth module in apache httpd you should be aware of this.

[1] https://www.vdoo.com/blog/vdoo-discovers-significant-vulnera...