davidpelaez

Thank you, reading the white paper from Coalfire about their service right now.

I would also appreciate a little comment on this because the readme doesn't do much explaining what it is, why it's important, how it's different from .NET Core 2 compiler? To put it in another way, why is this so relevant?

This is amazing and literally filling a void for companies aware of the benefits but lacking the budget. There's one last barrier though: how to use this in the cloud? A partnership with AWS to have this as a service would be amazing because their HSM offering is not affordable and also because for many compliance reasons companies use AWS (PCI DSS for example) and there would be no way to include HSM 2 there. Let's hope this happens!

Would it be possible to get an account for playing in the sandbox without living in South Africa?

Because you have knowledge of your own patterns, because you can change technology much faster and test many things as opposed to banks that usually evaluate enterprise super expensive software, usually neglect open source and hence don't always have the best tools. If you think the integration as an individual you probably cant, but if it's a company building on top of something like this, then it's totally possible to be better than the issuers and processors.

This is amazing. Are you on twitter or some other place I can find you and talk?

How far inside the bank do you APIs go? Do they deploy code you wrote or how are they providing the access? Did you build on top of some raw APIs? The hardest part of this businesses is probably that connection with the bank and I'm curious about what info you can share regarding that.

They have been manipulated. There's a investigation close to begin to the PR person of the NO leaders. I would agree with describing the Colombian people as "misguided children".

As they claim in the Q&A posted on Twitter, this encourages the process and celebrates the effort of president Santos to reach this far. If we do not reach an agreement to end this war it's a problem of other forces in the country and the ignorance of our people but for sure not by Santos failure. If we don't solve this for good, his brutal shift of the conflict from war to negotiation is already a great result.

Thank your for a reasonable comment! There is indeed a lot of ignorance from the outside. There's a logic to many points and theories but definitely people should be more informed even here in HN.

You don't benefit from mines, hard work conditions, no access to anything and the risk of getting bombed by planes or being in cross fire. I understand the logic for your question but once you check the facts of those parts of the country it's obvious that only the guerillas and huge land owners could be benefiting and they don't had enough control in this situation to affect the result of the vote.

The people who vote against claim they are not in favor of the war but in favor of another agreement. There's very few people in everyday life that want "the same". However, through many lies popular believe is that we can close the conflict making things even, like there's a better amazing deal we are missing altogether and need to stop and rethink it all. There's no full justice we can achieve as a country as there will never be anyone who can repair all the WWII deaths, destruction and suffering. That didn't mean that Europe couldn't recover and that Jews, as the most clearly affected group by size, where not able to cope and forgive in many cases. That's the point that voter against don't see and think they can easily get through another agreement.

I agree that Obama's was pretty shitty, but from my internal view as a Colombian I would really suggest that you find out about his work for peace. He's still a politician and hardly everyone's cup of tea, but he has really make a huge effort against many walls to find peace in Colombia. He has gone from defense minister all the way to finding an agreement we can implement. The patience to go between those such opposite positions is admirable.

Except they had. First world countries had the worst war on history and they rebuilt their societies making big concessions. Europe and Japan know a lot about accepting had agreements exactly as our peace process suggests. This is a great way of supporting the work a great president truly committed to changing our country because he was born rich and it's extremely obvious that the peace agreement with FARC and possibly ELN it his way to transcend. I applaud this price and the support of developed countries to the process.

I'm a Colombian citizen, a rather young one, 27, and I did not expect to see this happen during my lifetime. I think this is so important and unlocks so many things for everyone inside and outside of Colombia.

Storage apart, would you compare it to NATS? Is there something as latency sensitive as Pulsar or would you say it seems to be a leader in this prevalence? We see things like NSQ and NATS and we are never sure if latency is low enough for responding in an HTTP API with 1s timeout.

It's very hard with posts like this to understand the true reach of the problem: is this like having ssh with "password" as the password or is it something much less dangeroues. Is this something that could be exploited without Amazon team messing with the hypervisor providing your VM or something a third party can exploit? If this is a problem with Amazon then I think it's not a real problem for many people: it's inevitable to have a trust contract with them, it's pretty much essential to the notion of the cloud. They could be effectively violating their physical security rules for employees and installing modified code on the hypervisor but they still give us hints and certifications as to why that's not the reason and we need to choose to pick that or not. I just wanted to ask because I'm not an expert on this at all and I always find myself asking, how bad is this indeed and under what assumptions is it a security problem? Any hints to understand this are much appreciated! :)

Did your case have some things that make it heavy in some way? e.g. very long list with many images, data structures that were big and kept in memory? Video or heavy animations? Or not really and the whole thing was just slow?

It's great to learn about the process. Sounds amazing. I agree that JS syntax is not a selling point, from what I read the approachability of a wider audience is. However I agree that care should be taken not to fall to easily in stripping away most of the ML interesting things and end up with everything looking the same. Go, Rust, Swift, JS it's all about the same. For different languages their "user interface" is extremely similar. I think that with your proposals you have shown a great suitability to discover the balance between being different and being accesible, I don't think they have to be opposed as many language designers seem to be convinced.

This would be so interesting! I don't know any other language that has made this before. But if the intention is to increase the reach of OCaml then if sound like a great plan.

I'd like to clarify that there's a _major_ issue to consider. Here's my comment on the article explaining:

Cloudflare delivers signatures for records that last more than the TTL of the record. This has the problem of replay attacks. If one employee that had access at some points configures a machines DNS to return an old DNS response it will be valid until the expiration of the signature, hence having access for more time than the actual TTL.

I just checked and Cloudflare generates signatures expiring +2 days in the future. This means that I have a TTL of 5 minutes on my record but the client is receiving old queries, authentication would pass without a problem for as long as the RRSIG is valid.

Ideally Cloudflare should sign every record with the same frequency as the records TTL, that would solve the issue.

After finding this out I think you should _not_ use Cloudflare's DNSSEC because revoking access to a user wouldn't be 100% effective until the RRSIG expiration date given the replay attack scenario.

The registrar only has your public key and Cloudflare handles the private one for you. If you distribute the public key to your servers as part of the validation this means that your largest risk is actually a breach in Cloudflare.

I really really trust them, they have an impressive history of contributions to the web and commitment to security. If your servers are behind another access control layer, like a corporate VPN, this shouldn't be a big concern, since they would have to disclose breaches anyway.

Finally, I think this interesting because basically DNSSEC gives you an easy way to distribute data globally in a secure way with a TTL. This is the best benefit compared to using certificates for access control where revocation is usually very painful.

Consider this an initial look on how to use those benefits of DNS. I agree another layer of security would be great. Think something like asymmetric signature of the actual TXT record so that DNSSEC helps control expiration and then the other key validates origin. You are using DNSSEC only for the benefits of TTL validation.

Thanks for the link. It was a great read to understand in more detail what go channels really are from a theoretical perspective and how that could actually be matched within Rust.

I agree many people use Go for it's simplicity for new developers which is understandable but not the only way to measure why a language should be adopted.

I'm yet to verify this, but it seems that Rust is closer to Haskell in that it intends to enhance the likeliness of program correctness as it's being written and not only through testing. In go you still get runtime errors and I don't think it's all that rare, Rust should reduce those greatly.

I do share that adoption through libraries and widespread acceptance is very important and when you compare Rust to Haskell you make a nice point, the language could be great but not generate adoption.

However besides adoption I don't see anyone who seem to dislike the process of writing Rust itself. Apparently people think it's viable if more libraries are out there. The natural presentation of the arguments made me feel that people are open to it should the right libraries be there.

I agree in that you wouldn't write a driver in Go, but you would in Rust. It simply feels very strange to consider that Rust intention is limited to those areas. It could, but I have a feeling it can have a larger scope than the one it has somewhat imposed on itselve because it can effectively replace C/C++.

It's semantics are somewhat more complex that something like Go, but using it shouldn't prove much more complex that Go one you are used to the language basics. This could be of course my errors anaylising the problem, maybe it's way slower/complex and without any great benefit when precise memory management can be spared in favor of development speed. But even then I wonder if the existance of immutability, exhaustive pattern matching and an expressive type system don't increase heavily the realiability of Rust code hence providing stability reducing bugs.

> If you want a replacement for Ruby, and don't want to use Go (for whatever reason), then I'd really advise asking "Why?", first.

I'm slightly tired of not having a type system, I keep shooting myself in the foot and introducing little bugs that a type system would often get. In ruby heavy testing is very important and I find myself wanting things like immutability and pattern matching to ensure I handled exhaustiveness in my logical assertions during the program flow.

Also, my company pays way to much for not so much concurrent users because Ruby consumes a lot of memory. We have to think to much about deployments and horizontal scaling and I'd prefer something simpler to scale.

This are all problem that we have solved. They are natural to the dynamic character of Ruby, but the beautiful syntax and simplicity of DSLs come at a price in development and deployment.

Go feels a very poor language. Channels are nice and expressive, but the lack of a larger type system, error handling, it's mostly imperative semantics and excessive simplicity make it unattractive. I don't want a compiled Javascript, I want the quality of abstraction that simple tools can bring even though they may not be the easiest.

Javascript is very unrealiable and full of quirks. Go is too simple to offer level of abstraction we want to invest heavily in program correctness without too much testing. Ocaml has an interesting balance but I want statically linked binaries at all times and have no interesting in dealing with what seems a messy standard library and compiler flags to get the exact result I want. Haskell's too complex to learn for any practical use. Purescript seems interesting but suffers from the same complexity as Haskell. Many other languages are not safe even though they're fast and compiled and many JVM languages are way to close to Java which I would love to see disappear during my lifetime.

It's very picky, but hopefully the downsides of every language appear clear as to why I'd consider Rust instead of Go as a replacement to ruby.

It's not my intention to close the conversation but to try to make it richer by not focusing on the historical advantage that Go has over Rust. You are correct in that it's possible that not much more open source will exist in rust since it could simply fail to acquire any massive adoption.

I do think there will be space for both and I would prefer to consider them as raw tools, hence the language themselves, and take the risk of having a community in the future sharing libraries for common things. It's a risk but not a crazy one I'd say and probably helpful for the analysis.

Building on your reply, I'd say prove of adoption is one downside for choosing Rust. This however ignores the merit of Rust as a language which hints me into what I have begun to see more often: that it's the newness and relative absence of production use cases that don't seem to validate it viability, not some inherent complexity or downside to the language itself.

Go offers thread as channels directly expressed in the language Syntax, not as a semantic construct on top of them. That is of course attractive for it's simplicity, but Rust offer a lower level alternative. I don't have much experience with Rust, but maybe a clever macro could be use to express in a higher level the type of things you'd use go channels for.

Going back to my proposed question, maybe people can prefer golang for this syntactic benefit but I don't think that addresses the larger set of differences that usually separate them.

I agree that you can address the scalability problem in every architecture in different ways. In ruby you'll typically have a mix of vertical and horizontal scaling that often results in a significant consumption of memory. This even though feasible comes at a higher price on cloud resources. I have experience this first hand and I think it's similar (at much minor scale of of course) to what companies like Shopify have experienced as motivations to change to something like Go.

You're welcome BTW

Glad to hear you are thinking on how existing infrastructure could be integrated to Terraform.

I think this is specially important with elastic IPs that have been whitelisted somewhere, e.g. a VPN of a 3rd party service provider. So a way to say, take EIP x.x.x.x, don't ever release it and then indicate what instance to associate it to is great.

Another example of this feature is starting from an existing VPC and build from there, or even actually inherit information from the current state and convert it to an "auto generated plan" to build from. Thanks again Hashicorp for all the great software.