majke

16 ms·

151.
by majke 4y ago
Author here, I know this is a dismissive comment, but I'll bite anyway. As far as I understand the history of the IP protocol, initially an IP address pointed to a host. (/etc/hosts file seems that way) Then it was realized a
152.
by majke 4y ago
Ha, I guess this is one way of summarizing it :) Author here. I wanted to share more subtleties of the design, but maybe I failed. Indeed, the starting point is sharing IP's across servers with port-ranges. But there is more: * awesome
153.
by majke 4y ago
Worth debugging. Please email me at marek at cloudflare dot com
154.
by majke 4y ago
Ok, so you are talking about rowhammer. Let me try to put this in my own words. https://people.freebsd.org/~lstewart/articles/cpumemory.pdf DRAM is using hardware technology that is hard. Each dram bit can be addr
155.
by majke 4y ago
I'll bite. Neither. Both. Depending on system. When the "state" is large, or changes often, obviously you can't send full state every time - that would be too much for end-nodes to process on every event. Both cpu - dese
156.
by majke 4y ago
(a) is it the same phased array antenna as dishy v2? (b) is power usage improved? at 90 Watts dishy v2 is not perfect for an RV. (c) dishy v2 has pretty slow startup time. It might be less than perfect if that thing required 10 minutes of u
157.
by majke 4y ago
A mandatory comment that reducing random memory fetches is often way more important to perf than O() cost. Random memory read costs a lot. https://blog.cloudflare.com/when-bloom-filters-dont-bloom/
158.
by majke 4y ago
Cloudflare's core asset is the trust. Sure, it's possible to capitalize on that, but then the game is over. I think everyone is aware of that.
159.
by majke 4y ago
This is funny. Cloudflare ddos systems were named: Gatekeeper, gatesetter, gatebot, floodgate, gatewatch :)
160.
by majke 4y ago
> If everyone were on-board with what Cloudflare wants, the Internet would be... You got me lost here. Cloudflare is making money by having everyone re-centralized around it? Where is the revenue from?
161.
by majke 4y ago
> Although terminating the encryption was necessary to inspect the traffic and effectively mitigate the attack, the use of HTTP Pipelining required Google to complete relatively few TLS handshakes. Ouch. I mean, congrats for allowing att
162.
by majke 4y ago
“In a few years, datacenter networks will grow an order of magnitude from 40Gb to 400Gb. Systems researchers, including myself, have been preparing for this new world for almost a decade [1,2]. Demikernel is the first fully-featured nanosec
163.
by majke 4y ago
Shameless plug https://blog.cloudflare.com/when-the-window-is-not-fully-ope... I recently wrote a piece about specifically this mechanism (though looked from the receiver side). Basically on linux you can work around this i
164.
by majke 4y ago
> which I don't think is possible to achieve with tc alone. How you do it with tc: - set up dedicated network namespacel, with veth configured well - the veth on host should do forwarding and NAT/masquerade - Add TC either on v
165.
When TCP sockets refuse to die(blog.cloudflare.com)
4 points by majke 4y ago|0 comments
166.
by majke 4y ago
Here's what my colleagues think about unpriviledged namespaces: https://blog.cloudflare.com/live-patch-security-vulnerabilit...
167.
by majke 4y ago
Hey Siri. Tell @dang to put [1983] in brackets heree. I love the "pay attention" command :)
168.
by majke 4y ago
Thanks @wmf @dahart for the discussion. You are both right: - I can't just buy 3080 and stuff it into my servers due to legal. - I can't just buy 3080 and stuff it into my servers due to availability. - Often (as the example I giv
169.
by majke 4y ago
In my humble opinon there just isn't much point to use GPGPU for normal computing. I'll give you an example. https://blog.cloudflare.com/computing-euclidean-distance-on-... during this work I was able to achieve:
170.
by majke 4y ago
Thanks for an awesome explanation. I always thought modern x86 uses IPI (Inter-Processor Interrupts) for that. Is there a benefit of mwait vs IPI?
171.
by majke 4y ago
It's to make sure the result is either value 0 or value 1. Without this, the result could be like 2, and this is not wanted here.
172.
TCP Keepalives and TCP_USER_TIMEOUT socket option explained(blog.cloudflare.com)
7 points by majke 4y ago|0 comments
173.
by majke 5y ago
Thanks!
174.
by majke 5y ago
Somewhat related, if I remember right grsecurity emulated NX bit by abusing the fact that iTLB and dTLB caches are separated. On tlb miss, it hooked code (trap on a page tree walk?) and tried to reverse if it was instruction or data cache m
175.
by majke 5y ago
Earlier today the author: https://twitter.com/pshufb/status/1496376141589921792 > I feel like this is an underrated article. Maybe I'm a bit disappointed because I put lot of effort in writing it. #simd
176.
by majke 5y ago
Before making any change to kernel you need a strong use case description and explanation why it's not possible with current methods. Often, building this case is harder/more time consuming than writing the code itself. This is ki
177.
by majke 5y ago
We set it to max and move on. Also, we monitor to see if there is an application doing something wrong. There never was an issue with a single process eating too many descriptors, and during normal operation it doesn't happen. With TCP
178.
by majke 5y ago
There are multiple problems "kernel bypasses" solves. Generally speaking: (A) prevent kernel from touching data and only operate on metadata (to reduce cache misses/memory bandwidth) (B) in routing situations prevent applicat
179.
by majke 5y ago
On first read this article made little sense to me. Ok, go has GOGC env. Ok, you can tune it based on stuff. Do they tune it live as part of process life or is it pre-comoputed at start? Is gogctuner a library? > As we mentioned above, m
180.
by majke 5y ago
Just a shout out: it's super hard to do it for UDP / QUIC / H3. Beware. (but I don't think nginx supports h3 out of the box yet)

More ›