zippie

We run https://github.com/NVIDIA/OpenShell on our workloads and we like it because it is backed by NVIDIA and fits natively within our k8s env.

It also provides a nice TUI for network policy management and prebuilt sandboxes which have claude code, codex, etc.

Circa 2014, my economics mentor, who also mentored me in reading/trading free markets recommended reading Sowell.

We discussed Sowell at length, and my primary take away was that Sowell’s world view was that the individual is much better at improving their own lives than any intervening external factors. All in all, an ardent believer in individual capitalism. That is a high level assessment.

A more nuanced assessment is Sowell (like his mentor, Milton Friedman), is a true to earth anti-Keynesian. Fun fact, he considered himself a Marxist in his 20’s IIRC.

There are lots of anti-Keynesian economists. Though I think what sets Sowell apart is the way he uses widely accessible data to justify every single view on public policy he has, and to make it easy to digest for someone without an economics background (no easy task).

You can find a nice collection of his ideas online [1].

[1] http://www.tsowell.com/

I see this quoted a lot whenever there is discussion of wealth. However, as with all verses, the context is important as well as the follow up verses. This is not in defense of.

17 “Why do you ask me about what is good?” Jesus replied. “There is only One who is good. If you want to enter life, keep the commandments.” “Which ones?” he inquired. Jesus replied, “‘You shall not murder, you shall not commit adultery, you shall not steal, you shall not give false testimony, 19 honor your father and mother,’ and ‘love your neighbor as yourself.’” “All these I have kept,” the young man said. “What do I still lack?” Jesus answered, “If you want to be perfect, go, sell your possessions and give to the poor, and you will have treasure in heaven. Then come, follow me.” When the young man heard this, he went away sad, because he had great wealth. Then Jesus said to his disciples, “Truly I tell you, it is hard for someone who is rich to enter the kingdom of heaven. 24 Again I tell you, it is easier for a camel to go through the eye of a needle than for someone who is rich to enter the kingdom of God.” When the disciples heard this, they were greatly astonished and asked, “Who then can be saved?” Jesus looked at them and said, “With man this is impossible, but with God all things are possible.” Matthew 19:17-26 - https://www.biblegateway.com/passage?search=Matthew%2019:17-...

Would CTRL+X + CTRL+p/l/f be something akin to this? I use these frequently and have been quite content with their ability to provide in context completion.

I’ve been slowly coming around to this. Also there is no reason why something like salt cannot be adopted into the k8s world, it would bring better base image management capabilities by forcing larger organizations into a common image. A common base image would be easier to patch, upgrade, and maintain. Larger k8s deployments tend to not be so great at image management, which is a cost paid in operations dollars that were supposed to be saved by k8s.

What it comes down to is tooling which separates the application enough from the platform where I can move between metal, virtual, and containers without much effort. If this goal is achieved, moving between providers is achieved in tandem.

The GP may seem like sarcasm to some ... sqlite is an overlooked, novel, and faster way (up to 35%!) to store things than the filesystem [0].

You can use something like libsqlfs [1] for POSIX file heuristics with sqlite as the backing store.

One HA single primary/multi-master solution to use sqlite may be drbd.

[0] https://www.sqlite.org/fasterthanfs.html [1] https://github.com/guardianproject/libsqlfs

IPC microbenchmarks do not properly reflect the complex workloads running on post Zen2 microarchitecture. Zen2 upends microarchitecture schematics enough to warrant a different metric.

IPC MB’s, in my experience, tend to benchmark best case scenarios and that is probably the exception rather than the rule for application workloads in modern MA’s. Case in point, microbenchmarks showed significant improvements in IPC for Zen2 in lieu of Skylake yet for the application workload (CPU data bound), Skylake held up neck and neck.

The more appropriate benchmarking metric for post-Zen2 processors is CPI [0].

[0] https://john.e-wilkes.com/papers/2013-EuroSys-CPI2.pdf

Not sure if you were hinting at it already, just in case, you may be interested in the ongoing work with bpfilter [0] which uses ebpf underneath existing xfilter rule interfaces.

[0] https://lwn.net/Articles/747551/

You may want to consider building Streamlit into a standalone binary using Static-X or pex. I use pex for standalone binary distribution of a fairly popular python app [1].

[1] https://github.com/johnj/salt-pex

In modern C libraries malloc is mmap’ed anon pages underneath for an increasingly larger set of conditions these days.

Agree on timing and execution, from my own founding experience, being early is as the same as being wrong.

https://biblia.com/bible/niv/Eccles%209.11

The standardized way of defining what a universal quantum computer is through the DiVicenzo criteria [1].

Quantum annealing is a bridge until we have universal QC, it’s a fairly decent one for optimization problems where the solution set is discrete. I personally think D-wave is a good place to start to wrap ones’ mind around QC and superposition states. IBM Q is great, too.

In many ways, I prefer IBM Q if you are getting into QC for the long haul because many QC concepts such as CNOT, Z, X, Hadamard gates, interaction between quantum registers and classic registers are explicit. D-wave’s API hides quite a bit of what QC is all about, and you have to fit your problem (it has to be adiabatic in nature) into their system. I find this to be rather confusing in the long run.

[1] https://en.m.wikipedia.org/wiki/DiVincenzo%27s_criteria

Same here. I enjoy YouTube Music more lately, which allows you to play any “music video” such as live performances in audio only, and is also included in the subscription.

This is great progress towards making unikernels non-runtime specific.

However, I am still skeptical of the idea that unikernels will ever be production friendly. The biggest deficiency, by the definition of a unikernel, is the complete lack of debugging tools available. There is no top, perf, etc in a unikernel. In docker, I can still exec into a running container to debug and investigate. Unikernel issues lend themselves to “just restart it” rather than “let’s debug and fix it” mindsets.

I’ve run a k8s environment with kata containers for a while and as time has gone on, I’ve found that Solaris Zones (smartOS) are probably the most scalable way to achieve process/VM isolation for applications.

Though the parent mentions AF_XDP can be used in user space, it will require BPF maps to route the queues properly.

If you’re interested in XDP and the like, also check out DPDK (BSD licensed, https://www.dpdk.org).

Hacker News is up for me.

In all seriousness, YouTube music and videos are down for me in California.

Thank you for all the work on GitLab, we are using AutoDevops extensively. Any thoughts on how AD morphs or adapts with knative? It seems like Jenkins is fully knative with CRD support.

This release of NetBSD disables eagerfpu on vulnerable FPU’s.

Often overlooked while discussing performance impact of context switching; context switching also applies to the FPU. There are two modes in which the OS performs FPU context switching: lazy and eager.

“lazy” FPU context switching leaves the previous context on the FPU until a different context gives it a set of instructions. This saves an unload on the FPU, since not all time splices require the FPU, you may see some performance gains under some application workloads.

“Eager” FPU context switching unloads FPU context whenever a time splice is finished. On a new time splice, the FPU context is reloaded. While this constant reloading of context sounds more expensive, it is optimized in hardware and almost never noticeable on modern architectures.

By default eager FPU is enabled in Linux. You can test its’ impact by passing the eagerfpu=on or eagerfpu=off boot flags (Linux).

Kudos to the NetBSD team for enabling/disabling eager FPU based on FPU model instead. This approach makes more sense to me.

While cp may copy over the existing inode, this is non-consequential for running applications as shared objects are certainly compiled with -fPIC.

Application VM pages for these libraries are mapped back into the same physical DRAM pages via the MMU. Every modern OS implementation loads dynamic libraries once and then references the same pages across applications.

On disk pages matter not once the shared object is loaded by the kernel.

I find this solution compared to the gitlab Auto Devops, frankly, underwhelming.

We recently deployed AD in our self hosted gitlab instance and combined the SAST container checks with our production policies, it’s been rock solid.

Add to this the fact we are able to manage all the production policies via the pipeline API’s and AD templates, the whole Jenkinsfiles deal seems far less scalable and difficult.

I have no affiliation with gitlab.

As time has wore on our organization has relied on slack less for team collaboration and more for monitoring.

Admittedly, the slack client is great at cross platform notifications and we leverage those in our monitoring processes, where alerts are sent via zabbix to pagerduty and slack simultaneously via webhooks.

In a real sense the responders have “any activity creates a notification” which enables them to react and others to view a record of what happened. This eliminates the casual “what happened?” conversations.

We’ve yet to have an oncall event fall through the cracks.

Intel's investor call [1] is underway and they are describing the attack vector(s). Rogue data load seems to be most concerning issue according to Intel.

Intel thinks this will need firmware and operating system updates to fully mitigate.

[1] https://www.intc.com/investor-relations/investor-education-a...

Data structures stored in kernel space, such as llds [1], will not incur the overhead of the TLB flush/load.

I suspect that storing data in the kernel space in order to avoid maintaining a large application PD will become the norm, whereas in the past it has been reserved for use cases like search engines with massive in-memory trees.

[1] https://github.com/johnj/llds

This is nice but the agent forwarding is a legitimate concern especially because a compromised host can take off with the private keys which are used while beginning the session. Most private keys are used for more than connecting to a single host.

In our setup we use jailkit allowing only ssh passthrough [1], we have added LDAP support to it (may release the patch later).

[1] http://olivier.sessink.nl/jailkit/howtos_ssh_only.html

A clone is a clone. The main inplementation difference between a thread and process in Linux is COW, for all intensive purposes a worker process and a fork are the same in this use case. Neither have led to scalable web servers.

Process per connection does not scale no matter how light weight, even with COW. kore's connection handling model is the reason apache2 mpm_prefork fell out of favor many iterations ago.

The only valid argument to avoid a single event based I/O is some sort of hard blocking I/O such as disk or non-queuing chardev.

However I'm still not biting, this is solved...and as usual the answer is somewhere in between. For example, in RIBS2 there are two models for connection handling, event loops for connections and "ribbons" for the non-queuing bits [1]. RIBS2 is also written in C for C.

[1] https://github.com/Adaptv/ribs2/blob/master/README

Edit - mention RIBS2 is also written in C

Entering panic mode too fast, according to the chief of the CDC "there was a breach in protocol"[1]

Frankly, this hospital mismanaged the index patient from the beginning and though the woman infected now wasn't on the initial list...the list itself wasn't complete because they didn't properly diagnose the index patient ebola to begin with.

[1] http://www.cbsnews.com/news/cdc-chief-on-second-ebola-case-t...

Nuno Lopes attempted this first using LLVM in 2008:

http://llvm.org/devmtg/2008-08/Lopes_PHP-JIT-InTwoDays.pdf

I think the cost of the garbage collection involved in a JVM implementation vs LLVM significantly outweigh any immediate perceived benefits, especially when you factor in double reference counting anomalies.

Supporting benchmarks that might be interesting alongside the OP:

https://github.com/johnj/llds#wall-timings-in-seconds

Same concept applies, reducing translations for page lookups reduces latency.

A prime example of how to deal with and educate others a vulnerability.

Presumably the bounty was distributed without incident which is worth noting the recent threads of bounties being forfeited.