komuW

Take a look at FSRS.

The paper: https://dl.acm.org/doi/10.1145/3534678.3539081?cid=996605471...

Various implementations: https://github.com/open-spaced-repetition/awesome-fsrs

Some benchmarks of various srs algorithms: https://expertium.github.io/Benchmark.html

Have you looked at Tyk? https://github.com/TykTechnologies/tyk/

Location: Nairobi, Kenya

Remote: Yes

Willing to relocate: No

Technologies: Golang, Python, Django, SQL, PostgreSQL, AWS

Résumé/CV: https://www.komu.engineer/cv/komu-CV.pdf

Email: komuw05@gmail.com

Blog: https://www.komu.engineer/blog

I'm a software engineer with ~8yrs experience. Here's somethings that I've done;

- Reduced cloud costs for a production kubernetes service by 20%. This was done by analysing pod utilisation on kubernetes and then right-sizing the pods to match the expected usage.

- Read the SMPP specification and implemented a client for it from scratch. Integrated the client into a production application and used it to send out SMS at averaget rates of 800/second.

- Created an open source ACME client based off the ACME specification.

Hi, could you guys please reply to job applications. I had applied in April and up to now I haven't received even a rejection email.

My solution[1] to this problem is to do what they did in the Apollo Guidance Computer; log to a ring buffer and only flush it (to disk or wherever) on certain conditions.

1. https://www.komu.engineer/blogs/09/log-without-losing-contex...

Nice article. If you ever wondered how the python equivalent(celery) works, I wrote a blogpost about that ~4years ago; https://www.komu.engineer/blogs/07/understand-how-celery-wor...

My favorite technique for reducing the cost of logging is the same technique that was employed in The Apollo Guidance Computer(though I'm not sure if they did it for cost purposes).

To quote from Annotations to Eldon Hall's Journey to the Moon[1]: "The Coroner recorded every instruction executed, with its inputs and results, writing over the oldest record when it filled up. When a program crashed, you could punch out a full record of what it was doing in most of its last second and analyze the problem at your ease. I have often wished that PCs offered such an advanced feature."

So essentially buffer all logs into an in-memory circular buffer of capacity N. If a log record is emitted that has a certain severity/level; flush all records from the buffer to disk/clickHouse/grafana/whatever.

The python MemoryHandler[2] almost implements the said technique, except that it also flushes when buffer is full; which is not particularly what I would want.

I also wrote a blogpost[3] about how to log without losing money or context, ~3yrs ago.

1. https://authors.library.caltech.edu/5456/1/hrst.mit.edu/hrs/...

2. https://github.com/python/cpython/blob/v3.11.1/Lib/logging/h...

3. https://www.komu.engineer/blogs/09/log-without-losing-contex...

Note that dumping the Vault's process memory is beyond hashicorp/Vault's threat model. See: https://github.com/hashicorp/vault/issues/1446#issuecomment-...

I'm bringing this up because the circleCI blogpost says that the attacker did memory-dump encryption keys from a running process. See https://circleci.com/blog/jan-4-2023-incident-report/

So even if they were using hashicorp/vault, the attacker could probably still have been able to mem-dump vault's process.

Note that dumping the Vault's process memory is beyond hashicorp/Vault's threat model. See: https://github.com/hashicorp/vault/issues/1446#issuecomment-...

yeah this just kicks the can down the road.

> That requires client-side SSL authentication,

I do not think it requires client side SSL. See: https://engineering.salesforce.com/tls-fingerprinting-with-j...

What is been fingerprinted is the TLS negotiation between client and server.

From the circleCI blogpost[1]: "Our investigation indicates that the malware was able to execute session cookie theft, enabling them to impersonate the targeted employee in a remote location"

I haven't seen much discussion on how this specific attacker entrypoint can be mitigated. So I'm going to make a naive attempt in this comment.

How about storing the client's IP address in the session cookie. Then whenever the server recieves the cookie, it compares the client's IP address against the one stored in the session cookie. The server denies the login if there's a mismatch. The cookie would of-course have to be signed(hmac etc) so that it is tamper proof.

One problem with this is that client IP addresses are easily spoofed[2].

So, instead of storing the client's IP address; how about we instead store the clients' SSL fingerprints[3][4]. I haven't looked much into the literature, but I think those fingerprints are hard to spoof.

1. https://circleci.com/blog/jan-4-2023-incident-report/

2. https://adam-p.ca/blog/2022/03/x-forwarded-for/

3. https://github.com/salesforce/hassh

4. https://github.com/salesforce/ja3

it's unrelated; https://news.ycombinator.com/item?id=33382369

Filippo Valsorda(FiloSottile), who is the maintainer of Go's cryptography libraries said on Go's slack channel that the patch is unrelated.

See screenshot of the slack conversation: https://paste.pics/f5622033ae711b36e0bbcda393a67866

Filippo Valsorda(FiloSottile), who is the maintainer of Go's cryptography libraries said on Go's slack channel that the patch is unrelated.

See screenshot of the slack conversation: https://paste.pics/f5622033ae711b36e0bbcda393a67866

I don't think the flagging has anything to do with the Golang community. From my understanding, that came from the HN moderators themselves. @dang made some explanations on one of those threads

The code in this article is great advertisement for Golang.

Pin<Box<TimeoutWriter<TimeoutReader<TcpStream>>>>? Gesundheit indeed.

Great writing as always.

thanks!

Go does has some form of monomorphization implemented in Go1.18; it is just behind a feature flag(compiler flags).

Look at the assembly difference between this two examples:

1. https://godbolt.org/z/7r84jd7Ya (without monomorphization)

2. https://godbolt.org/z/5Ecr133dz (with monomorphization)

If you don't want to use godbolt, run the command `go tool compile '-d=unified=1' -p . -S main.go`

I guess that the flag is not documented because the Go team has not committed themselves to whichever implementation.

"it's OK for me to use Zig to implement YJIT, as long as foreseeable portability problems (mentioned above) are addressed.

Besides that, I prefer Zig to Rust, as a long-term C programmer, but all up to you." - Matz (Yukihiro Matsumoto)

reference: https://bugs.ruby-lang.org/issues/18481#note-17

When you do `go run qsort.go` you are also timing the time taken by Golang to build/compile the code. I suspect the same applies to `cargo run`

You should do something like; `go build . && time ./qsort`

I usually use Damian Gryski's: https://github.com/dgryski/semgrep-go

Rabbit holes for you to chase[1][2][3][4][5]

1. https://github.com/golang/go/issues/29696

2. https://github.com/golang/go/issues/42430

3. https://github.com/golang/go/issues/44167

4. https://github.com/golang/go/issues/44309

5. https://blog.twitch.tv/en/2019/04/10/go-memory-ballast-how-i...

And I agree with the proposal committee for declining your request. For a language that prides in having great backward compatibility, what you were proposing wouldn't fly.

> prevent HashDoS attacks[1] at the expense of slower hashing. I actually don't know whether Go's hashmap does the same.

From looking at the code[1], it seems like it does. From[2] it looks like it is only for platforms that have AES.

1. https://github.com/golang/go/blob/7bfe32f39c59056c49f5776b10...

2. https://github.com/golang/go/issues/9365

This is an interesting concept. I think it would need one or two major game studios to really drive this for it to take root.

I wonder what the mood was like when homo sapiens was transitioning - unbeknownst to many - from a hunter gathering nomadic lifestyle to a sedentary agricultural one.

I know the scales are different but sapiens is in another transition, again unbeknownst to many.

Gas stations make very little margins selling gas/fuel ~2%. However, their own convenience stores have very good margins.

So, a gas station operator would like to keep you at the station for as long as they can in the hope that you'll enter the convenience store.

That's partly why they have restrooms, smoking zones(for countries where public smoking is illegal), etc. They are partly their for your own convenience and partly to make you stick around and eventually enter the convenience store.

EV charging presents a perfect opportunity to keep you at their station longer. Each charge is probably going to take a minimum of ~30mins; and you'll spend most of it lazing around the convenience store drinking crap coffee marked up at 60%

Hi,

Looks nifty. Is there a way to enter source code(programming) in the editor? I cant find it. The thing I can find is how to enter formula, but that is not what I'm looking for.

there's a Kenyan guy[1] who makes electric wheeelchairs out of recycle laptop batteries.

and it has some nice off-road capabilities.

I can't find his website but he appears to be active on instagram[2]

1. https://www.bbc.com/news/av/world-africa-49528426/kenyan-inn...

2. https://www.instagram.com/linccelltechnology/