lsofzz

> Linux has achieved a 3% desktop market share (linuxiac.com)

And the desktop market amongst servers, cell phone, consumer electronics is?

Linux doesn't need to play this game because it has already won it - a long time ago.

A "faster" CPython is a decade plus minus four years old story ;_;

I'll check back in a decade.

> I feel old now, as I continue to deploy Apache :-)

we wrote bash scripts backends. don't worry about being old. keep going ;)

some even had their cgi code running in kernel.. all the more reason to be merrier.

We did this on production (still runs at webscale) but we abandoned dev effort on it for ${reasons}. I _loved_ it though :) Hook Lua on the HTTP event processing stages and add icing on the cake with Lua modules to hand-off non-trivial stuffs..

Run Kubernetes. Install the open-source Kubernetes ingress controller with your favourite load balancer. I'd wager that'd solve majority of your use cases.

this is NGINX Inc. talking. grain of salt.

This is one of the pet peeves of HN submitters and readers :)

Sure, here is my two cents FWIW - Kubernetes is complex for some set of folks but not for others. So, the answer is - depends; On a lot of external factors outside of just technical capabilities of team.

Kubernetes solves many non-trivial challenges but its not a silver bullet. I could certainly learn from Mercedes platform/infra team's "story from the trenches" (they reportedly run 900+ k8s clusters on production:)

> I spent the time to learn to use Linux effectively, and I still want to use something else.

It does take time to be effective. I like to emphasise that learning to be effective at Linux is not a sprint - it's a marathon.

I have two macs. And, yes, I surely I can afford many more of it.

But, whether you own a mac or not, once you start using Linux (and it takes patience to do so _effectively_), I can guarantee that you _will_ never want to use anything else.

- Linux user for the past 22 years (for the most part been so much fulfilling).

> They can rebuild that whole datacenter a hundred times over and still not feel it in their wallet.

Agreed.

> How is this supposed to work? (I use Arch BTW) supposed I'm in a country X, does Cloudflare basically caching the request to server that are in country X? But I'm already close to that server and I'm always cautious with mirrors that are in country X, often they were out of date :(

According to what I read in their main page https://cloudflaremirrors.com/archlinux, they seem to be caching the packages from mirrors and serving it via their anycast network.

OpenBSD is also a great choice for a firewall too https://www.openbsd.org/faq/pf/

I looked around but didn't find it. Thanks a lot.

> Especially when ARM Graviton 2's vCPU on AWS are actual CPU core while Intel / AMD instances are CPU thread.

Thank you for that information. Is there a reference that documents this somewhere?

> What would you think about sandboxing all media related components?

You have to be very _specific_ when you say _sandboxing_. Since, the attack surface is mostly at the decoding layer - there are at least few dozen ways to sandbox the processing logic on modern UNIX-like OS based on the requirements:

1. Farm out, give it its own namespace and filtered list of seccomp2 calls to do the decoding.

2. Farm out, compartmentalize the decoding layer to BSD jails

3. Same as 2) but using chroot - give the necessary libs/bins/mount

4. Farm out, run the decoding components on a separate VM - somewhat akin to QubeOS.

5. Farm out, run ephemeral spark jobs to process the decoding on a compartmentalized VMs/Containers....

These days the word _sandbox_ is overloaded.

It used to be that you put things that are in userland under selinux and go to bed at night.....

> Follow the blog: https://codecs.multimedia.cx/ but there's no source code release yet AFAIK.

Nice; though the documentation/blog is quite hard to follow :)

> No need to assume anything. The article starts out:

Aha. Reading now.

For any tool authors, jepsen is invaluable piece <3.

A lot of software in the messaging/storage space has undergone jepsen test and I for one am grateful to Jepsen's author Kyle Kingsbury for his incredible work in setting their expectations correct.

> A foolish consistency is the hobgoblin of little minds . . .

Didn't quite get the connection here. Care to elaborate? :)

I assume this is a play on the word "firecracker"? :D

https://github.com/firecracker-microvm/firecracker

> Doesn't this apply to really any sort of isolated environment? What's wrong with chroot vs a vm?

If you are implying _PoC GTFO_, then definitely I do not have anything to suggest today that either is secure but I would rather not base my comment on what's not seen in the wild and also on the limited breadth of my research.

If anything, we've learnt the from past exploitations of guest additions/kernel modules in guests/vmm, that all of it is real and possible. Given enough resource, time and eyeballs, a _lot_ of the bugs are exploitable - you just have to ask some of the folks in offsec who develop exploits for living.

> Chroot vulnerabilities have been discovered and fixed over time, as any security issue in an operating system is. It's not accurate to say that they are insecure in a blanket fashion especially these days. My opinion is that we should be using Unix as it is meant to be used, as on operating system, and using its time worn facilities meant for purposes such as

I think you are right in general terms but I do not think an attacker will play by the rule and use `chroot` in UNIX-like OS as it is "meant to be used". They will use whatever means necessary - whether it be 0day or other un-patched vulnerability to get a break out.

Nice. Would it not be possible to source data for other countries?

Oh bummer

> I'm not your son, nor am I talking about what DevOps "is about", but about what is became in practice, which you would have understood hadn't you rushed to reply in the most condescending tone you managed to invoke.

Fair enough. I am letting you know though the part where you got mixed up - that is not because _What DevOps has become in practice_. That is precisely because of failings and shortcomings in team culture and/or the organisation that practice DevOps.

It's hard to know exactly how bloated SSL/TLS libraries have become without actually taking the time to research them but some of the folks behind `LibreSSL` seem to know crypto well enough.

> Would a company like Amazon not have full time lawyers retained on salary instead of relying on outside counsel with that conflict?

That was a good laugh for a bit. Thanks. I read the first few words of yours as:

  Would a company like Amazon not have full time lawyers retained on salary to lie ....

> Nomad has been brought forth in a lot of comments, and it has a feature that nobody brought up yet, I think. It's multi-platform. It currently has official task runners for Docker, Isolated/Raw Fork/Exec, Java, and Qemu. It has several community-based task drivers, including Windows IIS and FreeBSD Jails.

I think `rkt` and `lxc` are missing from your list.

> I tried using Nomad once after being a little worn out by Kubernetes' complexity. For some reason, the Nomad abstractions didn't click on the first couple attempts. In comparison, Kubernetes' abstractions mapped 1:1 to my understanding of the service oriented architecture.

<3 Nomad. However, Nomad only satisfies a really tiny part of Kubernetes ecosystem which is the ability to pack containers and schedule them efficiently in a cluster; Plus, it scales really well. Kubernetes provides a bit more than that.

> I think this is a big failing of the DevOps movement as a whole (at least what DevOps became in practice — devs doing ops) which results in things like passwordless mongodb exposed to the internet...

Hardly. If anything at all, it tells about the _team_ and/or the culture of the organisation. In any DevOps/SRE/Opsec culture worth the salt, an immediate blameless postmortem analysis would be performed to help with premortem analysis in future.

DevOps is not about exposing unsecured endpoints. You've got it all wrong son.