amscanne

51 ms·

511.
by amscanne 8y ago
An address space provides some hardware isolation. Even if you ignore side channels, there's a lot that can go wrong in the software only case. I'm pretty sure that site isolation as a feature predated Meltdown and Spectre (though
512.
by amscanne 8y ago
Just to be pedantic, Washington was the first state to legalize for recreational use (by 4 days), so Colorado was also following suit ;)
513.
by amscanne 8y ago
Right. I’m very familiar with all these mechanisms, I guess I just don’t agree that the ability to cause an OOM, particularly if applications are isolated in cgroups appropriately, is a big deal. On balance, not allowing applications to use
514.
by amscanne 8y ago
What do you mean by “free” memory? Actually unmap it? Also, I assume the crippling you’re talking about here is just the ability to rapidly apply memory pressure? Otherwise I’m very confused.
515.
by amscanne 8y ago
The article is not accurate. Pre-KPTI, the cost of a system call might have been hundreds of cycles total. On a modern chip, that’s ~50ns. Add kernel code for relevant operation. A read on a pipe might be 500ns total. A read on a cached fil
516.
by amscanne 8y ago
> For whatever reason, smoke just accumulates in the Sound and lingers in the city, even for fires up in Canada. I don't think this is true. You could see maps, and Seattle and the sound happened to be in the path of the smoke at ti
517.
by amscanne 8y ago
From CBP website (FAQ): All current NEXUS members, and U.S. citizens and U.S. lawful permanent residents who are SENTRI members, are eligible to use Global Entry kiosks once they provide fingerprints and document information to CBP. If CBP
518.
by amscanne 8y ago
SENTRI = expedited land crossing at US/Mexico border. NEXUS is the best value IMO. It’s half the price of Global Entry, and _includes_ Global Entry (effectively), PreCheck and SENTRI. The interviews are straight forward and conducted b
519.
by amscanne 8y ago
Actually I think the airlines may still need to pay something, even if you’re formally enrolled. For example, Norwegian Airlines, a discount provider doesn’t “participte” in TSA precheck. So although I’m enrolled, there’s no way to get prec
520.
by amscanne 8y ago
DirtyCOW requires either ptrace or /proc/PID/mem, neither of which are accessible natively via gVisor. Even if they were, the VDSO is isolated, which was a good vector for privilege escalation. I don’t think “locked down name
521.
by amscanne 8y ago
(As requested, I work on this project.) To correct one misconception, the project is not bound to ptrace. There is a generic platform interface, and the repository also includes a KVM-based platform (wherein the Sentry acts as guest kernel
522.
by amscanne 8y ago
KVM is the kernel interface for virtualization features, but the model created (i.e. the emulated hardware or lack thereof) is up to the user space component (normally QEMU). I think your understanding of KVM is tied with a specific impleme
523.
by amscanne 8y ago
Hi! I work on this project. Nothing wrong with a full VM, but I don't think it's a panacea (and you probably shouldn't guarantee security). You may have taken the UML comparison to heart: did you look at the KVM platform? I&#
524.
by amscanne 9y ago
That’s all true for chemistry and physics too, once there’s an understanding of the princples. Yet new chemical compounds are patentable. And software is hardly pure numbers and logic. Many aspects of algorithms (and patents) are related to
525.
by amscanne 9y ago
The “software is math” line of reasoning doesn’t make sense to me. Is it math because numbers and logic are involved? In that sense, chemistry is just as much math, yet new compounds and drugs are readily patentable. Ditto for physics or me
526.
by amscanne 9y ago
github_idea4good is unsigned. There’s an implicit cast at the assignment. The condition is still true and that path is always executed.
527.
by amscanne 9y ago
You know pension funds that spend a material portion of their holdings speculating on currencies? I’m skeptical. Currency trading is zero sum and highly risky. Pension funds may keep small amount as a hedge, but to actively speculate on cur
528.
by amscanne 9y ago
You and your parent comment are describing a kind of hedge, not a material investment. That’s fine but did not seem to be what my parent was implying. Funds may just as well choose to maintain several points in cash (also not a productive a
529.
by amscanne 9y ago
Not consensus, probabilistic consensus. And not 50% of participants, 50% of computing power. Those are critical distinctions.
530.
by amscanne 9y ago
Wow, pension funds should not be doing currency speculation. That's bad. The problem with crypto-_currency_ is that it's not a productive asset. A share of a business pays dividends over time and thus has intrinsic value (and _som
531.
by amscanne 9y ago
There are secondary effects that also make this not a great idea. You may wind up slowing leaking vmas (the kernel needs to track what’s been mapped, even if it doesn’t allocate physical pages). This makes future mmap calls and page faults
532.
by amscanne 9y ago
You realize that the guest OS _does_ things right? It's not just overhead. You can't just remove the Linux network stack, you have to replace it with something. (And the Linux network stack is pretty damned good at what it does.)
533.
by amscanne 9y ago
That's how a regular KVM works as well (mmap a physical memory block) and the mismatch comes from the fact that all the regular OS memory management mechanisms -- reclaim, swap, page cache, etc. -- are all broken by the abstraction pro
534.
by amscanne 9y ago
> Yes, now white supremacists trying to make sure brown people die in the ocean This kind of gross distortion is counterproductive. (Unless your goal is to alienate others and hurt your own credibility.)
535.
by amscanne 9y ago
> The principle is the same. The hospital should not be doing so much as trimming a fingernail of any patient incapable of giving informed consent, in the absence of a true medical necessity. Do you have a child? Would you not trim their
536.
by amscanne 9y ago
> No, this is false. Point me to someone espousing the benefits of the waterfall approach, please. > So does the term "capitalism". Like capitalism, though, the waterfall method was a thing actually in wide use both before (
537.
by amscanne 9y ago
This is very common in Latin American cultures. In Mexico, they literally do it at the hospital before you leave. (They don't do this in the U.S., but a good portion of Latin Americans - I'd wager majority - will get it done at si
538.
by amscanne 9y ago
It's hilarious. It has only existed as a thing to critcize, and the term itself actually originates in a paper describing why it's broken. No one has ever advocated for the "waterfall" approach. The ultimate straw man in
539.
by amscanne 10y ago
I'm only demonstrating that the assertion that increasing marginal rates always means a larger share of the tax burden is put on the rich -- this is not true. The example is given to be demonstrative, not to represent a real world scen
540.
by amscanne 10y ago
Of course it happens. I knew a surgeon who chose to work half days because the marginal gains were not as good as working half days (in Ontario, so his marginal rate was ~50%).

More ›