iscoelho

6 ms·

31.
by iscoelho 9mo ago
wireguard-go is indeed very slow. For example, the official WireGuard Mac client uses it, and performance on my M1 Max is CPU capped at 200Mbps. The kernel WireGuard implementation available for Linux is certainly faster, but I would not co
32.
by iscoelho 9mo ago
I have not seen a case where I could not source a Juniper switch (for example) for lower $/port than Mikrotik, even at 400GE. It is unheard of to pay MSRP. YMMV.
33.
by iscoelho 9mo ago
VXLAN is used in cloud/virtualization networks commonly. VM HA/migration becomes trivial with VXLAN. It also replaces L3VPN/VRFs for private networks.
34.
by iscoelho 9mo ago
I don't disagree (: Though there are definitely use cases where it is needed, and it is way easier to implement earlier than later.
35.
by iscoelho 9mo ago
If I can source an enterprise Cisco/Juniper/Arista ASIC switch that is 1) rock-solid 2) full featured 3) cheaper - which I can - there is unfortunately no rationale where Mikrotik would be applicable in any professional project of
36.
by iscoelho 9mo ago
There are also solutions like Arista TunnelSec [1] that can achieve IPsec and VXLANsec at line-rate performance (21.6Tbps per chassis)! This is fairly new and fancy though. [1] https://www.arista.com/assets/data/pd
37.
by iscoelho 9mo ago
Exactly this. I would love to see a commercial product with a hardware implementation for WireGuard, but it does not yet exist. IPsec, however, is well supported.
38.
by iscoelho 9mo ago
At this time, there is no commercial offering for hardware/ASIC WireGuard implementations. The standard WireGuard implementation cannot reach 10G. The fastest I am aware of is VPP (open-source) & Intel QAT [1], which while it is ac
39.
by iscoelho 9mo ago
Any ASIC switch released in the last decade from Cisco/Juniper/Arista supports EVPN/VXLAN in hardware. EVPN is built on BGP. This has become the industry standard for new enterprise and cloud deployments. The lack of support
40.
by iscoelho 9mo ago
EVPN/VXLAN fabrics are becoming industry standard for new deployments. MACSEC/IPsec is industry standard for site-to-site. You'd be surprised to know that this is especially popular in cloud! It's just abstracted away (:
41.
by iscoelho 9mo ago
VXLAN is for L2 between campuses. It is commonly used in enterprise and cloud networks.
42.
by iscoelho 9mo ago
VXLAN over WireGuard is acceptable if you require a shared L2 boundary. IPSec over VXLAN is what I recommend if you are doing 10G or above. There is a much higher performance ceiling than WireGuard with IPSec via hardware firewalls. WireG
43.
by iscoelho 11mo ago
> I'd much prefer they enforce the laws evenly and then fix them where they're broken rather than disadvantaging everyone going through the legal process while those that cheat get to jump ahead. That is incredibly optimistic t
44.
by iscoelho 11mo ago
Your immigration attorney will advise that you overstay. If you do not, your application will be abandoned.
45.
by iscoelho 11mo ago
Negotiating is difficult if you show your hand. It is arguably beneficial to both the state and Elon that the e-mails stay redacted. I agree it is unfortunate though.
46.
by iscoelho 11mo ago
If the result of the negotiations are in good faith and beneficial for his constituents, then it is not corruption. Of course, that's open to interpretation. Corruption is usually when there is personal benefit to the politician themse
47.
by iscoelho 11mo ago
It appears we are not reading the same thread.
48.
by iscoelho 11mo ago
I agree it is a widely used format, however, it is rarely used on iOS devices.
49.
by iscoelho 11mo ago
UAF bugs lead to RCE exploit chains.
50.
by iscoelho 11mo ago
The vulnerability in question is being severely underestimated. There are many other comments in this thread going into detail. UAF = RCE.
51.
by iscoelho 11mo ago
FFMPEG is upset because Google made the exploit public. They preferred that it remained a zero-day until they decided it was a priority. I don't understand how anyone believes that behavior is acceptable.
52.
by iscoelho 11mo ago
It is my understanding that the commenters in FFMPEG's favor believe that Google is doing a disservice by finding these security vulnerabilities, as they require volunteer burden to patch, and that they should either: 1) allow the vuln
53.
by iscoelho 11mo ago
Google is a contributor to FFMPEG.
54.
by iscoelho 11mo ago
I am unsure why this untruth is being continuously parroted. It is false. This is exploitable on a majority of systems as the codec is enabled by default. This is a CVE that is being severely underestimated.
55.
by iscoelho 11mo ago
Google is, at no cost to FFMPEG: 1) dedicating compute resources to continuously fuzzing the entire project 2) dedicating engineering resources to validating the results and creating accurate and well-informed bug reports (in this case, a s
56.
by iscoelho 11mo ago
It’s a reproducible use-after-free in a codec that ships by default with most desktop and server distributions. It can be leveraged in an exploit chain to compromise a system. I'm not a Google fan, but if the maintainers are unable to
57.
by iscoelho 11mo ago
It’s a reproducible use-after-free in a codec that ships by default with most desktop and server distributions. The recent iOS zero-day (CVE-2025-43300) targeted the rarely used DNG image format. How long before this FFMPEG vulnerability is
58.
by iscoelho 1y ago
Hi cindori, I couldn't figure these out without purchasing: 1. Does Backdrop plan to support 5K/6K wallpapers? Those resolutions are pretty standard for Mac workstations. 2. Is functionality similar to TopNotch supported where the
59.
by iscoelho 1y ago
Yes, DNSSEC is designed to prevent DNS MITM via integrity. BGP hijacks lead to MITM. I am not sure where the confusion is.
60.
by iscoelho 1y ago
I agree that the problem lies with BGP and we definitely need a solution. You can also say the problem is with TLS CA verification not being built on a solid foundation. Even with that said, solving those problems will take time, and DNSSEC

More ›