pquerna

Actually, the origin is supposed to send a `Vary` header if it changes behavior based on any header.

So, if a client sends a 20kb `X-Oversized-Header`, when the server responds with a 400 -- it might be conceivable that it should include `Vary: X-Oversized-Header`.

Is that "really" the right fix? Probably not. But the HTTP RFCs provide `Vary` for exact this kind of reason within HTTP caching: the origin is varying its response based on a subset of headers.

Uber owns ~20 to ~30 percent of Grab, JFYI. They specifically exited the Uber brand from Singapore, and pushed Grab.

This isn't true in Retail. As far as I know, most of the top national retail brands in the US all use Azure or GCP as a policy over AWS.

The point is not about the minimum conformance, but rather the lock-in provided by the maximum configuration / extensions of each vendor.

Take AWS EKS as an example. Their feature page[1] does mention conformance. Then it mentions 20 other non-conformance focused features that create an effective lock-in.

k8s is becoming like OpenStack in this regards. You need to embrace a vendor version of k8s in order to have a functional cluster without a massive team.

[1] - https://aws.amazon.com/eks/features/

I thought an "interesting" part of the change was actually how they made a 50% chance work for the extra read. They select across a closed channel twice -- and it results in a mostly even distribution of chance.

    for i := 0; i < 100000; i++ {
        select {
        case <-closedChan:
            a++
        case <-closedChan:
            b++
        case <-closedChan:
            c++
        case <-closedChan:
            d++
        }
    }

Results in an almost even distribution across the select choices!

https://play.golang.org/p/cnAXBEZJm2B

(fixed playground link)

Love this article, but one thing it skipped on was more in-depth on Leap Seconds.

You see, UTC, is kinda like another human-made-up timezone. Humans made up some rules, and UTC is a 37 second offset from TAI / International Atomic Time:

https://en.wikipedia.org/wiki/International_Atomic_Time

(ffjson author here)

The main feature that ffjson has that most of the non-stdlib JSON libraries is stdlib compatibility. Eg, the same struct-tags and interfaces used in stdlib are used by ffjson. It's just trying move most of the reflection / allocations / etc to a `go generate` step vs runtime.

If you abandon trying to stay consistent with the stdlib JSON, and make new APIs/interfaces for propagating the encoder or decoder state, as Gojay has, it will undoubtedly be faster than ffjson or stdlib.

Partially agree, but the world is a big place. Lots of random internal resources do exist, even at big companies.

Internal resources are owned by many separate teams. They implement AuthN / AuthZ on their own. Resources might prompt for a username & password and then do an LDAP Bind with them, or they might have a local database, or they might use an SSO/SAML, or any other number of mechanisms.

Resource owners want to move fast, they want new internal apps. Central IT/Security wants to add WAFs, 2FA, centralized logging, and all kinds of other controls.

The BeyondCorp model moves these responsibility to an easier to deploy model. It's now centralized as a service, rather than each internal app needing to buy 5 security appliances that they are required to put in their rack.

Why can't the "Uberproxy" (in Google terms) consume Authentication mechanisms like spiffe[1] certificates and allow access to protected resources via those?

Theres no reason a BeyondCorp architecture needs to make automation or API access harder?

[1] - https://spiffe.io/

In a ByeondCorp-like architecture, BYOD is a policy decision. Google as a POLICY has generally said no to all unmanaged machines.

Some resources might require a managed machine by policy, but others may not.

Imagine your Corporate Cafe menu. You don't want it posted on Buzzfeed that y'all be having filet mignon on Tuesdays, but you really don't care about the posture of a device. Contrast this with your internal source code repository or wiki. You might really care about device posture for that type of resource.

Previously you had to put both the Cafe Menu and your Source Code under one big hammer: The VPN. Once you logged into the VPN you had carte-blanche access to all kinds of things.

BeyondCorp gives you a L7 place to drive POLICY decisions in a consistent manner.

not quite an infographic, but this site lets you slice the projects by different attributes:

https://projects.apache.org/

Intertwined with this announcement of an new instance type, is that it uses a non-Xen hypervisor.

Has anyone booted one yet? Is it KVM or something from scratch that AWS wrote?

Huh? What is your bar for "done growing". Because the rest of the normal publicly traded market doesn't grow revenue at 50+ percent a year. The average for the S&P 500 is something more like 3-4 percent revenue growth per year.

From data in the MongoDB S-1:

  2016 yoy revenue growth: 58%
  2017 yoy revenue growth: 55%

MongoDB is part of the same thesis as something like Twilio -- they IPO'ed over a year ago with the same belief around differentiating via developer-centric customer acquisition. Twilio is still putting up ~70% yoy growth.

According to LinkedIn data, Slack has >950 employees. Not 50.

They are going "big". Enterprise. Places Basecamp or hipchat never did or will.

> We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits.

This whole incident is really raising the profile of the creation of "cyber weapons".

They aren't like physical weapons with physical controls -- they are digital, controls and costs to copy/distribute are more like digital music than anything a Goverment organization is used to.

Many Xeon SKUs include the Management Engine, which at times has seemed to share many of the features of AMT/SBT/etc, but its unclear on the exact attack vector for this vulnerability.

Having said that, the ME is so opaque, the same type of vulnerability could easily exist.

I love the transparency of having your source on Github, but the license ambiguity isn't ideal when revealing this to the world:

  We are currently working on a new 
  license for Kryptonite. For now, 
  the code is released under All 
  Rights Reserved.

https://github.com/KryptCo/kr#license

Soon as I see that, I've got to close the tab, so does anyone who cares about IP.

(disclaimer: i'm a co-founder of ScaleFT)

Yes, at least the Docker images that use glibc as their libc. (eg, most Debian/Ubuntu images)

It looks like musl, which is used on Alpine Linux images for example, will only read it once, and then cache it:

https://github.com/esmil/musl/blob/master/src/time/__tz.c#L1...

It has a mutex/lock around the use of the TZ info, but avoids re-stat'ing the localtime file.

Good blog post explaining the behavior of glibc, I also saw this first hand when profiling Apache awhile back too:

http://mail-archives.apache.org/mod_mbox/httpd-dev/201111.mb...

https://github.com/apache/httpd/blob/trunk/server/util_time....

The internals of glibc can often be pretty surprising sometimes, I'd really encourage people to go spelunking into the glibc source when they are profiling applications.

one example i know of: http://scaleworks.com/

they bought Filestack (formerly Fileppicker), Chargify and a few more

Lew wrote about basically the same thing as sama earlier this month: https://medium.com/@lewmoorman/not-venture-scale-get-over-it...

I basically agree with you, but your analogy actually happened:

Woman says red zone painted after she parked:

http://abc7news.com/news/woman-says-red-zone-painted-after-s...

I used to work at Joost. Culturally, it came fro the Skype world, and I worked on the p2p engine used for both on-demand and live streaming of video:

https://en.wikipedia.org/wiki/Joost

The cost of delivering content is not zero. The main variables are the codecs & quality of a stream, which on average is going up, and the cost to deliver (bandwidth/storage). The cost deliver keeps going down.

So, there are periods of time, when a p2p approach "looks" nice. 4k? Maybe all this live-streaming stuff? Sure. But what happens is the cost of delivery with HTTP keeps going down.

Joost had a bunch of other issues that made it fail, un-related to the use of p2p.

p2p might be cheaper to operate for a business, but it has almost no advantages for users over a well built CDN. For users it only has negative attributes (baring a few situations on LANs / getting streams into places you can't put a CDN).

All in, about ~1.8bn annual budget in SF.

The Proposed Operating Budget for FY 2017 totals to $1,154.7 million[0]

The Proposed MTA FY 2015 and FY 2016 Capital Budget includes an appropriation of $562.9 million in FY 2015 and $669.0 million in FY 2016. [1]

Is that underfunded? SFMTA has massive basic accountability and prioritization problems, tons of more money wouldn't make those better.

[0] - https://www.sfmta.com/sites/default/files/agendaitems/2016/4...

[1] - https://www.sfmta.com/sites/default/files/agendaitems/4-15-1...

you might be interested in ScaleFT, we offer our product in a behind the firewall edition with similar goals/features to BLESS:

https://www.scaleft.com/product/

(I'm a ScaleFT co-founder)

> I'm sure they contribute back at least a little

Almost from 2 years ago:

https://news.ycombinator.com/item?id=9358843

But gist is, Amazon employees are generally discouraged from contributing to open source at all.

If you contributed a reasonable patch to Apache Mesos, implementing a feature like enhanced authentication, and then that patch was reject with such an excuse, that would be a problem.

But Mesosphere choosing not to contribute specific features back is their choice. The long term belief in a healthy community is that enough people will contribute patches that make the project better.

ScaleFT | San Francisco, CA; Austin, TX | Software Engineer | ONSITE

ScaleFT is a software security startup. If you already know about Google's BeyondCorp papers, then you will understand where we are going. We have created a new model of device attestation with ephemeral certificates for SSH & RDP, to provide authentication, authorization and user management.

We are looking for full time Staff Engineers in San Francisco or Austin.

# Client Engineer

This role is primarily in Go, but there is a mix of platform specific C, ObjectiveC and C#. Generalists & systems people have fun here.

The ScaleFT client software encompasses our ScaleFT Server Agent (sftd), our command line tools (sft), and our native client user interfaces on macOS, Windows, Linux, ChromeOS and FreeBSD. Our client software is how our customers interact with the ScaleFT platform, with the goal of make managing cloud infrastructure safer and more secure. This client software integrates our platform’s certificates into the native operating systems cryptographic stores (eg, Keychain on macOS).

https://www.scaleft.com/careers/staff-engineer-client/

# Backend Engineer

This role is primarily in Go. This role is focused on adding features and scaling the ScaleFT platform, which we sell as both a SaaS and on-premise. Experience with PKI is a major plus:

https://www.scaleft.com/careers/staff-engineer-backend-servi...

If you are interested, shoot me an email paul.querna@scaleft.com

WaPo headline: Trump urges supporters to monitor polling places in ‘certain areas’

https://www.washingtonpost.com/news/post-politics/wp/2016/10...

I don't think its perfect, but I think Yelp's search UI does pretty well for a ton of choices, and integrates Geo-boxing in a way that most people can understand more easily than within 20 miles of a zip code

Example:

https://www.yelp.com/search?find_desc=tacos&start=0&l=g:-122...

They keep the most common filters quickly available, make it easier to dive into more, and their search result entry contains the neighborhood so i can quickly figure out where something is, a photo, part of a review, phone number and address.

Almost 300 projects now:

https://projects.apache.org/

I wouldn't describe it as a "neighborhood full of foreclosures and zombie properties". Yes, theres been a bunch of drama around OpenOffice, but many projects are doing great.