q3k

21 ms·

331.
by q3k 2y ago
I've been experimenting with k8s and/or running it on prod basically since the initial release, and I've so far only had one workload-affecting bug. The bug caused the scheduler to get stuck meaning pods assigned to nodes kep
332.
by q3k 2y ago
Not that easy with HSTS.
333.
by q3k 2y ago
A certain (free) operating system (just a hobby, won't be big and professional like gnu) for 386(486) AT clones.
334.
by q3k 2y ago
There's Starlark... ...and CUE, and Jsonnet... ...and probably no-one wants to see BCL/GCL see the light of day :)
335.
by q3k 2y ago
Some people have an unhealthy obsession over the tiniest, most insignificant things. In this case it's probably about using U vs V for voltage (U is eg. more commonly taught/used in Europe and is recommended by IEC norm 60050 [1],
336.
by q3k 2y ago
Alternative: write your applications to not depend on the liveness of other services to start up. Your ops will thank you.
337.
Xzbot: Notes, honeypot, and exploit demo for the xz backdoor(github.com)
849 points by q3k 3y ago|469 comments
338.
by q3k 3y ago
> The OP makes it sound like an attacker can send a malicious payload in the pre-auth phase of an SSH session - but why does he say that an exploit might never be available? Surely if we can reverse the code we can write a PoC? Not if pu
339.
by q3k 3y ago
Right, but in this case it's not even compiled it, which is arguably better than compiled in but assumed dormant :) (at least until someone actually does a full analysis of the payload).
340.
by q3k 3y ago
NixOS/Pkgs 23.11 unaffected, unstable contains backdoored implementations (5.6.0, 5.6.1) but their OpenSSH sshd does not seem to link against systemd/liblzma, and the backdoor doesn't get configured in (only happens on .deb&#
341.
by q3k 3y ago
Network policies are currently not implemented. Bring your favourite Ingress controller. We support NodePort services, with plans for a LoadBalancer Service controller given the right network topology (a la MetalLB - either BGP to TOR switc
342.
by q3k 3y ago
We actually provide gVisor as the default runtime for Kubernetes workloads. Monogon OS implements the layers underneath Kubernetes and gVisor - it's the operating system which runs on your nodes/machines and which comes together t
343.
by q3k 3y ago
Hello, I'm one of the contributors to Monogon OS (codename Metropolis). We didn't expect to go public with our project for a few more months, which is why the end-user documentation is still very bare, sorry! But fixing that is so
344.
by q3k 3y ago
It's somewhere in my git stack :). Until I get to publishing it, the proto/gRPC definitions for node management are a good enough start: https://github.com/monogon-dev/monogon/blob/main/metropol
345.
by q3k 3y ago
> And anything they do with the content can be explained away as "necessary to provide the service". That's the problem: they're not constraining themselves in any way. They need money to provide the service, so why c
346.
by q3k 3y ago
> By similar logic, should we imprison all tobacco executives? If it was for me to decide - yes, absolutely.
347.
by q3k 3y ago
Now I'll also do it out of spite! :)
348.
by q3k 3y ago
> Under no circumstances does my engineer brain think this is a good idea. At all. Yeah, if that's the model engineer in the "don't build your own billing system" mantra then the article had the opposite effect on me.
349.
by q3k 3y ago
Try it. When someone complains you can always go back. But they probably won't. It's the same with bullshit meetings. Just decline the invitation and you'll be surprised how little anyone will usually care.
350.
by q3k 3y ago
Yeah, it makes no sense. It's like naming a TV remote 'OpenMicrocontroller'.
351.
by q3k 3y ago
> Till today, I use the "unhackable" iPod Nano 7g. CUB3D recently got code execution on n6g/n7g via a freetype 1day (comex's star vuln/exploit, after using another bug which allowed disabling resource partition c
352.
by q3k 3y ago
The IDE for these PLCs actually has VCS integration! It's SVN, but it's still better than nothing. Its on-disk representation of graphical 61131-3 languages (FBD / SFC) is text-based and somewhat human readable, so there&#x27
353.
by q3k 3y ago
IEC 61131-3
354.
by q3k 3y ago
The main obfuscation was the way IEC 61131-3 constructs get first compiled to C and then to assembly. There's a lot of indirection and zero strings in the resulting code, meaning it's very difficult to actually find whatever logic
355.
by q3k 3y ago
As another coffee nerd I'm happy to realize I wasn't the only one who did a double-take when they first noticed the in-game espresso machines.
356.
by q3k 3y ago
Network level or application level DoS? Those are two vastly different beasts.
357.
by q3k 3y ago
The iPhone SE still starts at 3x the price of a low-tier Samsung smartphone. Example from Poland: https://mediamarkt.pl/telefony-i-smartfony/smartfon-apple-ip... https://mediamarkt.pl/telefony-i-smartfo
358.
by q3k 3y ago
Most of the world simply can't afford an iPhone.
359.
by q3k 3y ago
Yeah, I was very confused by this post. Just the city I live in (Munich) has at least three community-oriented hackerspaces/makerspaces, and a bunch more 'open workshops' and commercial spots. Here's a list of _just_ Cha
360.
by q3k 3y ago
> Which is why I have gotten rid of getaddrinfo() calls in my server code, and rather resolve DNS directly reading the DNS server setting from the system. This works as long as you don't need support for mDNS or LDAP host resolution

More ›