helper

Keep up the good work!

The talk on finding vulnerabilities in dtrace to escalate privileges seemed to be the most interesting/terrifying to the attendees. Definitely worth watching: https://www.joyent.com/about/events/2016/dtrace-conf/videos/...

I use deb-s3[1] which is sort of like this, but handles uploading the package and updating the Packages index in a single step. deb-s3 can also sign your Release file so apt won't complain about unsigned packages.

The post mentioned deb-s3 and dismissed it as more complicated to setup than this solution. While the lambda solution is neat, I'm not sure I would describe it as simple. For now I think I'll stick with deb-s3.

[1]: https://github.com/krobertson/deb-s3

My first thought reading this was "lcamtuf works at cloudflare now?" Nope, cloudflare just took an awesome tool of his and made the kernel able to filter packets based on its signatures using bpf. Pretty cool.

I don't know very much about defending against DDOS attacks. How do you identify a SYN flood and filter it without interfering with legitimate traffic?

Looking forward to being on call new years eve.

Those are some sketchy install instructions. Add a trusted apt repo to some random ip address that doesn't do package signing? Not cool.

Setup a PPA, its really not that hard.

18,000 passengers per day is 6,570,000 passengers annually which is about 12% of the total 54M passengers at JFK. 12% doesn't seem all that low to me.

> This is a town for freaks and weirdos.

Those are all the people currently getting forced out by the lack of housing supply. Opposing this legislation won't magically make the rich leave, instead the city will continue to be less accessible to the middle class.

I hope that some day everyone who wants to live in San Francisco can live here. It seems like the only way for that to happen is to increase the housing supply.

Yup. Its a shame they can't expose a normal http interface directly to lambda. That would make setting up APIs a thousand times easier. For example I want to have a lambda function receive events from github, but in order to authenticate those requests I need to have the raw body and headers.

The API Gateway has the concept of "custom authorizers" in which another lambda function gets called to authorize the request before it gets passed to the real lambda function (WHY!!!).

The API Gateway feels more like "enterprise" software than anything else I've used in AWS (not in a good way).

I hope the AWS team and jeffbarr are listening.

I'm sure there are companies that will run this instance type 24/7 for years. But you can also spin one up for a short period of time, use it to do things you would normally need to do across a bunch of machines and then tear it down.

Having this type of instance available via an API call is within seconds is really cool.

If you paid hourly (instead of using a reserved instance) it costs $116840.88 per year (13.338 per hour * 24 * 365). A 1 year reservation + hourly charges for a year is $67197.96 (all up front).

I've also got mine hooked up to my harmony hub. I've got a program on my network pretending to be a bunch of smart lightbulbs. So I can say "Alexa, turn {on,off} TV".

I think I could do volume control by simulating a bulb that supports brightness but I haven't tried that yet.

Maybe "release" isn't the correct term. Ubuntu publishes new AMIs with the latest security patches quite regularly. When I spin up a new instance on say 14.04 I want it to boot with a fully patched kernel.

Having used both Marketplace AMIs and non-marketplace (community) AMIs, I find the Marketplace ones to be quite painful to use. I want my tools to be able to go out and get the latest AMI automatically and launch that instance, but it is basically impossible to do this with things in the Marketplace. Amazon makes you jump through a bunch of hoops as if you are paying extra for this marketplace AMI even if it is provided for free.

The nicest experience I've had is with the Ubuntu community AMIs. Ubuntu keeps a listing of their official AMIs[1] and there is a JSON api that they provide so you can fetch that information programtically.

[1]: https://cloud-images.ubuntu.com/locator/ec2/

Unfortunately loadable modules in nginx still suck. Instead of having an ABI like apache does, nginx relies on signature checking for each module. This means that your modules still need to be built at the same time you build your nginx binary. If you decide later on you want to add a new module, you still need to rebuild nginx.

Its so frustrating because it really introduces a lot of operational costs to an otherwise excellent piece of software. It was the most surprising thing about nginx since Apache has had loadable modules for a long time.

There was some discussion about this when 1.9.11 was released that suggested that loadable modules wouldn't even be all that beneficial to package mantainers[1].

[1]: https://news.ycombinator.com/item?id=11067664

This story doesn't quite make sense. I believe that his RSA pass was clonable and that his towel also had an RFID chip embedded in it. What I find hard to believe is that the towel had a writable RFID tag.

My main experience with RFID is cloning tags onto T5557 chips, and I don't think I've ever come across a writable tag in the wild. It doesn't seem to make economic sense to spend an extra penny or two on every towel to put in a tag you are never going to change.

If you want to read a good book on studying in-store shopper behavior, you should checkout "Why We Buy" by Paco Underhill. He runs a firm that studies shoppers by secretly following people around in a store and writing down everything they do.

The panic when calling close on a closed channel is a bit annoying. Recently I've been using x/net/context to signal goroutines instead of closing a channel. The CancelContext allows you to call cancel multiple times.

From Eben Moglen's wikipedia page:

Moglen is closely involved with the Free Software Foundation, serving as general counsel since 1994 and board member from 2000 to 2007. As counsel, Moglen was charged with enforcing the GNU General Public License (GPL) on behalf of the FSF,[4] and later became heavily involved with drafting version 3 of the GPL.

I'm comfortable calling him the leading legal scholar of the GPL.

Amazon now has an NFS service (in preview release) called EFS: https://aws.amazon.com/efs/

There are a couple of open bugs[1][2] related to grub and ZFS that make it a little tricky to get ZFS on your root volume, but it is doable: https://github.com/zfsonlinux/pkg-zfs/wiki/HOWTO-install-Ubu....

I expect those issues to be resolved before 16.04 is released. Even with those fixes, the interactive installer doesn't support ZFS yet so you will still need to drop to a shell to actually setup your zpool and your partitions.

[1]: https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1527727...

[2]: https://bugs.launchpad.net/ubuntu/+source/zfs-initramfs/+bug...

Rebuilding our integration docker image right now. If all our tests pass I expect to have go 1.6 binaries in production by this evening.

Tavis is beast when comes to finding these exploits. Its always fun reading his write ups.

How many servers? 1, 100, 1000,10,000? Where are you hosting them, in your home or in a datacenter? How much are you paying for bandwidth and power? What SLAs do you have in place for network and power? How much do you pay for your remote hands?

I hope you see what I'm getting at. While I love ZFS and think self-hosting can make a lot of economic sense, without knowing all the variables you can't really make a fair comparison.

It is a load balancer Google is using in production: http://techcrunch.com/2016/01/29/google-open-sources-its-see...

Edit: Here's the official Google announcement: http://google-opensource.blogspot.com/2016/01/seesaw-scalabl...

Distasteful? He is saying that the Minsky's work is a direct ancestor to his own. If you read the rest of that paragraph he is praising and thanking Minsky for the foundation he laid.

Isn't that what automation tools are for?

Turn on cloudtrail for all regions.

I love that the go team is hostile to breaking stdlib changes (which is what changing the flag package would be). It is so nice to be able to upgrade to the latest go version without having to worry about what it might break in production.

It is true that the go team is cautious about what goes into the stdlib. Part of that is their commitment to long term support of the standard library. To be able to do that effectively they need to be discerning when choosing what to have there vs an external library. But that doesn't mean that they don't take big changes. HTTP2 support will be in 1.6 which is a huge addition.