q3k

74 ms·

751.
by q3k 6y ago
But the image [1], once built, is still idempotent. You can deploy it and it will always contain the same configuration and code. Meanwhile, a month-long Ubuntu VM that has received regular CM pushes (including system updates) will likely
752.
by q3k 6y ago
On the other hand, VMs are wasteful resource-wise (and $$$-wise) and have a much larger operational overhead (suddenly for every deployment you have a different Linux installation, with its own root /, with its own configuration drift,
753.
by q3k 6y ago
How is it technical debt? How else do you handle software rollout and rollback, or canarying? Do you have a VM for every single version of your software?
754.
by q3k 6y ago
How do you handle multiple versions of the same project/software/deployment on the same machine?
755.
by q3k 6y ago
If you want a library and not a fully-fledged raft-backed KV daemon/service, there's also dragonboat [1]. [1] - https://github.com/lni/dragonboat
756.
by q3k 6y ago
NixOS with amdgpu. Works really well.
757.
by q3k 6y ago
> and we also are exploring using TPM remote attestation I can already tell this is very likely not going to work fully, or even work for a sizeable chunk of Linux installations out there. Many platforms don't have TPMs, or have TPM
758.
by q3k 6y ago
4 CRs stacked on eachother in Gerrit. It's that one killer feature of Gerrit that you cannot live without in other systems once you realize how powerful it is. Phabricator's Differential also does this, but it's comparatively
759.
by q3k 6y ago
> For some reason, it feels really unsatisfying to a lot of people to conduct an extensive code review, and come up with exactly zero items to change. You should fix that instead of trying to hack around this. Code review shouldn't
760.
by q3k 6y ago
Good post. For a longer, more prose-like read that raises the general same points and expand upon them, see Google's 'How to do a code review' [1]. [1] - https://google.github.io/eng-practices/review&#x2F
761.
by q3k 6y ago
Depends what you mean by hobbyist. PCIe-capable FPGAs are getting cheaper and cheaper, and there are plenty of devboards in a PCIe card form factor, just bring your own bitstream and I/O. Hell, you might be able to use the open source
762.
by q3k 6y ago
The 'standard' one is containerd.
763.
by q3k 6y ago
To me it seems like all of modern streaming media (what's on Netflix, HBO, ...) basically collapsed to be this amorphous blob that mostly hits the same stylistic and emotional notes, regardless of genre. I might be getting old/jad
764.
by q3k 6y ago
Same. For all the supposed great shows and films out there, I watched a total of zero minutes of TV or films this year - down from dozens/hundreds of hours last year.
765.
by q3k 6y ago
> And in some cases, researchers may need to avoid reporting that exploit to Apple in order to keep using it. And this will continue to happen until Apple just starts selling the damn things to anyone who wants them, instead of trying to
766.
by q3k 6y ago
By 'wanting to prove something', he caused the vendor to act urgently, instead of sweeping this as a maybe-exploitable-maybe-not bug that would get lazily patched whenever. By 'wanting to prove something', he showed the
767.
by q3k 6y ago
The article explains bypassing exactly this (PA/PAC). > Vulnerability discovery remains a fairly linear function of time invested. Defeating mitigations remains a matter of building a sufficiently powerful weird machine. Concretely,
768.
by q3k 6y ago
I didn't meant to discourage from playing CTFs, I just became jaded by seeing the same kind of heap feng shui tasks over and over and over again :). You know, the note-management linked list task with a simple CLI menu. Not to mention
769.
by q3k 6y ago
These are just phones that you are officially permitted to attach a root shell and kernel debugger to, like to any other device that's not an iPhone. Researchers have been working around that for years by using private jailbreaks &#x2F
770.
by q3k 6y ago
Who do you think the customers of ZDI, Zerodium, Azimuth and others are?
771.
by q3k 6y ago
Check out LiveOverflow on YT. Maybe play some CTFs, but don't do that super seriously, just enough to get you hooked on binary exploitation. They're fun, especially if you find some teammates to cooperate with. And then just, well
772.
by q3k 6y ago
As much as I like to bash security critical code written in memory-unsafe languages, I don't think that this is the crux of the problem here. To me it's that this extremely trivial bug (the heap overflow, let's ignore the res
773.
by q3k 6y ago
The research would've been much shorter if Apple would actually provide researchers with debug symbols. Or you know, if Apple open sourced their security-critical software. > One of the most time-consuming tasks of this whole projec
774.
by q3k 6y ago
> After a day or so of analysis and reversing I realize that yes, this is in fact another exploitable zero-day in AWDL. This is the third, also reachable in the default configuration of iOS. Holy shit.
775.
by q3k 6y ago
> I don't actually know what an intent flow is! Sorry, I might've made that up :). What I meant is that stracktraces do not necessarily reflect the actual code path that the error was caused by (eg. with deferals to internal wo
776.
by q3k 6y ago
Production outage at 2am.
777.
by q3k 6y ago
Absolutely. I'm not saying exceptions are bad and harmful, I'm saying that exceptions aren't an automatic solution to good error handling.
778.
by q3k 6y ago
How does this work if I use SNAFU and so does a library I call?
779.
by q3k 6y ago
You can't always have actionable context, because generally if you could, you wouldn't throw the error in the first place. :) I mean, apart from the obvious 'database connection failed, check that it's up'. Troubles
780.
by q3k 6y ago
One of my longest and most frustrating debugging sessions was with a Java project where some developer was fed up with 100-line stack traces and wrote the following: catch (Exception e) { log.error(e); } Which caused t

More ›