stephen-mw

This is probably a better thread: https://twitter.com/bmastenbrook/status/1335322652462829568

For those wondering how bad the issue is, check out this[1] screenshot of a diff between the TLS/non-TLS html from www.example.com.

Here's "corrupted" UTF-8 characters expressed as bits. In this example you can see clearly what's happening. The top byte is correct and the second one is corrupted.

    01100111 # g
    01101111 # o

    01110000 # p
    01111000 # x

    01101100 # l
    01100100 # d

    01100101 # e
    01101101 # m

1. https://i.imgur.com/qIMnTTe.png

I think the path to get us there (reshoring chips) would be extremely painful, but it certainly would be a better position for the United States to restore our ability to produce these critical components.

Also, just in time for this research to get off the ground:

>If it all works out, the effect could be to make small groups of engineers capable of feats that would take 100 engineers to achieve today.

https://spectrum.ieee.org/tech-talk/computing/hardware/darpa...

Check out my install script linked earlier. If you already have the GPS unit attached and tested, you could probably be up and running again in a few minutes (make sure to change the GPIO pin in the script to your PPS pin).

I just built one of these. It's fun to have a little computer that can synchronize highly accurate time without an internet connection by listening to things in outer space!

I built an auto-install script that anyone here is welcome to use or reference[1]. If you know what you're doing, just change the GPIO pin to your PPS input and fire away.

Unlike the author I used Chrony instead of NTP. It's lighter-weight and much easier to configure with a PPS/GPS reference clock.

The GPS chip I used was an ATGM336H, which can be had for less than $8 on ebay. I'm able to lock consistently 11 satellites from my desk[2]

Keep in mind the Pi has no hw RTC. If you're doing this for fun spend a few more bucks and buy an rtc chip from ebay so you don't drift considerably between being powered off.

1. https://github.com/stephen-mw/raspberrypi/blob/master/roles/...

2. https://www.ebay.com/sch/i.html?_from=R40&_nkw=ATGM336H&_sac...

That’s funny you say that. One of my pet projects was using google sheets to control SSH access with non-techies. It worked surprisingly well.

https://github.com/stephen-mw/gdoc_ssh_manager/blob/test/REA...

I never published it, but I actually wrote a service that uses google sheets to manage SSH access on your servers. Users simply submit a google form with their SSH key, and it's automatically pulled by a daemon on each host. It comes complete with admin/sudo access toggling.

https://github.com/stephen-mw/gdoc_ssh_manager

Feel free to email. Please provide as much information for reproducing it as possible. Thanks!

Very nice! I see this as the next evolution to the phusion's custom init system[0], which was created to solve largely the same problems.

I should be able to take Yelp's dumb-init and add it easily to any linux container I want -- including things such as Alpine[1]

[0] https://github.com/phusion/baseimage-docker/blob/master/imag... [1] https://github.com/gliderlabs/docker-alpine

If you email me at [redacted] I can forward it to somebody who may be able to help.

> he simply introduced new words into the still-inchoate English language when none seemed to do the trick; Browne is responsible for “hallucination” and “suicide,” along with about a hundred other neologisms.

I'm having a hard time believing there wasn't a translation of the word "suicide" until 1600s. Wasn't suicide all over classical mythology? Wasn't it well known that Cato committed suicide rather than submit to Caesar? How did they describe such things?

My brief reading of the iOS guidelines [0] says this is not allowed:

> 2.25 Apps that display Apps other than your own for purchase or promotion in a manner similar to or confusing with the App Store will be rejected

[0] https://developer.apple.com/app-store/review/guidelines/

Runit is the default system daemon for Phusion's baseimage-docker Ubuntu image[0]. I've used it in a basic manner and have been very happy with it.

For containers it hits a real sweet spot: lightweight and easy to use within a limited scope of processes.

[0] https://github.com/phusion/baseimage-docker

From time to time I think about university apart from academics. I went to a state school and left w/ around $15k in student loan debt, but made some of the best memories of my life.

Those are the kinds of experiences money can never buy you again. No sports car later in life will ever bring you that kind of fulfillment.

Some quick tips for securing SSH:

1. Disable password authentication altogether

2. Create and use keypairs

3. Add an "AllowUsers foo" line to /etc/ssh/sshd_config so that only your user is allowed to SSH

4. Install sshguard or fail2ban and set the ban limit to a week

There are other things you can do, but I find this to be the lowest hanging fruit for the best security.

I very much doubt Apple sells anything at a loss. It's really not their style. Their margins are the envy of the entire industry, and Apple takes home 90% of cell phone profits[0]

The fact that they can create a phone/device with "inferior" tech and sell it at blockbuster margins proves to me that most people aren't interested in specs, but rather the whole experience and ecosystem. This is something Apple understands well and invests heavily in experience.

[0] http://www.cnbc.com/2015/02/09/dominant-apple-takes-90-of-sm...

Some of us prefer this screen size. I'm actually holding off until the 6s to see if they launch a model with a small screen.

I found iterm2 to be my most-missed piece of software when switching to linux desktop. Terminator just doesn't compare with ease-of-use, look, and feel. Gnome terminal is nice but lacks some of the rich features.

Why not just use AWS? Seems like you went from bad to slightly better.

There's no reason to fear virtualization, and the automation is definitely one of the best aspects of running in a major cloud.

I think the H1B program is great when it works, and I've seen it function because I've worked with some amazing and talented workers from countries such as India, Spain, France, etc. I really felt like we nabbed the best people from those countries. For these engineers, the US should be stapling green cards to the backs of their pay checks.

The problem here is that this group of workers is clearly being hired only because they provide a steep discount to local talent. This has nothing to do with skill, and in fact usually the engineers who take these positions are low-skilled. Think about it, who else would take a steep pay cut, work unreasonable hours, and take on a supervisor who threatens deportation on them?

For every H1B we hire in this category we make it harder to bring and keep a skilled worker. They don't fit the mould of disposable and cheap labor, so they don't get sponsorship. They refuse to take a pay cut just because they're a foreigner, and rightly so.

Unfortunately that's simply not the same. Python libraries many times still require header files to be present, which means on a host you want to install PyOpenSSL you must also install libssl-dev, which means you also much install python-dev... etc etc. Don't get me started on using gevent.

A container is the only sane way to package a python service, but that's not _nearly_ as convenient as a statically compiled binary.

I checked this out when it was part of Stripe. I found it worked very well for my limited use-cases.

Personally I just prefer python and boto for most of my AWS tools, but times where I've switched to go is to take advantage of static compiling and concurrency:

1. Listing all of my AWS instances in all accounts in all regions (lots of api calls!) 2. Downloading/uploading large files via multipart API 3. Various server-side configurations

When using something like LXD I can barely tell the difference.

It's funny you mention this. Myself (and a quite few other Bay Area people) were at the filming for this film at the De Anza theater. Everyone was so bored and desperate to be on camera that they were cheering at the top of their lungs and flaying their arms about every time the camera turned on.

I remember thinking how absurd it was, but we were all bored so what the heck!

The site looks good. I feel that the devops world is hungry for a _full_ replacement of graphite/zabbix/reimann, etc, but the pricing hasn't been appealing enough for the best tools.

Per-host pricing schemes punish large installations and engineers who've created services that run on small, horizontally scaling instances.

In the end most of us end up with some wacky combination of different services.

AWS is the best in the game and you pay a little extra for it. If you ask me I think it's worth it.

I wouldn't waste a single cycles migrating to another cloud providing to save a little money. In the end it simply won't be worth the time and you'll miss running on AWS's mature platform.

Instead, I would focus on getting your app working perfectly within linux containers. Use some existing tools such as swarm, CoreOS, or Tutum[0]. Once you have your app properly containerized, you'll be able to quickly move between clouds or even utilize multiple clouds (provided you have the time or experience to maintain the network).

The only way you'll save significant money is if you're willing to put up the resources to run your own prem, and I would strongly discourage you from doing that.

[0] https://www.tutum.co/

I like LXD a lot, but it's simply too new to rally behind it fully. You have to backport it to Ubuntu 14.04 if you even want to run it on an LTS operating system.

That being said, I think Canonical has good vision and will execute. LXD combines the best from old and new school.

I think Flockport is doing some amazing things. When I read the pagerduty bug-hunt post and saw that they were using ipsec between "hosts", I wondered if perhaps they used LXD with some of your services.

Without a doubt use Docker. It has the ecosystem, which is extremely important. It also has the support and community.

For devops engineers looking to build an entire enterprise around containers, LXD will be a great option when it reaches maturity and its ecosystem matures. It's not there yet, and probably won't be for a few years.

Another great company that's doing extremely cool things with LXC minus Docker is Flockport[0]

[0] http://www.flockport.com/