GauntletWizard

SEEKING WORK | US | Remote OK

I am a Site Reliability Engineer (SRE), Google Style, with experience at both large and small organizations. I can help you build a Platform Engineering practice from the very beginning. I'm looking to help small dev teams increase their velocity by implementing best-practices of Devops: CI/CD, Kubernetes Deployments, and effective Monitoring frameworks.

My resume: https://resume.gauntletwizard.net/ThomasHahnResume.pdf

My LinkedIn: https://www.linkedin.com/in/thomas-hahn-3344ba3/

My Github: https://github.com/GauntletWizard

Anubis's design is copied from a great botnet protection mechanism - You serve the Javascript cheaply from memory, and then the client is forced to do expensive compute in order to use your expensive compute. This works great at keeping attackers from attempting to waste your time; It turns a 1:1000 amplification in compute costs into a 1000:1.

It is a shitty, and obviously bad solution for preventing scraping traffic. The goal of scraping traffic isn't to overwhelm your site, it's to read it once. If you make it prohibitively expensive to read your site even once, nobody comes to it. If you make it only mildly expensive, nobody scraping cares.

Anubis is specifically DDOS protection, not generally anti-bot, aside from defeating basic bots that don't emulate a full browser. It's been cargo-culted in front of a bunch of websites because of the latter, but it was obviously not going to work for long.

This is important work, and I thank you for it. These public transparency logs are important for keeping honest people honest, but also for keeping dishonest people out - If someone does manage to backdoor Google's build process, this is how they'll know.

An opinion, based on meeting people like https://www.nbcnews.com/news/us-news/capital-one-hacking-sus...

There are tons of people in the West who have no qualms about doing this for pure crime purposes; many of them are the ones who espouse most ardently that doing this work for the government is immoral.

Internal documents doesn't mean they weren't lying. It just changes the target, the expected audience, of the lie. Many workers lie to their bosses. They speak what they think their bosses want to hear, and bosses tell them what lies they want to be told.

That's nice, but they were interactive - You could move around the scene or change the camera angles. The fact that you could do this and prove it was realtime and not prerendered was part of the demo and most of the charm. Lacking that, it's just... lacking.

Having run an exit node for a couple of years, the worst part for me was the spam associated with torrent traffic. I got several notices per week of copyright requests, which I responded to with a form letter fuck off, but it was still obnoxious because my upstream required me to do so, creating a ticket that they would not close until I had responded.

As far as dark websites, you are supporting them whenever you create any node, because any node can act as a hop for onion sites. On the balance, I think that it is worth having anonymity through Tor, but I will admit that that balance often seems a razor's edge.

At one point I did the same for a comic app which was getting the earliest releases of a manga I wanted to read; I still don't read Japanese but was the buyer for my translation circle. They had similar forms of obscure obfuscation; They scrambled the image into chunks, then you got a metadata that remapped it into a finished image. Raw, it looked like one of those slide puzzles.

Over the course of a couple years they updated their scrambling; First to randomize the size of the regions, then to make them triangular instead of rectangular. It was an interesting if tedious challenge to reverse engineer.

EVs chargers are known to contain about 5 lb of copper per cable, which is only about two bucks at black market scrap prices, but still enough to be worthwhile for the tweakers who are stripping it.

And China has always been a threat.

Found on the front page today, an article about exactly this kind of "marketing" https://larslofgren.com/codesmith-reddit-reputation-attack/

Not only that, but Google Japan has a long history of humorous keyboards, such as the "Double Sided" keyboard: https://youtu.be/EHqPrHTN1dU , the "Single Row" keyboard: https://youtu.be/9G3DWHf1xX0 and the Spoon Bending keyboard: https://youtu.be/DeJY5d14qKs

It's been their running April Fools joke for years and they've upped the rate to every six months.

Which itself is a Hitchhiker's Guide to the Galaxy reference.

Many of them are using their subreddits for submarine promotion. Here's a public example: https://www.reddit.com/r/SeattleWA/comments/547wxd/comment/d...

There's much worse that's "pure speculation", because a few thousand unemployed losers that nonetheless have six figure incomes aren't suspicious at all. See the kerfuffle when the mod of r/antiwork went on Fox News, where several of the other power mods alluded to their true incomes and professions (they know what they are - PR people) when trying to boast about how they'd have done better.

By reddit? No. By the users? No.

But they are paid.

SEEKING WORK | US | Remote OK

I am a Site Reliability Engineer (SRE), Google Style, with experience at both large and small organizations. I can help you build a Platform Engineering practice from the very beginning. I'm looking to help small dev teams increase their velocity by implementing best-practices of Devops: CI/CD, Kubernetes Deployments, and effective Monitoring frameworks.

My resume: https://resume.gauntletwizard.net/ThomasHahnResume.pdf

My LinkedIn: https://www.linkedin.com/in/thomas-hahn-3344ba3/

My Github: https://github.com/GauntletWizard

I've never had to restore a single file that's older than my local snapshots; The restores where I've needed an old subset have been a substantial enough subset that 4-5xing the data size on restore was not really an issue.

I kinda agree with your point on file-by-file encryption, but ZFS's general integrity features are such that I'm not really worried - Except about this article's specific failure mode, which is pretty easy to deal with/avoid when you know about it, but is a substantial deficiency.

I really love ZFS Native encryption, but this is the big problem with it. I use ZFS Raw Sends to store my backups incrementally in a cloud I trust, but not enough to have raw access to my files. ZFS has great attributes there, theoretically - I can send delta updates of my filesystems, and the receiver never has they keys to decrypt them.

I've used this in practice for many years (2020), and aside from encountering exactly this issue (though thankfully I did have a bookmark already in place), it's worked great. I've tested restores from these snapshots fairly regularly (~ quarterly), and only once had an issue related to a migration - I moved the source from one disk to another. This can have some negative effects on encryptionroots, which I was able to solve... But I really, really wish that ZFS tooling had better answers to it, such as being able to explicitly create and break these associations.

I had a brief period of setup pain and then have never looked back, though have occasionally wished that feature parity came a little quicker. Podman is in many ways a delight, simpler in what it does in the general case and yet as powerful as docker or more.

Yes.

I more or less stopped completely. I spent nearly $10,000 on Amazon in 2016 (Multiple computers, clothes, games, foodstuffs - Just everything); It was down to $2000 by 2018 after I stopped trusting it for anything but big-ticket items that were unlikely to be counterfeit. It picked up again in the pandemic, but after a series of bad purchases in 2023 I've spent less than $1000 in the last year, and over half of that is a CPU that I really feared buying because of fraud/counterfeit concerns, and immediately inspected and installed to assuage those fears.

In this scenario, where oscp is required and stapled: The CA can simply refuse to reissue the certificate if the host is compromised. It does not matter if it is refusing to issue an ocsp ticket or a new short lived cert.

Ocsp has always represented a terrible design. If clients require it, then it becomes just a override on the not after date included in the certificate, that requires online access to the cert server. If it is not required, then it is useless, because blocking the ocsp responses is well within the capabilities of any man in the middle attack, and makes the servers themselves DDOS attack targets.

The alternative to the privacy nightmare is ocsp stapling, which has the first problem once again - it adds complexity to the protocol just to add an override of the not after attribute, when the not after attribute could be updated just as easily with the original protocol, reissuing the certificate. It was a Band-Aid on the highly manual process of certain issuance that once dominated the space.

Good riddance to ocsp, I for one will not miss it.

You can add a metadata device to the pool at any time - it's probably faster to add that pool and wait for it to populate than to delete all that data with metadata on spinning rust.

My "AI" response was actually pretty good; It summed up the number of minutes per hour, making only one (glaringly obvious but understandable by some metrics) error:

> Hour 12: The hour (12) is never greater than the minute (0–59), so the time is 0.

Misunderstanding how human clocks work, but right for this clock.

It then doubled that, because there's two 12-hour periods in a day, which was useless but reasonable, and finally divided by 1440 minutes in a day, and got an answer of 9%

Then I asked again, and while it got the same answer, it used totally different "reasoning" that was wrong in a unique way.

SEEKING WORK | US | Remote OK

I am a Site Reliability Engineer (SRE), Google Style, with experience at both large and small organizations. I can help you build a Platform Engineering practice from the very beginning. I'm looking to help small dev teams increase their velocity by implementing best-practices of Devops: CI/CD, Kubernetes Deployments, and effective Monitoring frameworks.

My resume: https://resume.gauntletwizard.net/ThomasHahnResume.pdf

My LinkedIn: https://www.linkedin.com/in/thomas-hahn-3344ba3/

My Github: https://github.com/GauntletWizard

I feel bad for the guy playing the left side; 0 - 55 is a heck of a deficit to come back from.

A similar anti-pattern - WhatsApp has it's own contact list and list of users. However, you can't use it without granting the Contacts permissions. On my phone, though I have WhatsApp installed, I can't create a new chat - It just brings up the "Enable Contacts" dialogue. I can however use their web-client to initiate a chat, and when people can message me I can respond.

All it takes for a TLD these days is a vaugely-legitimate use and about a million dollars[1]. This isn't hard for a large company or state actor to fund; Why would a mid-large religion not be able to?

[1] https://newgtldprogram.icann.org/en/resources/faqs#6