Hacker News Reader

pquernaon Scaleway: Bare metal SSD ARM servers

When you use a remote blockstore like they are as your storage, you also generally are always booting via PXE, and so far have a provider controlled kernel.

I used to work on Rackspace OnMetal: http://www.rackspace.com/cloud/servers/onmetal

https://journal.paul.querna.org/articles/2014/07/02/putting-...

In OnMetal this not the case -- you get local storage, you have your local kernel that you can re-install or do whatever you want to -- and if we have a control plane outage, you can reboot -- there is no dependency once your server is created on a provider hosted PXE server.

OnMetal isn't cheapo-ARM servers, but it is possible to build a "bare metal" cloud, which is truly bare metal, like you would normally get, and no remote block stores for your root FS.

pquernaon Infrastructure as code

The crew at Mailgun are kinda doing this, and its been enabled by vulcan proxy:

https://github.com/mailgun/vulcand

At first, sure, Vulcand is just another reverse proxy, but what they have been doing is registering individual HTTP handlers with the proxy -- into etcd:

https://github.com/mailgun/scroll

(there is a python implementation somehwere too, just can't find it)

What's neat about exposing these individual HTTP handlers, is now your reverse proxy can produce metrics, apply circuit breakers, etc, all in a central way, but your "micro" service just has to register with etcd:

http://blog.vulcanproxy.com/vulcand-news-circuit-breakers-be...

So, you end up with an architectural style where you can deploy a single HTTP handler as its own service, similar to what the article was pointing to, but in a multi-lanaguage approach, where HTTP is the communication method.

pquernaon Red Hat OpenShift 3 design document

From a quick read, this looks like more or less a ground-up rewrite of OpenShift?

Is anyone a user of 2.x? How does this feel?

pquernaon Official CoreOS Images on Google Compute Engine (2014)

Correct -- the base OS would auto-update, but with how it works today, you would still need to upgrade your own containers.

I don't believe this problem of updating dependencies in containers will last forever -- its pretty reasonable that you could mark some dependency as "auto-updatable" in your own container -- then when there is an OpenSSL issue, the base container OS is upgraded, and your app restarted.

pquernaon I Am Sam Altman, President of Y Combinator. AMA

This works OK when you have direct relationships with the YC Founders -- but when you are only tangentially connected in a big company... It is hard to know where rumors go.

pquernaon I Am Sam Altman, President of Y Combinator. AMA

I may or may not of applied to YC before; I decided to tell all of YC founders working at the same company ahead of time for this reason. It can get at least a little complicated when some of them are managers... of people applying.

Most of the YC founders ended up helping us with the application, and it wasn't a big deal, but I fully understand this feeling.

pquernaon We use RethinkDB

Have you thought about a "read at timestamp" construct in RethinkDB?

It's not really an MVCC thing, and you can work around it in data model, but for lots of reports (say, running in a cronjob), I want to run a query "as" the database saw things from at midnight UTC, even if i start running it at 2am? It would also make reports a more reproducible... but maybe this is really a datamodel problem. I felt when I read the Google Spanner papers that it was a pretty potentially useful feature for Read-Only queries.

pquernaon We use RethinkDB

Is anyone using RethinkDB as a "lightweight" Business Intelligence / Analytics / Datawharehouse store? (Maybe for use cases like Amazon Redshift?)

It seems like there could be a sweet spot of their nice query language, schemaless, and easy scaling for moderate size data sets?

I'm kinda tired of having to go all in on a big hadoop-ecosystem just to figure out average X to Y in a dataset....

pquernaon Tagged Logging in Go

I've used `logrus` in a couple projects and been pretty happy with it.

Easy to get rolling, easy to make chained loggers, and can do JSON in production or pretty colors when in dev environment.

pquernaon Email Encryption Software Relies on One Guy, Who Is Going Broke

Apache Software Foundation does not pay any software developers -- so its a very different model than what you are proposing.

pquernaon Don't Talk to Corp Dev

In my experience partnerships in a SaaS-like thing tend to be binary:

0) Press-release and a few links on a website: Basically worthless.

1) Sales-team integration: you train the partners sales force, they get quota retirement (somehow, this can be complicated), this has some great customer outcome -- you give them margin on re-selling/kickbacks/discounts/whatever to get access to their sales/marketing machines, making it worth their time/effort.

pquernaon When your IP traffic in AWS disappears into a black hole

It's common on these provider "isolated" networks to use a small /24 subnet by default.

I'm more surprised that AWS isn't sending a gratuitous ARP when IPs are re-cycled to mitigate issues like this.

pquernaon CoreOS is building a container runtime, Rocket

In theory, OVF is the 'answer' for Virtual Machines -- but its failure has been in adoption -- if you can't get Amazon and OpenStack to adopt it, what's the point?

Before Rocket/ACI there wasn't even a contender for Containers. Now there is a published spec. Start there. Iterate.

pquernaon CoreOS is building a container runtime, Rocket

personally, I think the long term value of Rocket is not about Rocket -- its about the ACI specification for the formats of containers.

Right now I'm already taking a Dockerfile, exporting it to a tar, and then running systemd-nspawn -- I love Dockerfiles, I love being able to grab a postgres server and get it up quickly from Docker Hub, but I didn't need or want the rest of docker.

If both Docker and Rocket support ACI, then you have a composable image layer, and that means people aren't locked into either ecosystem just to build images of their applications.

ACI :: Docker-tar-format to me is like QCOW2 :: VMDK. Wouldn't it be cool if projects like Packer[1] didn't have to exist, because the image format of Virtual Machines was open and documented as an independent standard?

[1] - https://www.packer.io/

pquernaon The sad state of server-side TLS session resumption implementations

Hi, Apache developer here, kinda a request for feedback on how we can improve the situation:

How would people feel about automatic key rotation that required time synchronization across a cluster?

Eg, on all your webservers, you have something like this:

    SSLSessionTicketKeyFile  /var/lib/apache2/session-ticket.key
    SSLSessionTicketRotation 1hour

Internally apache would calculate `HMAC(1hour-time, $key)`, and use that for the current hour (and allow the previous hour) for session ticket signing?

If you don't specify the TicketKeyFile, it would just randomly-regenerate a key every hour.

This is not perfect. It has issues. Like if your key is leaked when using a TicketKeyFile, calculating the session ticket secret for a given time is trivial.

pquernaon Libtls – New TLS API from LibreSSL

Yes, and BIOs are one of the parts that basically every major open source project uses:

Apache, Nginx, Node.js, curl, etc -- they all use the BIO API to provide TLS as a filter over their internal streaming APIs. Having personally worked on some of these projects, the current libtls API is not sufficient at all.

This isn't to say at all that OpenSSL's BIO API was great -- it could definitely use iteration all over -- and I hope libtls gets there, but it doesn't seem at all focused on realistic server workloads.

pquernaon The Amazons of the dark net

Well, I don't know about the 'dark' side, but I know @kordless has been hacking on StackMonkey:

https://www.stackmonkey.com/

Which lets you buy compute instances anonymously using BitCoin.

pquernaon DigitalOcean partners with Mesosphere

Yes, iptables is installed as a dependency of Docker, but is not configured to do anything:

		$ iptables -L -v
		Chain INPUT (policy ACCEPT 2172 packets, 459K bytes)
		pkts bytes target     prot opt in     out     source               destination

		Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
		pkts bytes target     prot opt in     out     source               destination
		0     0 ACCEPT     all  --  any    docker0  anywhere             anywhere             ctstate RELATED,ESTABLISHED
		0     0 ACCEPT     all  --  docker0 !docker0  anywhere             anywhere
		0     0 ACCEPT     all  --  docker0 docker0  anywhere             anywhere

		Chain OUTPUT (policy ACCEPT 2350 packets, 461K bytes)
		pkts bytes target     prot opt in     out     source               destination

pquernaon DigitalOcean partners with Mesosphere

That is a horrible glib answer.

I was supposed to get a EASY TO USE, READY TO GO, Mesos development environment. So now I have to ssh to 5 boxes and manually add iptables rules? Why don't I just install Mesos myself then?

Honestly this whole thing just reads to me as a marketing releases, not something I would recommend anyone to use.

If the answer is 'use' iptables, fine, but then I would expect the automation that builds my cluster to do it for me, not leave me with a $200 a month cluster just waiting to get hacked.

pquernaon DigitalOcean partners with Mesosphere

This seems completely insecure. I just spun up the small cluster, and it does nothing to firewall off or isolate the instances from the internet?

Eg, Zookeeper is listening on port 2181 on the public internet?

How is this OK?

pquernaon Everything you need to know about the Shellshock Bash bug

CGI is an interface first defined 1993, 21 years ago. No one thought setting user data in environment variables was a risky thing at the time.

More modern interfaces between dynamic code and webservers, like even FastCGI or SCGI or dozens of others do not pass user data over Environment variables, and instead pass data in various protocols over a socket.

pquernaon Show HN: Tyk – Open Source API Gateway written in Golang

Have you looked at Vulcan Proxy?

http://vulcanproxy.com/

It doesn't have the SaaS thing y'all be doing, but the APIs and structure of the proxy seem pretty well thought out....

pquernaon The Making of OnMetal

Strictly speaking, you can get traditional vendors to do firmware signing -- but getting them to put your public key in there will be more difficult, with volume most of the big vendors will be... accommodating.

Dell's 12th generation PowerEdge for example has a pretty good baseline outlined here:

http://en.community.dell.com/cfs-file.ashx/__key/telligent-e...

But that only covers the BIOS really, not things like firmwares in different PCI cards. But its a start.

pquernaon The Making of OnMetal

I'd like us (Rackspace) to publish a full whitepaper about what we have done, but I'll break down things into two topical areas:

1) Requiring signing of all firmwares, and putting those firmware private keys in control of Rackspace whenever possible.

2) Disabling systems of integration between the BMC and Operating system -- for example we completely disable the HECI bus, removing a major surface area for the operating system to affect the BMC.

pquernaon Clutter is taking a toll on both morale and productivity

Timezones are... unfortunate. I work in Pacific time, but have co-workers in Central, and Eastern. My 11am meeting is their afternoon.

pquernaon Backend Teardown: Muut

hadn't realized it had been open sourced so recently, just 8 days ago was the HN discussion on AerospikeDB being open sourced:

https://news.ycombinator.com/item?id=8093476

pquernaon Backend Teardown: Muut

Curious on the Docker usage in production, are they using host networking or another way of doing load balancer integrations?

(me, I'm a fan of vulcanproxy[1], even if it is a bit young)

[1] - http://vulcanproxy.com/

pquernaon Show HN: A Marketing Bot That Sells OpenStack Cloud Instances for Bitcoin

I work for Rackspace, we have a cloud. Sometimes people do illegitimate things with it -- but attackers using resources fall generally into two groups:

1) Fraudulent Payment method (eg, stollen credit card)

2) Someone hasn't patched Wordpress (or another app) in 3 years, box gets hacked, then used for bad things.

So, at least with paying via BTC for compute, you pretty much eliminate #1 -- in all cases the provider gets paid, no chargebacks, etc.

pquernaon Show HN: A Marketing Bot That Sells OpenStack Cloud Instances for Bitcoin

Pretty cool demo!

The pre-pay model works well for reservations of a VM, but what are your thoughts about consumables that vary, eg Bandwidth? Would you imagine service providers just say, hey X VM includes Y gig of transfer per hour?

pquernaon Putting Teeth in Rackspace Public Cloud

avoiding too many forward looking statements

As a general principle we will add more form factors.

For your specific example hardware, that kind of specification could be achieved using the Open Compute Micro Servers / Server Card designs, instead of the full-on 2 processor windmill designs:

http://www.opencompute.org/assets/motherboardandserverdesign...

As you make smaller servers, things like HA-Networking become a higher portion of the cost too, so it might be more feasible if we dropped the 2x10g Bond and went to a single 10g port for example, would losing the HA networking but having those kinds of specs be interesting to you?