catern

37 ms·

331.
by catern 8y ago
Are you sure about that? I just googled "gentoo vs code" and the ebuilds I saw appear to download the precompiled binaries.
332.
by catern 8y ago
Hmm, I was excited to see a former Midori developer working on a "cloud development platform". And I was even more excited to read: >Using Pulumi, you author cloud programs using your favorite language, spanning low-level infra
333.
by catern 8y ago
There's an easier way than using dconf dump twice and looking at the diff: You can use dconf watch. http://catern.com/2014/12/21/plain-text-configuration-gnome....
334.
by catern 8y ago
It's not necessarily a good thing for the container to be able to specify locale. Locale should be picked up from the surrounding system; it's just that unfortunately the surrounding system is usually not configured correctly. And
335.
by catern 8y ago
>Types that don't actually do any constraining are useless. Exactly! I can make CartId/ProductId/WhateverId types that are just wrappers around String. But that's not actually using the type system to enforce correct
336.
by catern 8y ago
I'd go further than saying "doing actions against an id is a shortcut". I say it's an antipattern. Ids should only ever exist at the edge of your system: When you're taking serialized data in and turning it into obj
337.
by catern 8y ago
The OP states that BPF is replacing nftables as if it was a foregone conclusion, but it's not at all certain - it's still far from happening.
338.
by catern 8y ago
>An eBPF program could respond to every system call a process makes, allowing behaviour like OpenBSD's pledge, only much more sophisticated. That is actually one of the oldest and most widespread uses of BPF :) https://ww
339.
by catern 8y ago
>Effect systems are good when all you want to do is write code that has effects. Monads are not really about effects, although they can be used to describe certain classes of them. Monads are nevertheless, strictly more powerful. This is
340.
by catern 8y ago
Since I see that some of the developers are in this thread, I'll post my question to them here. What are your plans to deal with the overhead and nastiness of ptrace? Beyond the performance losses, there's also the annoyance that
341.
by catern 9y ago
Just curious, not trying to trip you up: In your perspective, would it be trespassing to make a new website which has links to the original site with the edited URLs, without actually accessing those edited URLs? If such a website with link
342.
by catern 9y ago
That's fine. If global optimization turns out to be significant, we can do it at the edge with overlay networks. No need for network operators to be involved.
343.
by catern 9y ago
That's pretty bad. It's been known for decades on other Unix systems that you shouldn't pass passwords by command line parameter, or even support doing so. I guess no-one told Apple.
344.
by catern 9y ago
Raising the abstraction level of the ISA and making more logic part of proprietary CPU microcode is exactly the wrong direction to go in for security. I'm not sure how the authors can possibly claim this will be beneficial for security
345.
by catern 9y ago
Sorry, I didn't mean bind mount, I mean union mount, like with OverlayFS or whatever the most-used one is.
346.
by catern 9y ago
Hmmmm, interesting... That does seem like a pretty good reason, though maybe you could bind mount over /nix? That should be fine from a Nix perspective, not sure how well it works with container technologies.
347.
by catern 9y ago
It might be related to using a different Nix prefix for your builds, which is a little poorly supported. Just curious: Why are you using a different prefix?
348.
by catern 9y ago
From a technological standpoint, it's easy to pin the channel. It's as simple as creating a file like this in your project: https://github.com/catern/nix-utils/blob/master/pkgs.nix And importin
349.
by catern 9y ago
>If my frequently given answer teaches anything it at least teaches not to assume that these things work, or how they work. ("systemd is (I assume) ...") Even reading the current source code is not enough. The systemd people ha
350.
by catern 9y ago
You might be interested in https://github.com/catern/supervise which does provide job-like behavior, using PR_SET_CHILD_SUBREPAER. I haven't written it down in that repo, but I believe that it exits in finite time
351.
by catern 9y ago
>monopolizing a system resource (e.g. IOPS or network bandwidth) People have been placing ulimits on users to limit their resource usage for decades, using cgroups to do it is not a novel concept, just more effective. >rogue problems
352.
by catern 9y ago
It depends on your definition of "container". The popular Docker-style container is substantially heavier than "just a process"; it creates cgroups, bind mounts things, creates new pid/user/mount/etc names
353.
by catern 9y ago
catern@home ~ $ { timeout 1 sh -c 'while :; do /bin/echo foo; done'; echo; } | wc -l 1542 So at least sub-millisecond. And this is less efficient than possible because it's also writing to a pipe. Also
354.
by catern 9y ago
You gain on isolation with Zerg (and other "VM per request" things) but you lose on everything else compared to CGI with processes. But you can reach comparable levels of isolation with processes: just use Linux namespaces.
355.
by catern 9y ago
Yes, all this "container per request" or "unikernel per request" stuff is essentially the same as what everyone was doing 20 years ago with basic CGI. But this stuff also has far worse performance than CGI's "p
356.
by catern 9y ago
So there's no advantage other than getting through broken middleboxes?
357.
by catern 9y ago
This has absolutely nothing to do with my comment or with reproducible builds. Flatpak does absolutely nothing to help reproducible builds. That's just a statement of fact: It works at a different level of the stack, and solves a diffe
358.
by catern 9y ago
Nix allows you to perfectly reproduce the on-disk inputs going in to a build, and also completely isolate the build by heavily sandboxing it. But build processes, being a large and complicated function, may not give you bit-for-bit identi
359.
by catern 9y ago
Yes, both of those would work. The "service with an API" approach dodges the GPL by keeping the client and server separated in separate processes or even separate servers, which is fine. (The AGPL was created as a stronger version
360.
by catern 9y ago
What communities/projects do this?

More ›