lima

89 ms·

961.
by lima 7y ago
Kudos for not deaggregating routes into /24s like many other major ISPs do nowadays.
962.
by lima 7y ago
Thank you! CloudFlare's response is appropriate. The incident itself and lack of response (for HOURS) from Verizon's side is absolutely unacceptable. It's 2019, filtering ALL of your customer's routes according to - at l
963.
by lima 7y ago
With QUIC, even TCP is getting replaced because of the need to innovate despite protocol ossification. It's almost impossible to improve TCP at this point due to non-compliant endpoints and middleboxes. It's a similar "lowest
964.
by lima 7y ago
And Chromium's crosvm. Rust is a perfect fit for that particular task (writing a VMM). I would be surprised if there was widespread usage of it, though. Rust chose a whole different set of tradeoffs than Go.
965.
by lima 7y ago
Be aware of web browsers though.
966.
by lima 7y ago
gVisor has unsafe modes of operation, too. What I'm saying is that this is not a good example of "Container breakout", as it was just a misconfiguration, not an exploit. "people are extremely creative and will find ways
967.
by lima 7y ago
gVisor is a special kind of hypervisor, basically - it has a production-ready KVM backend. The main difficulties with VM-backend containers are storage passthrough and memory overcommit.
968.
by lima 7y ago
> Here is a good example of someone who broke out of a container on the play-with-docker.com site using a custom kernel module [4]. This allowed a container escape but you could say this was a bug since that wasn't the intent. So,
969.
by lima 7y ago
They're working on it, though.
970.
by lima 7y ago
They do have a (customized) UEFI BIOS based on CoreBoot.
971.
by lima 7y ago
Yes - for security reasons. Chrome OS has a full verified boot chain, starting from the BIOS, like a smartphone. You cannot tamper with Chrome OS or access user data without password even with physical access to the device. None of this wor
972.
by lima 7y ago
Still waiting for a Golang ORM as awesome as Python's SQLAlchemy. I like the code generation approach of SQLBoiler: https://github.com/volatiletech/sqlboiler
973.
by lima 7y ago
Yes
974.
by lima 7y ago
TimescaleDB confuses me. Postgres is an OLTP database and their disk storage format is uncompressed and not particularly effective. By clever sharding, you can work around the performance issues somewhat but it'll never be as efficient
975.
by lima 7y ago
The article is clear on it being allowed.
976.
by lima 7y ago
As you say, it goes both ways. Many kernel vulnerabilities are found and fixed within weeks to months of introducing them, with LTS distros totally unaffected. And then you have bugs being fixed on master (sometimes silently), and the backp
977.
by lima 7y ago
Most things on RHEL 7 aren't ancient - there's plenty of backports, even major ones. Some examples: - OpenSSL rebase to 1.0.2k (for HTTP/2 support). - overlayfs2 kernel support. - Kernel eBPF instrumentation. - Introduction o
978.
by lima 7y ago
Nice. I'm currently building an operator and this comes in handy. Quick question: how do I differentiate between freely available and subscription-only containers on the Red Hat Registry?
979.
by lima 7y ago
If anything, CentOS 8 will be faster since they won't have to deal with a big migration this time. IBM has zero incentive to interfere with CentOS, it's the best advertising for RHEL they can get.
980.
by lima 7y ago
Exactly, and with App Streams you won't be stuck on an old Python version! This is an awesome feature. You already have that on CentOS/RHEL 7 with Software Collections, and App Streams make it a first-class citizen.
981.
by lima 7y ago
Exactly right. I don't understand all those teams reinventing the wheel building custom k8s distributions, rather than using something like OpenShift and focusing on their core business. Running custom k8s in production is the 2019 equ
982.
by lima 7y ago
The point is that with native HA, it doesn't have to be distributed storage. You can use locally attached SSDs or NVMe drives, which are straight forward to manage and fast.
983.
by lima 7y ago
It has the same API as k8s. It's literally the same thing, OpenShift just adds some PaaS feature on top of k8s.
984.
by lima 7y ago
OpenShift is a superset of k8s, so you're free to customize it (you just won't get support if it breaks).
985.
by lima 7y ago
If you have a well-built and automated bare-metal deployment, it's no harder than switching cloud providers. At the scale where it makes sense to go bare metal, either would be a lot of effort. An extra abstraction layer like k8s makes
986.
by lima 7y ago
How is that related to bare metal vs. clouds? That could have happened on either.
987.
by lima 7y ago
Anecdotal evidence. I've also seen colleagues spend weeks arguing with AWS support while debugging a weird performance degradation issue, that would have been straight-forward to investigate in a bare metal deployment with full control
988.
by lima 7y ago
In many environments, you don't actually need distributed storage: - Application servers are stateless. - All state lives in stateful databases. - Those database handle high availability at the application layer by replication data, so
989.
by lima 8y ago
Competition is good and I didn't know IBM had a bare metal offering. (you might want to put some sort of contact method in your profile in case people want to reach out to you)
990.
by lima 8y ago
The litmus test is "will it survive if Google pulls the plug on it?", and I suspect the answer is "No". But this is true of so many widely used open source projects.

More ›