tytso

37 ms·

241.
by tytso 10y ago
There are tools that get used by maintainers. For example, patchwork is used by many subsystem trees to track patches and the discussion around them. And those developers and maintainers who fix bugs (and who are getting paid for it, as
242.
by tytso 10y ago
The challenge I have with believing that theory is they paid an _awfully_ large sum for just the hardware business.
243.
by tytso 10y ago
The problem comes if the sender has a DMARC reject policy, and he or she sends e-mail to a mailing list which then reflects the mail to a recipient which honors DMARC, the recipient will bounce the e-mail message, and never see it. In some
244.
by tytso 10y ago
The primary problem is that DMARC is fundamentally flawed, and was not enacted using a standards process that respected all of the stakeholders. As a result, it fundamentally becomes a matter of power politics. If there are a bunch of peop
245.
by tytso 10y ago
Make sure you understand the tax implications of your stock options: http://web.mit.edu/tytso/www/OPTIONS-HOWTO/OPTIONS-HOWTO.htm...
246.
by tytso 10y ago
At least in the part of Google where I work (Technical Infrastructure), in general most of the obvious optimizations that can be made at only one level (within the scope of a single programmer, or a single team), have been made long ago.
247.
by tytso 10y ago
Sure, but a lot of these things are things I was doing anyway when I was working for MIT and earning a five figure salary. When I moved out to a startup (VA Linux Systems), I more than doubled my salary; and when I went to Google I took a
248.
by tytso 10y ago
Last year, when I was attending our Storage Infrastructure roadmap/planning meeting, it was very humbling because there lots of people in the room that were way smarter than me. Which is the other really great thing about working at
249.
by tytso 10y ago
I work at Google Cambridge, and I'm easily working 50+ hours a week. I work in Technical Infrastructure (on our storage systems in our data centers) and one of my 20% projects was to design and architect the underpinnings of what an
250.
by tytso 10y ago
Actually, that should be "cold boot" attack, not "evil maid" attack.
251.
by tytso 10y ago
So I only worked on the ext4 encryption feature in the Linux kernel which was used to implement Android FBE, and so I'm not an expert on vold, but there shouldn't be a reason why vold needs to hang on to the key. Vold is responsi
252.
by tytso 10y ago
The main reason I use fail2ban is I got tired of the log file noise/bloat. I use key-only access on my servers already, with the key stored on a hardware token (Yubikey).
253.
by tytso 10y ago
This effort to harden the Linux kernel is not new. Kees made a very similar presentation at the Kernel Summit last year[1] and it was quite well received. After his presentation, the kernel-hardening mailing list was revived, and new fe
254.
by tytso 10y ago
I made a very similar proposal back in 2003, which I called the Temporary Proprietary License, or TPL: https://thunk.org/tytso/TPL.html
255.
by tytso 10y ago
Google's self-driving cars is collecting a lot more data than Tesla is --- it has many more sensors that Tesla's cars. So it's not just how many miles you have driven, but what is the quality of the data. More importantly
256.
by tytso 11y ago
The question I have is whether committee members are sufficiently representative of programmers in the trenches, and whether committee members are sufficiently informed about the impact of their saying, "great, sounds awesome".
257.
by tytso 11y ago
It may be unpleasant, but the reality is that many programmers do feel that way. I can say that as a kernel programmer, I approach using a new version of gcc with a particular version of dread. What sort of random bugs that might end u
258.
by tytso 11y ago
Flash is not getting cheaper faster than HDD's, once you control for write endurance. One of the big messages in the paper is that IOPS matter. If you only have a petabyte or two of data, you can use a brute force solution such as
259.
by tytso 11y ago
I've smoked two wall warts because of trying to use a dodgy USB-C cable to charge a 2015 Pixel. In one case, the wall wart sim[ply stopped charging. In the second case the wall wart started charging my Nexus 6 REALLY FAST on one port
260.
by tytso 11y ago
I've smoked a USB wall-wart that was spec'ed to be able to provide 2A. At the time I had assumed it was a dodgy USB charger, but I now believe that it was the cable which was dodgy. Benson has posted instructions if you want to t
261.
Band-Aids Can’t Fix Bullet Holes: Silicon Valley and the NSA(lawfareblog.com)
3 points by tytso 11y ago|0 comments
262.
by tytso 11y ago
Actually, the preferred and recommended way to get randomness on modern kernels is to use the new getrandom(2) system call, with the flags argument set to zero. http://man7.org/linux/man-pages/man2/getrandom.2
263.
by tytso 11y ago
Well, the question is kind of moot, because I haven't dared to re-enable UEFI boot since. Supposedly newer BIOS's have the bug fixed, but the value to me in risky another range of motherboard replacements is just not worth it.
264.
by tytso 11y ago
They are basically asking people to pay $96 to buy a pig in a poke. So in exchange for saving $204 (which is what a one year subscription is claimed to be offered at) when the product is "done", you are putting $96 at risk again
265.
by tytso 11y ago
Well, that's really the question, isn't it? Is there more security added by enabling UEFI, or keeping it disabled? I managed to brick four Lenovo Thinkpad T540p mainboards due to a UEFI bug. Fortunately I had the on-site
266.
by tytso 11y ago
Nope, because my ssh key is on my phone and my tablet, with an ssh client, and I pretty much always have my phone with me. I do have a USB thumb drive with a bootable standalone system which I could use on a random mmachine --- but even if
267.
by tytso 11y ago
The following Planet Money story is worth listening to; there are some real challenges and downsides with making all salaries public. http://www.npr.org/sections/money/2014/07/02/327289264/episo
268.
by tytso 11y ago
I thought it was pretty well known. I gave a good chuckle before I clicked on the link, and after reading the article, I thought it was actually pretty accurate. My reaction was, "well there's $140,000 that's going to s
269.
by tytso 11y ago
Private creditors took a haircut. Government owned entities, including the German and French national banks did not take any kind of haircut at all. And at that time, it was clear that the debt write down wasn't enough --- but for po
270.
by tytso 11y ago
Actually, that's not quite right. With pretty much all modern Unix systems, the kernel supports process groups, and the control-C gets sent to the tty's foreground process group. Since the shell will set up a new process group w

More ›