ahmedtd

6 ms·

1.
by ahmedtd 5d ago
> I don't get why they to restore the RAM of the agent env. Maybe to fully optimize resumption. Idk, I don't have that much RAM in my homelab, my agents use a ton, testing stuff in Chromium making screenshots for me. I can&#x27
2.
by ahmedtd 5d ago
Agent Substrate was built to provide a few (important) things over Agent Sandbox: * More efficient usage of compute by timeslicing agents (Substrate Actors), which requires fast suspend and resume (using gVisor or cloud-hypervisor snapshots
3.
by ahmedtd 5d ago
Substrate is in the process of being donated to the CNCF as a vendor-neutral common ground (similar to K8s). (The agent-substrate org is currently Google's, but that will change).
4.
by ahmedtd 5d ago
Agent Substrate is solving this - similar to K8s, Substrate is an OIDC (and also SPIFFE) IDP. Credentials containing the actor's identity can be injected into outbound requests using the Substrate egress gateway. (This is work in flig
5.
Kubernetes v1.37: Pod Certificates and Cluster Trust Bundles(kubernetes.io)
3 points by ahmedtd 26d ago|0 comments
6.
by ahmedtd 4mo ago
From the article, it doesn't seem like Go is trying to re-encode strings? Go is saying (correctly, IMO) that a UTF8String field in the Issuer is not the same as a PrintableString field in the Subject.
7.
Agent Substrate(github.com)
2 points by ahmedtd 4mo ago|0 comments
8.
by ahmedtd 7mo ago
Stock grants (RSUs, like Google gives out) are taxed as ordinary income at the moment they vest. If you sell them immediately, then you don't pay any additional capital gains tax, because there were no capital gains from the moment you
9.
by ahmedtd 7mo ago
American laws also have universal jurisdiction (for example, the Bill of Rights doesn't say, "unless you are located outside the US"). Most countries do not explicitly recognize that their laws do not have universal jurisdi
10.
by ahmedtd 8mo ago
I don't think this is true. It's something that could be useful, with some sort of ACME-like automated issuance, but should definitely be issued from a non-WebPKI certificate authority.
11.
by ahmedtd 8mo ago
If that's all you want to accomplish, you don't need WebPKI. Just generate a private key and a self-signed certificate. (This is basically how Let's Encrypt / ACME accounts work)
12.
by ahmedtd 8mo ago
Can you link your PRs here? Kubernetes is such a huge project that there are few reviewers who would feel comfortable signing off an an arbitrary PR in a part of the codebase they are not very familiar with. It's more like Linux, where
13.
by ahmedtd 9mo ago
I have exactly the same two problems, haha. I wonder why they seem unable to fix them.
14.
by ahmedtd 1y ago
Sam Altman skipped any attempt to prove his own statements right, so...
15.
by ahmedtd 1y ago
It's not enabled by default, but you can --- gRPC Reflection: * https://github.com/grpc/grpc-java/blob/master/documentation/... * https://grpc.io/docs/guides/reflectio
16.
by ahmedtd 1y ago
Various pieces support pieces for pod to pod mTLS are slowly being brought into the main Kubernetes project. Take a look at https://github.com/kubernetes/enhancements/tree/master/keps/... , which is
17.
by ahmedtd 1y ago
From the sync.Pool documentation: > If the Pool holds the only reference when this happens, the item might be deallocated. Conceptually, the pool is holding a weak pointer to the items inside it. The GC is free to clean them up if it wa
18.
by ahmedtd 2y ago
If they are using multitenant Docker / containerd containers with no additional sandboxing, then yes, then it's only a matter of time and attacker interest before a cross-tenant compromise occurs.
19.
by ahmedtd 2y ago
GKE does ship with both Ingress and Gateway controllers integrated, they set up GCP load balancers with optional automatic TLS certificates. I think you need to flip a flag on the cluster object to enable the Gateway controller.
20.
by ahmedtd 2y ago
That page seems to be a community wiki, and I think the original authors are somewhat confused on that point. If you salt and hash the password on the client side, how is the server going to verify the password. Everything I can think of e
21.
by ahmedtd 3y ago
In Washington, cyclists can treat stop signs as yield signs, as long as there is no other traffic approaching the intersection. Obviously, though, if you almost hit a pedestrian then you aren't properly yielding.
22.
by ahmedtd 3y ago
Related (though not a sator square). A while back I made an implementation of 5x5 word squares, following an example from Knuth: https://row-major.net/articles/2020-05-12-interactive-word-s...
23.
by ahmedtd 3y ago
Disclosure: I work in GCP engineering, thoughts are my own and not Google's, etc. My impression is that Anthos is probably not what you need if your use case is deployment of a managed product into customer GCP projects (or AWS accoun
24.
by ahmedtd 4y ago
Don't the bits come off the wire one at a time at the server as well? Any ability to read() from multiple sockets coming over the same interface is enabled by the kernel reading the data serially and placing it in buffers.
25.
by ahmedtd 4y ago
Not when the counter overflows back to 0. If it's a 3 bit counter, 0 is A again, not C.
26.
by ahmedtd 4y ago
Not really the point of your comment, but... The GKE equivalent of EKS IRSA is GKE Workload Identity. It's pretty much the same user experience: * Enable Workload Identity on your cluster * Create a GCP service account * Grant your Kub
27.
by ahmedtd 4y ago
I'm pretty sure v2 and v1 functions are totally separate. If you run `gcloud functions list --log-http`, you can see that gcloud makes separate calls to the v2 and v1 apis in order to present a unified list of all functions.
28.
What GKE users need to know about Kubernetes' new service account tokens(cloud.google.com)
2 points by ahmedtd 4y ago|0 comments
29.
by ahmedtd 4y ago
www.row-major.net
30.
by ahmedtd 5y ago
You don't pop the min, you pop the top of the stack.

More ›