nyrikki

10 ms·

61.
by nyrikki 5mo ago
Orcas Slicer is a fork of Bambu Studio, which is a fork of PrusaSlicer, itself a descendant of Slic3r. Orca Slicer was forked to improve usability and features, not to get around any cloud printing requirements, Bamboo added those later and
62.
by nyrikki 5mo ago
1) the various projects refused even simple requests like allowing the admin to disable the —privileged flag, in the rootfull days. 2) The choice to break out CRI will zero authorization or mutations at the CRI level, while understandable t
63.
by nyrikki 5mo ago
Zig is a middle ground. It solves some of the common foot-guns in C, Without the costs of affine substructural typing that offers Rust its super powers. I am of the opinion that it is horses for courses and not a universal better propositi
64.
by nyrikki 5mo ago
It is a minimal improvement due to the introduction of user namespaces and the fallout from local team convenience for Docker and thus OCI. It is very important that you realize that any capability is a slice of superuser privileges, and th
65.
by nyrikki 5mo ago
Namespaces _may_ result in limits on what you can do with a capability, but a capability is global in scope. If a kernel feature is gated on cap_sys_admin only, it doesn't matter at all what namespace it is in. Namespace support or ad
66.
by nyrikki 5mo ago
The original from SGI back in the mid 90's, before CPUs had RDRAND instructions etc... was a an actually practical solution. At the time I was at the Internet company that originally got online-gaming banned in the US, we were looking
67.
by nyrikki 6mo ago
We are probably closer than you think, and SMBs have zero leverage. The point is not avoiding vendors or duplicating everything. The point is designing systems so the software/platform never becomes the point of control. A self-hosted,
68.
by nyrikki 6mo ago
While patch[0] has problems, the issue here is not that it is undocumented. Git recently added this doc on roundtripping, and the problem is with git. Any line that is of the form: * three-dashes and end-of-line, or * a lin
69.
by nyrikki 6mo ago
To start, I want to be clear I am trying to understand not criticizing, and mistakes are how institutional knowledge grows. Your last paragraph hints at retention struggles which complicates the issue. But was vendor mitigation not part of
70.
by nyrikki 6mo ago
You aren't running it during an external transitive failure that happened on April 15th. The problem isn't the happy path, the problem is when things fail, and that linux, in particular made it really hard to reliably disable [0]
71.
by nyrikki 6mo ago
It is hard to cover decades of politics in one post on here, but rather than the IAB being in an ivory tower, at least for the first 15 years, I think it was ruled by inertia that was changing, and suffering a bit from The Mythical Man Mont
72.
by nyrikki 6mo ago
> AAAA records have lower priority than A records if you don't have a v6 address assigned on your system. (Link-locals don't count for this). There is an expired 6man draft that explains some of the issues here. https:/&#
73.
by nyrikki 6mo ago
In fact, 30 years later, I just had to add a IPv6 block on Ubuntu’s apt mirrors this week, because the aaaa record query has higher priority and was timing out on my CI, killing build times. That behavior is due to the same politics mention
74.
by nyrikki 6mo ago
Everyone forgets that the Internet Architecture Board took a religious view on "Internet transparency and the end-to-end principle" which was counter to the realities of limited tooling and actual site maintainers needs. [0] There
75.
by nyrikki 6mo ago
I can't comment directly on LXC but LXC is very different from runc/crun/your-CRI here, not better or worse, just different. With podman, unfortunately we don't k8s Container Storage Interface (CSI), so you have to work
76.
by nyrikki 6mo ago
Not really s3, and I haven't touched LXC in a long but this may help on the OCI side. I apologize if this is redundant to you. Remember that UID mapping on namespaces is just a facade with an offset and a range typically based on subu
77.
by nyrikki 6mo ago
Parallelism can be tricky and always has a cost, but don't discount the 3090 which is more expensive these days in that price bracket. 3090 llama.cpp (container in VM) unsloth/Qwen3.6-35B-A3B-GGUF:UD-Q4_K_XL 105 t/s
78.
by nyrikki 6mo ago
Lots of ways to establish a persistent presence with a short time life key, especially if it is in env or a file it is trivial to find. In theory the Linux kernel keyring would help here, even with a tsm or in conjunction with it. Unfortuna
79.
by nyrikki 6mo ago
More concrete info here. Container: # ps -ef UID PID PPID C STIME TTY TIME CMD root 1 0 0 Apr11 ? 00:15:32 ./llama-server -hf... Host: UID PID PPID C STI
80.
by nyrikki 6mo ago
Chalk an cheese, Wavelength Division Multiplexing took out Globalcrossing Worldcom etc… But the secondary market that grew out of it was because once it is in the ground it has a long lifespan and low upkeep costs, this is not the same thin
81.
by nyrikki 6mo ago
While it does increase the risk of Container to Host Escalation, that is not the largest problem. In the K8s world you should expect the kubelet or any containers, regardless of namespace to be open to data leakages and there may be c2 conf
82.
by nyrikki 6mo ago
There is a reason we don’t allow corvids to choose if a person gets a medical treatment or not.
83.
by nyrikki 6mo ago
> Run services in the tightest possible DAC/MAC sandbox with minimal caps. That is what os dangerous, especially with containers where people run with the container root with elevated privileges. With ollama, llama.cpp, and many oth
84.
by nyrikki 6mo ago
SDKs and Binary format descriptors are where I see agents failing the most, they are typically acceptable for the happy path but fail at the edge cases. As an example I have been fighting with agents re-writing or removing guard clauses and
85.
by nyrikki 6mo ago
The Automation bias issue is something that has been raised by many people like myself but mostly ignored. The better models get the worse that problem with get, but IMHO the implications of the claims are not on the code generation side. T
86.
by nyrikki 7mo ago
It is an observability issue, even zabbix tracked reserve space and inodes 20 years ago. Will dedupe,compression,sparse files you simply don’t track utilization by clients view, which is what du does. The concrete implementation is what mat
87.
by nyrikki 7mo ago
Came here to say this X-Accel-Redirect (Nginx sendfile), if supported by Haskell is the way, it is zero copy and will dramatically help in many cases. If you are modifying the body is one of the cases where it doesn’t work.
88.
by nyrikki 7mo ago
XFS, Ext4, btrfs etc… all support sparse files, so any app can cause problems you can try it with: dd if=/dev/zero of=sparse_file.img bs=1M count=0 seek=1024 If you add conv=sparse to the dd command with a smaller block
89.
by nyrikki 7mo ago
> The agent inside the container runs with bypassPermissions — it can use Bash, write files, do whatever it wants. But "whatever it wants" is constrained by what the OS lets it see. No application-level permission checks needed
90.
by nyrikki 7mo ago
The linked to blog post in the OP explains this better IMHO [0]: If the data stream encodes values with byte order B, then the algorithm to decode the value on computer with byte order C should be about B, not about the relationship be

More ›