Hacker News Reader

twistedpairon AWS SIGv4 and SIGv4A – How AWS signs and verifies API requests

> I was very surprised to see that awscli still doesn't support Yubikeys

Thanks, but you cannot[0] use hardware keys on the terminal.

[0] https://github.com/aws/aws-cli/issues/3607

twistedpairon gRPC for Microservices Communication

Swagger is handy here. Auto-generate your API model objects, interfaces, and REST clients in any language (e.g. Typescript).

twistedpairon AWS SIGv4 and SIGv4A – How AWS signs and verifies API requests

Feels odd that AWS still uses secret tokens all these years later. Take GCP for example. They use your personal identity (via OAuth, service accounts use certs), and you can use FIDO tokens to authenticate your local keys (e.g. for gcloud CLI). I was very surprised to see that awscli still doesn't support Yubikeys.

twistedpairon GitHub Actions: Ephemeral self-hosted runners and new webhooks for auto-scaling

And, if you restart a job, no new entry is made for the job history, so it just overwrites the job history on rerun.

This is likely because they modeled the jobs as one-per-job-def-and-commit, so they don't have a UX to show two.

This is a security blind spot, since you can do something naughty in a job, then rerun it and the logs are no longer accessible.

twistedpairon GitHub Actions: Ephemeral self-hosted runners and new webhooks for auto-scaling

What about the OSX runners? Those run in MacStadium, not Azure.

twistedpairon GitHub Actions: Ephemeral self-hosted runners and new webhooks for auto-scaling

I've been eyeing this for a while. My biggest hangup is that CI/CD is a major attack (e.g. supply chain) vector. If you use CI/CD for deploys, then a lot of highly privileged creds are in play.

I'd really prefer if GH made and managed the K8s operator (e.g. the most popular infra provisioning tool) themselves.

twistedpairon GitHub Actions: Ephemeral self-hosted runners and new webhooks for auto-scaling

We moved all our builds (e.g. 100+) to GH Actions. We've been using GH Actions since it was a daily tar ball drop in a private GH Slack channel in Q3 2019.

Happy to answer any questions.

The biggest challenge has been the many GH Actions service outages/impacts. We're working on moving to self hosted runners to mitigate this.

twistedpairon Workers are often told not to talk about pay. That's not legal

Given the ongoing inflation in the US is 5.4% so far this year, everyone has gotten their 5.4% cost of living increase for 2021, right?

twistedpairon Workers are often told not to talk about pay. That's not legal

A friend screened a female candidate years ago. She was highly qualified, with serious experience. When asked what her salary expectations were, she said what she made, but confessed she doubted the prospective employer could possibly pay that.

The reality was she was quite under paid. It's quite saddening that her prior employer seemed to have convinced her that such low pay was top of the industry mark.

twistedpairon Hospitals lift curtain on prices, revealing giant swings in pricing by procedure

Ever heard of coupons, rebates, bundles? All ways of adjusting pricing based on consumer price sensitivity.

twistedpairon The Framework is the most exciting laptop I've used

Plug it in when you get to work, plug it in when you get home, repeat for 5 years.

twistedpairon Google Docs in a clean-room browser

Having painful flashbacks. Script Debugger was sooooo useless.

twistedpairon Google Docs in a clean-room browser

Always a challenge trying to explain to a paying customer that "they're doing it all wrong", if you want them to stay a paying customer.

twistedpairon Renting a car will be a pain until at least 2022

Isn't is more of an existential issue?

If you're a rental company, looking at ~$0 income for the next year, and the need to pay for, maintain, and garage their car fleets, then you're top priority is to shore up the balance sheet and keep your corp afloat. What the car buyer's market will be in 18mo is a more distant concern.

twistedpairon Functional programming is not popular because it is weird (2016)

Seems that NumPy was written in Python b/c the ML community was using Python, not the other way around.

twistedpairon Functional programming is not popular because it is weird (2016)

The Spark data processing platform was/is popular, and is written in Scala, a.k.a. FP.

twistedpairon Leaded gas was a known poison the day it was invented (2016)

Don't forget UL94 as well. You can already buy it at select airfields.

twistedpairon Leaded gas was a known poison the day it was invented (2016)

Aluminum and metal particles. There are various (inconclusive) studies suggesting a tie between metal particles in the blood/brain and dementia. Ever notice that foods now say thing things like "Ingredients: baking powder (aluminum free)", that you can get "Aluminum free" deodorant, etc?

Liking to stack the deck in my favor, I've moved to all stainless steel and cast iron cookware.

twistedpairon Ask HN: Who is hiring? (September 2021)

mabl | Boston, MA | Software Engineer | ONSITE/REMOTE | https://mabl.com/careers

Bring AI to software testing at mabl. We provide automatic, self healing testing of web applications using advanced ML and AI techniques to replace the tedious and fragile UI testing of yore. Consider us a smarter, auto-healing Selenium.

We’re a 100% serverless operation built on Google Cloud Platform that rapidly develops and deploys features on a CI/CD model. Four years in, we’re a recognized industry player and growing our engineering ranks to keep building out our platform.

Our open positions:

- Software Engineer

- Head of Customer Success, Head of PM, PM

- Enterprise Sales, Account Executive, Sales Engineer

Our stack is built with modern Java 11, TypeScript, and some Bash glue

Drop me (an engineer), any questions joe at-symbol mabl.com, and checkout our careers site [1]. We can’t wait to work with you.

[1] https://www.mabl.com/join-the-team#jobs

twistedpairon If software engineering is in demand, why is it so hard to get a job?

Had a similar Google interview ~10y ago, shared GDoc. Phone connection was poor, interviewer refused let me try another line. I'd ask clarifying questions and he'd just keep acting annoyed and saying "Are you done yet?"

Frankly the most annoying interviewer I ever encountered. Served as a low water mark and inspiration for me to be as helpful, thoughtful, and kind as I could be in the next 100 phone screens/interviews I conducted for my employees.

FWIW, I've been to many a Google campus and know many employees there, so I think this was an outlier.

twistedpairon Incident with GitHub Actions, API Requests, Git Operations, Issues and more

`watch -n1 "git push origin"`

Time for lunch. The push will get through eventually.

twistedpairon Remote code execution in cdnjs of Cloudflare

I'd suggest GCS+Cloud CDN or S3+CloudFront.

I've been running several sites off Firebase Hosting the last 4 years and have seen surprisingly high downtime, cache clearing errors, and unexplained 502 errors from Firebase Hosting.

twistedpairon Npm Audit: broken by design?

> That npm dependency trees are often insane

For my hundreds of repos (Java, Scala, JS, Typescript, Python...), Snyk flags 99% of the CVEs for the JS repos. Shocking how I've only seen a few dozen or so Java based CVEs flagged over the last few years.

Perhaps it's because my NPM based repos have ~10K more dependencies? That and the Java stdlib handling most needs w/ the vanilla lang.

twistedpairon Npm Audit: broken by design?

I had a researcher contact me about a "vuln" in an OSS effort of mine once. The vuln made no sense w/ how the tool was used, but they published and I earned a CVE scarlet letter nonetheless. I finally "fixed" it, but IMHO, nothing was ever broken or vulnerable.

twistedpairon Npm Audit: broken by design?

Would be nice if package.json had a flag to indicate the runtime would be either Node.js or a browser. So many of these "bugs" have no bearing in a browser context.

twistedpairon Up to 1,500 businesses affected by ransomware attack, Kaseya CEO says

Did the RMM box really have to be on the open internet? In infra I run, anything with a public IP is behind numerous layers of FWs and VPNs, why not the same here?

twistedpairon Up to 1,500 businesses affected by ransomware attack, Kaseya CEO says

It is; just move to the cloud.

AWS S3 and Google Cloud Storage have Retention Policy Locks [1] and fuse bits in their buckets. e.g. set the retention policy on your backups bucket to 1 year and burn the fuse bit.

Now files cannot be deleted or changed in that bucket for 1 year after their creation. Not even the account root owner contacting support can get it changed. No ransomware, short of breaking into the AWS or GCP control plane is going to compromise those backups.

1. https://cloud.google.com/storage/docs/bucket-lock#policy-loc...

P.S. remember the write protect tab on old floppies/tapes ;)

twistedpairon Up to 1,500 businesses affected by ransomware attack, Kaseya CEO says

Only 1500? Phew.

Please tell me that my most onerous and security conscious customers weathered this just fine. You know, the folks that lock down ports by jack number, MAC address, and user. The folks that MiTM everything and instantly cauterize a port if the traffic becomes suspect. Please tell me they made it through this OK and that all the security theater was for something.

twistedpairon Up to 1,500 businesses affected by ransomware attack, Kaseya CEO says

What if you could somehow rate limit it? e.g. you can access N remote offices per day, but not all of them. Like the time lock on a safe, to prevent these pervasive smash and grabs.