HNHacker News
TopNewBestAskShowJobs

throwaway20371

331 karma · joined September 7, 2021

submissionscomments
throwaway20371··on Let's Encrypt API v2 Service Disruption (12 Sep 2021)
I completely agree that scheduling has to be controlled by the customer (you) and having more context on the change helps. In AWS I can schedule the maintenance windows, and I know if it's because it's a major version bump or a patch, and I can talk to support if I'm concerned.

For me the major consideration is getting away from toil so I can spend time improving things that will move the needle. If somebody else can do a half-decent job, and there's a backup plan in case things go wrong, please somebody else do it for me!

throwaway20371··on I Got a 'Mild' Breakthrough Case
First, it's not forever. Over time, when we know more about the virus and it changes more, there will probably be less-severe variants where we can mostly rely on vaccination.

Second, there are plenty of ways you can mitigate the need for masks and social distancing with people that you know. Just like you don't need to use condoms with a monogamous partner that you trust, you don't need to wear masks around vaccinated people that use masks and social distance around people they don't know.

Third, you're not sorry. You're going to get people killed and continue to hurt the economy (and people who depend on it) because you can't stand to put a piece of cloth on your face for 5 minutes, stand back a bit from someone, or eat outside. You're freaking out and being childish because you personally don't care about the consequences, while ignoring the consequences for everyone else. It's the same as people who refused to wear condoms during the AIDS crisis because "they're not normal".

throwaway20371··on I Got a 'Mild' Breakthrough Case
......? Herd immunity is herd immunity. It doesn't matter what caused it.

Natural immunity is great, but most people clearly don't have and won't get natural immunity. Having had COVID-19 already also does not make you later immune, to any variant. You can get it again and spread it again. https://health.clevelandclinic.org/can-you-get-covid-19-more...

throwaway20371··on Adam Smith and Inequality (2014)
Well nobody has ever succeeded in doing a lot of things that haven't been done yet. But more to the point, we have to define a rich economy, and inequality.

Is a rich economy just a bigger economy than most? Or an economy with surplus? Or an economy with lots of value (and then we define value)?

Is inequality some people having less money than others? Or not having as much stuff? Or privileges? Or not being able to self-sustain? Or unequal social treatment?

I think the more important questions come from fully understanding what we want and how we're trying to get it. If all we care about is that some people have more than others, we will literally be fucked for eternity. But if instead what we care about is that everyone can eat food and live somewhere without struggling to do it, we can achieve that in probably many kinds of economies, but the economy obviously has to be set up to be sustainable in the face of that requirement.

A lot of economies are just shitty regardless of how they're set up, for the same reason that a lot of humans don't have the same privileges, even though they're made of the same meat.

throwaway20371··on Let's Encrypt API v2 Service Disruption (12 Sep 2021)
Sure, but there's different levels of complexity, risk, cost, recovery with different services. And it depends on your design. If you do go with a NoSQL distributed DB, I would absolutely push the maintenance off to cloud hosting; that shit is a nightmare to do yourself. RDBMS you can totally do yourself, but if you're not really great at DBA/infra/etc and it's the lynchpin for your service, will you really do a better job than a dedicated cloud hosting team?
throwaway20371··on Let's Encrypt API v2 Service Disruption (12 Sep 2021)
I'm not an expert, and I'm not saying they're doing it wrong.

But for what it's worth, just because they thought for a long time doesn't mean they made the right choices. Some of their design decisions have been not great. You can still create perfectly valid domain certs for domains you don't control with a variety of common attacks. Then there was the ACME API vulns. Either they knew about all this and chose a simpler design that's more flawed on purpose, or all that thinking just didn't end up being correct.

throwaway20371··on Let's Encrypt API v2 Service Disruption (12 Sep 2021)
"Database performance is the single most critical factor in our ability to scale while meeting service level objectives."

Ah, that's unfortunate. It's hard to get RDBMS reliability/performance "right" in the face of changes, and scaling it isn't easy. But at least all the problems are well-known.

throwaway20371··on I Got a 'Mild' Breakthrough Case
> Covid is no different.

Covid-19 is literally a neurological disease. It causes the body to attack itself, like an autoimmune disease, which is what is leading to the incredibly high number of severe cases leading to death. And all of the long-term, quality-of-life-impacting side-effects that have nothing to do with respiratory viruses.

This has been reported for over a year.

> It’s life. There are no guarantees.

There's no guarantee you will get AIDS Or HepC if you have unprotected sex. Time to throw away the rubbers, we can't stop living life now can we?

Oh, wait. You can still fuck with rubbers. I guess you don't have to choose between not fucking or getting AIDS.

Just like you don't have to choose between being a hermit and making out with a dozen strangers at a bar. These things called "masks" are there to reduce risk without forcing us to stop living life.

throwaway20371··on Let's Encrypt API v2 Service Disruption (12 Sep 2021)
I think the OP was referencing this: https://letsencrypt.status.io/pages/history/55957a99e800baa4...

   September 12, 2021 20:30 UTC
      Service disruption
   
   September 12, 2021 05:39 UTC
      Production planned maintenance
   
   September 12, 2021 02:33 UTC
      Degraded API and OCSP Performance
And then you see this planned maintenace for the 20th:

   September 20, 2021 16:30 - 17:00 UTC
      API Database Maintenance
I'm curious what kind of database and maintenance. The one useful thing about Cloud-managed NoSQL databases is the potential for zero-downtime maintenance. Making it stable enough is a hercluean task for the Cloud provider, but the customer never has to think about it.
throwaway20371··on I Got a 'Mild' Breakthrough Case
And I want to be able to climb a mountain, drink alcohol, taste pizza, and live past age 70. All of those things can go out the window with a severe case of COVID-19, and potentially even with an asymptomatic case, due to the long-term effects of scarring on multiple organs, and unknown long-term neurological effects.

I know humans always prioritize short-term goals over long-term. But personally, I am fine with wearing a mask or staying in for a year, to ensure my health for the next 70 years.

I also wear condoms when having sex with strangers. Crazy, I know, but somehow getting a lifelong disease just doesn't seem worth the momentary pleasure.

All you have to do is listen to the stories of young people who are now on a breathing machine for life. If that doesn't scare the fucking bejesus out of you, I don't know what will.

throwaway20371··on I Got a 'Mild' Breakthrough Case
Five reasons why COVID herd immunity is probably impossible https://www.nature.com/articles/d41586-021-00728-2

Here’s why herd immunity from Covid is ‘mythical’ with the delta variant https://www.cnbc.com/2021/08/12/herd-immunity-is-mythical-wi...

The developer of the AstraZeneca shot says the Delta variant has made herd immunity impossible because vaccinated people can still transmit the virus https://www.businessinsider.com/delta-variant-made-herd-immu...

throwaway20371··on Why is IRC distributed across multiple servers?
> The most basic case is if there's absolutely no method of exchanging information from point A to point B. Then agents at A and B will not be able to communicate. That's it.

That's not it. The most basic case is if there's no linearizeability between A and B. A and B can continue communicating but fail the C in CAP if linearizeability fails. Hence we shouldn't compare everything to CAP.

throwaway20371··on Why is IRC distributed across multiple servers?
I'm pretty sure even back then you could edit the hard-coded limit in the source code and recompile. I remember us doing something like this as it was too expensive to just keep buying servers and our apps were connection-happy.
throwaway20371··on Why is IRC distributed across multiple servers?
> "netsplits" exist in every distributed system, be it a chat app or a database, it's just the CAP theorem

Well let's not get carried away. Network partitions happen everywhere, but everything is not about the CAP theorem. CAP theorem is a very specific model that a lot of apps (even ACID databases) don't conform with. Comparing IRC to CAP theorem is like comparing it to ACID and saying, "IRC decided to sacrifice transaction integrity".

IRC didn't explicitly sacrifice the C in CAP, they designed a simple server protocol. They could have added a bunch of weirdness to hide splits from users, but it would have been unnecessarily complicated and not contributed significantly to the user experience.

throwaway20371··on Why is IRC distributed across multiple servers?
Why are Linux distributions hosted on multiple mirror servers that they don't own?

1) money 2) availability 3) trust 4) security

1) If you don't have a lot of money, you take the servers you can get. Donated mirrors means you don't have to pay the bandwidth or hosting bills.

2) If you have multiple servers, it's less likely that one server going down will tank your project. When GitHub, AWS, or even Level3 has an outage, Linux distros keep on chugging like nothing happened. Traditional server maintenance is also easier when everyone can just switch to a different server.

3) Maintainers can use their PGP keys to create signed packages and downloads. Their public keys are distributed on mirrors, as well as embedded in the downloads they've signed. Once downloaded by users, the distribution can verify its own integrity. But how does the user know they started with the real maintainers' public key? The public key is distributed on a hundred geographically-distributed servers all owned by different people; the user can check them all. So other than compromising a maintainer's key, it's logistically impossible to compromise end-user security. (this one is more Linux-specific than IRC-specific)

4) If you only have one server & it gets compromised, it can be hard to tell. By comparing its operating state to the other servers, you can sometimes more quickly identify the compromise. And if you do find a compromise, you can remove the compromised server quickly, close the hole on the other servers, and start regenerating keys. It's an eventuality every large project should be prepared for, and IRC servers do get compromised. Linux mirrors don't matter in this regard, but the build servers etc do matter.

IRC comes from the same time and place, and has some (but not all) of the same considerations.

throwaway20371··on We still believe in private offices (2015)
There is nothing more you need to know about what your company thinks of you than how much personal and communal space they provide. Cubicles and a tiny kitchen? Do your work and shut up. Open office with elbows touching your neighbors, but a common area the size of a 747? Do your work with "constant collaboration" from your "peers" who never shut up. Agile / hot-desks? Don't even think about having a personality that the Company hasn't issued you.
throwaway20371··on Sayings of Spartan women
Speaking specifically of Greeks and Romans. And in general, Ancient peoples did not consider slaves to be as animals, but American slave-owners often held the belief that they were sub-human and not more than talking beasts.

There was a class of Mycenaean slave that was close to a free man, who could own land and have status.

Greek slaves could be involved in every economic activity except politics. Slaves were bankers, craftsmen and tradespeople. Male slaves might be personal assistants, shield makers, cutlers, bedmakers, while female slaves would be textile weavers and bakers. Not only were slaves not seen as denegerate inferiors, they were expected to be able to take over their masters' business when needed. Some of the most famous and respected philosophers were slaves.

Slaves could earn wages, and use those wages to pay a fee to live and work alone, and even use their savings (or loans/gifts) to buy their freedom. Cretian slaves could own a house and livestock and pass it down to their family, which was also granted the same familial laws as freedmen.

Debt slavery was common until it was abolished; people basically could become serfs until they paid off their debts, and then become free again. Some slavery was limited to a period of time, and slaves had rights / could be involved in legal disputes, and so win freedom or other rewards.

Roman slaves perhaps were treated worse than Greek originally, and many more of them were used for agricultural labor, probably putting their experiences on par with American slaves. But as the Roman empire progressed, slaves gained many more rights.

https://en.wikipedia.org/wiki/Slavery_in_ancient_Greece https://en.wikipedia.org/wiki/Slavery_in_ancient_Rome

Worth nothing also that a lot of Spartan "historical information" is more myth and bullshit than evidence-based. Spartans were masters of propaganda. Helots may have been treated like shit, but apparently a lot of the reputation was inflated or made up by later historical writers.

Helots could also be craftspeople, own land, raise crops, keep money, buy their freedom. They maintained family units and were less often dispersed than Greek slaves. Helot children born of Spartan citizen fathers would become members of the army as an intermediate rank.

https://en.wikipedia.org/wiki/Helots

throwaway20371··on Sayings of Spartan women
> Another interesting bit was how it's historically rare for slave-owning societies to have more than 50% of their population enslaved

Probably worth noting, then, that in 1860, South Carolina and Mississippi had over 50% population enslaved, and four more states over 40% population enslaved.

Considering that American-owned slaves were treated much crueler on average than Ancient slave populations, I'm curious whether Spartans were more or less like Americans in this regard. A glorious empire built on brutality and moral superiority.

throwaway20371··on Apple’s effort to court ‘ethical’ hackers draws poor reviews
Yes, if the robber is a baron.
throwaway20371··on Apple’s effort to court ‘ethical’ hackers draws poor reviews
Society's mores are pretty fungible. Who'da thunk that half of society would be fine with killing people if the alternative is sometimes wearing a paper mask and getting an injection?
throwaway20371··on Apple’s effort to court ‘ethical’ hackers draws poor reviews
If I'm a hacker and I have an Apple 0-day, why the hell would I report it to Apple if I can quickly get a tidy payment on the black market?
throwaway20371··on GitHub Actions limitations and gotchas
> migrate every engineering team at Venmo to GitHub Actions

Oh jesus christ. I feel for you dude.

We evaluated GHA, and we still are trying to use it, but there is a barrage of problems and limitations, including cost, lack of functionality, and technical issues. It's really only suitable (at scale) for linting, or generating Changelogs, or something else trivial. I use it in my OSS projects to run tests, and it's okay for that (though impossible to just tail a build log when it's large)

Drone.io is still an amazingly effective system that matches GHA (and has _crazy_ features like build parameters) but is more flexible. Of course you'll have to pay for commercial licenses, but if it's between paying for GHA or Drone, I highly recommend Drone instead. Drone is stupidly easy to maintain (infrastructure-wise).

throwaway20371··on How Docker broke in half
The ironic thing is that Docker became successful only because of the tremendous hype they generated about themselves, and then failed to see the K8s hype train barreling towards them.

Swarm is still what 99% of companies need when they adopt Kubernetes, and is probably 1/10th to 1/20th the cost. Somebody needs to re-invent swarm as an independent project so that we can stop investing in K8s. The cost of K8s isn't even in the complexity, it's in all the millions of side-effects of the complexity, like security, fragmentation, and specialization.

throwaway20371··on 20 years after 9/11: Will we ever stop taking our shoes off at airports?
I don't have to take my shoes off airports. A govt contractor looked at my birth certificate and driver's license and charged me $78, and then gave me a special number to put on my boarding pass. Now a man at security gives me a little red flag that says I don't have to take my shoes off.

Honestly, I don't know why everyone doesn't pay for TSA PreCheck and GlobalEntry.

throwaway20371··on No Starttls
STARTTLS and its ilk are what happens when technology companies (& their minions) are pussies. It has been clear for decades that secure e-mail transport would be a good idea, but not if we had to actually upgrade software / systems to get it. This bullshit is so endemic that Google Mail has actually released two new standards in 2019, that depend on two other protocol stacks, just to advertise to SMTP servers that they support secure mail.

Thankfully, in 2018 someone had the balls to release RFC8314, which explicitly obsoletes cleartext for MUA <-> MSS <-> MAS mail. So why did Google release standards in 2019 that presume that some servers still won't talk TLS? My guess is they're terrified someone won't send them mail, and they'd lose some of that sweet sweet analytics money.

We clearly have an endemic problem in our technology culture related to breaking changes in order to fix shit. This is going to keep happening, unless we come up with new industry principles and practices to enforce breaking upgrades of legacy systems. If your system doesn't have a sunset date of less than 8 years, it should be considered broken out of the box. If it doesn't expect major feature overhaul after 4 years, it should be abandoned in favor of a system that does. Not having zero-downtime upgrades and rollbacks should be a non-starter too. Basically we need a "12 factor app" for protocols and systems.

throwaway20371··on My £4 a month server can handle 4.2M requests a day
Software has become slower and less efficient because we have faster hardware to run it on and nobody's asking for the software to get more efficient. Back in the day you had inefficient, expensive hardware with limited software. There was demand to make software as performant as possible so it didn't cost you ten grand to serve a popular website. But now you can load up on hardware for pennies on what it used to cost. 16 cores? Sure! 32 gigs of ram? No sweat. Software can now be bloated and slow and it won't break the bank. On top of that, we now have free CDNs, free TLS certs, even free cloud hosting, and domains are a couple bucks. You can serve traffic for free today that would have cost $50K 15 years ago.

Sometimes there's also a misunderstanding of metrics that leads devs to not think about performance tuning. Like, "4.2M requests a day" is clearly incorrect at this 50rps benchmark. Traffic is not linear, it's bursty. You will never serve 50rps of human traffic steadily for 24 hours. If you're serving 4.2M requests per day, 90% of it will be in a 12 hour window, peaking at whenever people have lunch or get off work, with a short steep climb leading to a longer tail. So to not crash your site at peak visitorship, you realistically need to handle 300+ rps in order to achieve 4.2M requests per day. (But also that's requests per second... if under load it takes 5 seconds to load your site, you can still serve a larger amount of traffic, it's just slower... so a different benchmark is also "how many requests before the server literally falls over")

throwaway20371··on My £4 a month server can handle 4.2M requests a day
You can also handle 50 requests per second on a 66MHz 486DX2 with 16MB of RAM and a 10Mbit/s network card. Not with modern "I have infinite resources" software, but we used to handle more than that traffic regularly in the early 90s.
← PreviousPage 2 of 2