paulfurtado

11 ms·

61.
by paulfurtado 5y ago
Yes, all of this is definitely true and I'm not actually complaining about it, I have used arch on all my machines for 7 or 8 years and don't plan to change that anytime soon, but these problems are actually unique to using arch a
62.
by paulfurtado 5y ago
I use arch on all my machines and there are really a lot of ways it has broken. - Arch will release a new version of Xorg before the graphics card vendors release new drivers that are compatible with it. Same for kernel versions too. - I&#x
63.
by paulfurtado 5y ago
There are a lot of low level algorithms that benefit from custom allocators which allow them to take advantage of SIMD instructions. Haven't used rust in a long time, but back in school I called out to the c++ fftw library from rust, w
64.
by paulfurtado 5y ago
Is UPX actually that much slower than extracting a gzipped docker layer? I didn't realize UPX decompression was much slower than other compression algorithms
65.
by paulfurtado 5y ago
The other use case is to distribute images more quickly over the network and improve image pull times, at the expense of slightly more memory use. Similar to how saving disk is less useful to most people these days, RAM on servers in big do
66.
by paulfurtado 5y ago
UPX does significantly more compression on binaries than gzip can on the layers. It's not just simple compression, it makes a lot of modifications to the binary to make it more compressible.
67.
by paulfurtado 5y ago
Definitely important to note, I wonder if upx could solve this via execing an memfd_create in some mode. Also wish upx came with a trivial extraction tool so you could use it for distribution but not runtime.
68.
by paulfurtado 5y ago
It definitely is, although a cool thing about busybox is that you can rebuild it with any applets disabled. I'm not sure just how small it can get though. But yeah, the tradeoff of that 1MB is that you get a very functional shell envir
69.
by paulfurtado 5y ago
FWIW, if you wanted to get the static from-scratch go image a lot smaller, try running the binary through UPX. It typically improves compiled go binary sizes by absurd amounts: https://upx.github.io/ Also, https:/&#x2
70.
by paulfurtado 6y ago
dnsmasq doesn't do authority checks so unfortunately an external cname to a .internal name may not resolve correctly if the upstream server gives back "additional data" containing the A record answer for the target .internal
71.
by paulfurtado 6y ago
By large amount of memory, I meant systems that have large amounts of memory that is nearly full. For example, a server with 256GB of memory and 255.9GB in use. SSH is purely in memory, however, in order to allocate memory for it, linux wil
72.
by paulfurtado 6y ago
I'd imagine that in a shell context, most of your FDs would be closed on exec unless explicitly passed. That said, why not use env vars which tell the child process what to expect on which file descriptor numbers? Depending how crazy y
73.
by paulfurtado 6y ago
If you have a large amount of memory, are doing decent amounts of IO, and linux OOMs, the system becomes unresponsive for many minutes before killing any process. At which point, ssh sessions timeout endlessly. A serial console stands a cha
74.
by paulfurtado 6y ago
Do servers really catch on fire nearly daily at this scale?
75.
by paulfurtado 6y ago
I'm surprised it's using fuse-overlayfs instead of the overlay2 driver. Is it that you're using rootless containers in production? For rootful containers I think you'd have the same experience as docker here (or at least
76.
by paulfurtado 6y ago
A zone transfer or grep really isn't so terrible, even for someone who doesn't know much about dns it's just a quick memorized dig away. HTTP or grpc aren't really better CLI UX and if this is your infra you can just wri
77.
by paulfurtado 6y ago
If you have significant infrastructure in multiple cloud providers, colocation facilities, etc then it's very possible you want to keep your OS and configuration management systems consistent between all of them. Amazon linux also come
78.
by paulfurtado 6y ago
I wonder if these can easily run linux AMIs. Since OSX doesn't have native containerization, our CI system for mac builds runs linux on mac minis and runs osx VMs inside of linux since you're allowed to run osx vms on linux if lin
79.
by paulfurtado 6y ago
If you add -XX:+AlwaysPreTouch to the JVM arguments, the JVM will pre-touch the entirety of the heap at startup time to avoid unpredictable page faults through the life of the application. I'd imagine other HFT companies may also pay f
80.
by paulfurtado 6y ago
That article is about broken container filesystems, as in, the root filesystem of the container, but that filesystem is not where you would ever store the data of a database. In kubernetes/eks you would use a PersistentVolumeClaim with
81.
by paulfurtado 6y ago
If the docker container was running with something other than --net=host, it could have been avoided easily with standard networking concepts (route tables with reverse path filtering or iptables rules), even if the attacker somehow managed
82.
by paulfurtado 6y ago
crun is actually a project that competes with runc. runc (run container) is implemented in go, and crun is a mostly drop-in reimplementation of it in C that is more faster and simpler, it's currently gaining traction in rhel/cento
83.
by paulfurtado 6y ago
To run 64 bit VMs, you always needed to turn on hardware virtualization in the bios. To configure kvm, all you need to do is "modprobe kvm" if it isn't already loaded. At that point, everything else is user-space and 100% of
84.
by paulfurtado 6y ago
It'd definitely be a harder sell for third party software to require a privileged container and /dev/kvm mounted when you run it in your environment, especially since nested virtualization is largely unavailable in AWS. It a
85.
by paulfurtado 6y ago
If you have container orchestration in place, being able to use it to run VMs via qemu is actually incredibly useful and isn't really much of a yikes. Sure, you're losing the container's isolation features, but you have a VM
86.
by paulfurtado 6y ago
This actually exists in Racket and the DrRacket IDE for it. You could actually even use images as variable names, so back in school there was a funny lesson where the professor used the image of a sailboat as a variable name everywhere and
87.
by paulfurtado 7y ago
It's pretty atypical to upgrade to the latest mainline linux kernel the day the kernel is released. Most distributions take time to pick up a new kernel and make it part of a major distribution release that is subject to more testing.
88.
by paulfurtado 7y ago
Does anyone know of a generic way to detect that letsencrypt will revoke a certificates soon? The goal would be to have our automation automatically rotate the certificates when similar issues occur in the future.
89.
by paulfurtado 7y ago
MySQL has multiple Unicode character sets. The one named "utf8" doesn't support all of utf8, but utf8mb4 supports it all.
90.
by paulfurtado 7y ago
If the language's sqlite bindings don't offer a way to load a database from a string, if you're on a modern linux kernel (3.17+) you can make use of the memfd_create syscall: it creates an anonymous memory-backed file descrip

More ›