rob-olmos

Would strace have been of any help?

I would guess that could show some kind of open() and "not found" or other syscalls on file descriptors like stderr just before crashing and that could be good leads or where into look next.

The recommendation is to have at least one backup key.

There's also a WebAuthn extension in the works to at least make it easier to maintain a backup key by not having to pull it out of the safe every time you register MFA with a new service:

https://www.yubico.com/blog/yubico-proposes-webauthn-protoco...

Related to the Spotify desktop client, I still don't understand why I have to restart the app when my internet connection is interrupted.

Some example code on how to use these headers to allow/reject requests:

https://web.dev/fetch-metadata/#step-5:-reject-all-other-req...

And the wonderful issues that can come with it sometimes. Although I suspect much less now that large responses are more common.

Back in the day a very popular registrar that included DNS service would have random issues with the size of DNS response when it switched over to TCP, returning servfail instead of answer.

I'm guessing it was a load balanced cluster and some of the servers were broken. We reported the issue a few times but never heard back, as expected.

For Stripe, there's two headers that can help clients with retrying or not: "Idempotent-Replayed: true"[1] and "Stripe-Should-Retry"[2].

Whether they're helpful in all server-side error situations I'm not sure.

1: https://stripe.com/docs/idempotency#sending-idempotency-keys

2: https://stripe.com/docs/error-handling#the-stripe-should-ret...

I was excited and hopeful for Scopeware Vision back in the day.. or at least to have MacOS "application windows" or "mission control" UIs to be a bit more 3D layered/cascade with easier to navigate through them, kinda like Cover Flow or Time Machine's view.

What's the CoinBase method for connecting via ACH or is it only wires? Funding via ACH would just be two numbers, at the easiest.

I've been interested in any smart contract languages/VMs that are somehow more capable of being provably correct/secure. The only one I've come across is Kadena, which internally uses the Z3 prover, but I haven't looked into the source code in depth or if it's able to be applied to custom smart contracts (dApp) as well.

Are there other blockchains that are similar? Is there a strict subset and prover for Solidity or other languages? Or things like proven smart contract kernels that can be built on top of? Eg, OpenZeppelin Contracts, but with provers rather than only audits.

It depends on the setup. Some cloud load balancers like AWS ELB require a CNAME, which DNS (RFC 1912) doesn't allow other records at that level if it has a CNAME.

So, can't put a CNAME on the apex, which probably also has MX records. I think in some cases like Exchange, if it sees a CNAME, it doesn't bother with looking at the MX.

Back in the day "CNAME flattening" or aliases (RFC draft draft-ietf-dnsop-aname) wasn't a common thing, so only real way was to redirect the domain apex to www, and then use a CNAME on the www. You'd probably need a separate service/servers to handle that redirect (at least DNS round robin would work in this case). So yea extra complexity in that case, due to the requirements. Or, give them DNS authority (eg, AWS Route 53).

Then there's the whole era of TV/radio commercials telling people "www dot <name>" that a lot of people type it anyways. You can redirect www to apex, which some sites do for a "clean brand" but now browsers are dropping the www in the UI anyways.

I've also run into plenty situations where www worked but apex didn't. Relatedly, it's a little surprising that browsers didn't default to assuming typing the apex in the browser it would try www first. And recently, now we're getting SVCB and HTTPS DNS RRs along with A/AAAA (and maybe ANAME). Indeed lots of complexity.

If each Route 53 POP is already close to the querying DNS client, then things like geo routing with cached answers might just work well enough in most cases? With each POP having its own cache.

Auto-refreshing the popular records in the background before the TTL expires to help smooth over any temporary issues?

Other big name DNS providers have ALIAS type records. I imagine according to the SLA, AWS Route 53 is still "available", even if it can't resolve a "target address record" (as the ANAME draft calls them) but Route 53 is still able to respond.

> The thing about a "brownout" is that service goes away, and then it comes back - for a while.

I don't want to beat a dead horse at this point, but that's basically a planned blackout. It'd be similar to a power company cutting off a residence's power for a couple hours to remind them to pay their overdue bill. I can't see that being correctly called a brownout.

I agree on more descriptive language. Sounds like then "blockout" or "password authentication blockout" would be the better language than "brownout", since that's what they're doing, blocking password auth.

I believe that's what I'm saying, password auth isn't being dimmed, it's experiencing a blackout. Ie, "password authentication blackout".

Regarding the offensiveness, I was hinting at GitHub's prior remarks for racial sensitivity: https://news.ycombinator.com/item?id=23500093 -- among the many other projects that have actively changed black/white to block/allow and other variations.

Relatedly, is "brownout" the best word for this case? If they did a percentage of auths or maybe intentionally made them take an excessively long time I could see it. Otherwise this looks more like planned blackouts. Or maybe an "auth flex period", since "brownout" or "blackout" might be offensive.

Might also be affecting GSuite/Workspace emails.

Great point. And potentially email delivery services that have auto-suppression lists to protect reputation, at least they might be able to remove entries on behalf of their customers.

The new project: https://rockylinux.org/ Forums: https://forums.rockylinux.org/

CloudLinux also announced a free alternative: https://blog.cloudlinux.com/announcing-open-sourced-communit...

Depending on TCP checksums and experiencing single-bit flips took down AWS S3 back in the day: https://status.aws.amazon.com/s3-20080720.html

What tools are your team using for remote dev?

Why an explicit null MX record? Mainly because email servers may keep trying thinking it's a temporary issue rather than an explicit configuration the domain does not receive email.

Some additional helpful info in this answer: https://serverfault.com/a/714070/53160

If it looks like this: \# 76 000100000100150568332D32390568332D32380568332D3237026832 0004000868121A2E68121B2E00060020260647000000000000000000 68121A2E26064700000000000000000068121B2E

That's the RFC3597 encoded form, probably because it's an unknown RR type. Taking a quick stab at decoding some of it according to "draft-ietf-dnsop-svcb-https-01":

\# 76 length; 0001 priority; 00 full registered name, null, "."; 0001 alpn key type; 0015 alpn value length; 05 alpn-id length; 68332D3239 alpn-id: h3-29; 05 alpn-id length; 68332D3238 alpn-id: h3-28; 05 alpn-id length; 68332D3237 alpn-id: h3-27; 02 alpn-id length; 6832 alpn-id: h2;

That's what the desktop/mobile app does for generating the TOTP code that's using the TOTP secrets on the Yubikey.

I'm not sure if a Yubikey's simplest mode as a HID device can read the device's wall clock it's attached to without additional drivers?

I would say most likely that is one of the goals since server-side is highly encouraged to run the container under the owner's subdomain...

and Google being prepared for smart devices like toasters that have enough resources to run GTM code with an ad blocker.

Module federation: https://webpack.js.org/concepts/module-federation/

Agreed. Like with Pocket's Chrome extension permission model[1] that has a "read everything on all websites", when really it only needs brief access to the URL when I want to save something.

I tried changing the "Site access" setting to "On click" -- but then the extension started acting funny or not working in some cases.

Chrome has added a more limited "activeTab" permission[2], but even that might be too much since it grants control to the tab and continues to allow permission on the same origin.

Like the GP said, even if the extension developer isn't trying to exfiltrate data, they should do more to protect users from a compromise of their extension, and browsers should give them the models to do so.

IMO, good security models can be a foundation forward to better overall security compared to desktop apps since it seems that browsers are becoming an OS of their own.

1: https://help.getpocket.com/article/912-what-permissions-does...

2: https://developer.chrome.com/extensions/activeTab

If I'm understanding correctly, currently "RUM Errors" is not "Error Tracking", and "RUM Errors" only records an error if that RUM session is actually profiled/recorded?

Ie., you have a RUM sample rate less than 100%, so some errors aren't recorded in RUM Errors? Will that be the same situation for "Error Tracking"?

Curious to see what this pricing is.. eg., any client-side errors get auto-included as a RUM session? There's a good amount of bogus browser errors due to incomplete or oddly sandboxed javascript environments.

I imagine AWS and other clouds have a staging/simulation environment for testing their own services. I seem to recall them discussing that for VPC during re:Invent or something.

I'm on the fence though if I would want a separate region for this with various random failures. I think I'd be more interested in being able to inject faults/latencies/degradation in existing regions, and when I want them to happen for more control and ability to verify any fixes.

Would be interesting to see how they price it as well. High per-API cost depending on the service being affected, combined with a duration. Eg, make these EBS volumes 50% slower for the next 5min.

Then after or in tandem with the API pieces, release their own hosted Chaos Monkey type service.

Thanks for the pointer. I wish something like that alert list existed for error/log messages of similar software.

I was going to try out Elastic APM for self-hosted APM option. Would that be the same case of a waste of time, energy, money? TIA for any insights!