Hacker News Reader

ymseon GitLab Container Registry

The registry is just that: a registry. You can push a Guix-generated image to it if you wish and use with any container runtime. rkt supports the same API; the Docker relation is by name only.

In fact, being able to push static images directly to such a registry with Guix would be a great feature. Both for continuous integration (without needing Hydra) and for coupling with a cluster scheduler such as Kubernetes.

ymseon GitLab Container Registry

It's written in Ruby like Github, but the latter have considerably more experience running high-traffic systems.

Just perused their job page and will apply this week. Sound like they could use some Varnish and Ceph talent :)

ymseon How do you stop a randomized game from randomly being boring sometimes?

> XCOM2 has a slightly controversial "randomness compensator": repeatedly missing increases your chance to hit, and being hit repeatedly by the aliens lowers their hit chance.

Do you have a source for this? I'm not doubting you, but I've played copious amounts of XCOM2 (until it broke on NixOS..) and didn't notice. But now that I think about it, the hit chances are less predictable than in the prior games.

ymseon ZFS, BTRFS, XFS, EXT4 and LVM with KVM – A Storage Performance Comparison (2015)

Not the same, but there was an article about file system fuzzing recently: https://news.ycombinator.com/item?id=11469535

The presentation is focused on how the fuzzing technique works rather than individual file system performance, but the "time to first bug" is quite telling. Copied here:

    ext4 (2h)
    XFS (1h45)
    GFS2 (8m)
    NTFS (4m)
    NILFS2 (1m)
    HFS (30s)
    HFS+ (25s)
    ReiserFS (25s)
    OCFS2 (15s)
    F2FS (10s)
    BTRFS (5s)

I've had miscellaneous failures with the bottom three, but XFS and ext4 have been rock solid. Unfortunately ZFS and CephFS were not included.

Would love to see a Jepsen-style analysis of the various file systems too.

ymseon Worm going through unpatched Ubiquiti routers

What's the appliance? Most current consumer routers come with a backdoor called TR-069[0] that allows the ISP to provision and update the device. Recently other appliances than routers have started using the same protocol.

The session is initiated from the client, but if you can MITM it or compromise the provisioning server all bets are obviously off.

I have mixed feelings about TR-069, but don't see how devices can stay current without something like it.

0: https://en.wikipedia.org/wiki/TR-069

ymseon GNU's advanced distro and transactional package manager

They implemented the Nix model in Guile, so inspiration is selling it short. Although Guix have arguably passed Nix in terms of features already, with a much better command-line tool, a linter, importers for several external package registries and grafting[0] which is a real pain point in Nix.

I think part of the reason they are now cruising past Nix (despite 1/10th of the users) is that it's written in a proper programming language, and not a home-made language that relies heavily on bash.

That said, I'm really happy with NixOS after two years, and would not consider going back to any "conventional" distro for my own workstation. Coming from a Gentoo background, there is nothing like screwing up your system and simply booting into the previous generation :)

Having the entire system configuration in one place that can be version controlled is a big plus too. You can create a live CD, VM, container etc from the very same code.

Nix and Guix can also be used standalone (think Homebrew or Gentoo Prefix), and can be very handy shell tools. E.g. `guix environment foo`[1] will drop you to an ephemeral shell environment with all build dependencies of package foo available.

0: https://www.gnu.org/software/guix/manual/html_node/Security-...

1: https://www.gnu.org/software/guix/manual/html_node/Invoking-...

ymseon Reflections: The ecosystem is moving

Open Whisper Systems have asked LibreSignal to stop using their servers and may decide to shut it out.

See https://github.com/LibreSignal/LibreSignal/issues/37 and discussion upthread.

ymseon Why OpenBSD Is Important to Me

Note: they explicitly state "only two remote holes...", one of which can be found in this very thread.

Security problems are usually clearly marked in the changelog: http://www.openbsd.org/errata59.html

What really annoys me with OpenBSD is that users are expected to download the CVS source and compile it to fix problems rather than upgrade to a dot-release.

For a normal user that's fine, but if you have a bunch of servers you'll need a sophisticated build/deploy infrastructure to stay updated.

ymseon Prometheus: Monitoring for the next generation of cluster infrastructure

That's sensible, thanks.

What if the inside of the network is further segregated, and the Prometheus instance does not have access to all endpoints. Can I use the push gateway as a "proxy", or is a direct route required.

Sorry for the stupid questions. Now it's getting entirely academic of course :)

Edit: just re-read your post and saw the proxy note. Time to read the documentation again. This setup should make for a good blog post.

ymseon Prometheus: Monitoring for the next generation of cluster infrastructure

This is more a job ad than an article. I've wanted to try out Prometheus a while, but can't figure out how to:

1. make it highly available

2. play nice with firewalls

If I deploy Prometheus outside a NAT, and want to monitor 100 physical machines on the inside with node_exporter, as well as a dozen different services, how to make these metrics available?

What if I have four identical NATed sites and want them all monitored by the same outside Prometheus instance(s)?

ymseon GNU LibreJS

I had never looked up the OSI definition[0], but you are of course entirely correct. So the difference between free and open source software is the "four freedoms", which I think we all knew to begin with.. :)

0: https://opensource.org/osd

ymseon GNU LibreJS

It's not that simple. Open source implies the source is out there for anyone to study. Free software is not necessarily free of charge and readily available.

Nothing prevents you from paywalling a GPL program as long as you distribute sources to legitimate users on request. Free as in freedom, not as in beer.

ymseon GNU LibreJS

I'm curious, which products are you referring to? In most cases the GNU version predates the alternative by a large margin. E.g. screen vs tmux, squid vs varnish, wget vs curl, net-tools vs iproute2 etc.

Of more recent software "clones", there is guix vs nix, mcron vs vixie-cron, shepherd vs systemd, gnutls vs openssl, all high-quality implementations of good ideas.

Sure, lsh has a way to go before it's a viable alternative to OpenSSH, but I wouldn't say it's low-quality. I don't think I've come across a GNU project which felt "half-put-together", rather the opposite.

The GNU projects' motivation is very clear-cut and not at all different from e.g. the BSD camp or suckless. How are they questionable?

ymseon Proxmox VE 4.2 released

I haven't used Proxmox or oVirt (but know roughly their strengths), but can tell you right away that Openstack almost certainly is not what you want. Unless you expect CERN or Rackspace-level traffic, and are prepared to fork it and throw a dozen engineers at it.

The Openstack documentation is terrible, the user interface is awkward and clunky, and the configuration files for each component are several-thousand lines of Python code. Unsurprisingly it has more bugs than New Zealand, and regularly breaks in inexplicable ways. Additionally it does not support crucial features such as node evacuation or rebalancing, and you can't even use the built-in scheduler to pick a new host when live migrating.. And good luck upgrading from one version to the next.

If you're a small shop, oVirt or Proxmox are both solid options. Ganeti fits here too, but has a much higher barrier to entry (no web UI or guest OS support by default).

Source: used Ganeti for 6 years at three different sites, and recently resigned from my current job after one year of fighting Openstack because I could not convince my colleagues to pick a better platform.

ymseon Proxmox VE 4.2 released

Ganeti can use either Xen, KVM and LXC hypervisors -- I've actually only used the KVM backend.

I've used Ganeti Web Manager[0] in the past, but would probably try out Ganetimgr[1] for future installs. The command-line tools are very good however, and I don't think the web interfaces expose the full functionality (i.e. rebalancing, node evacuation, master-failover, etc).

0: https://github.com/osuosl/ganeti_webmgr

1: https://github.com/grnet/ganetimgr

ymseon Proxmox VE 4.2 released

For anyone looking to build a clustered virtualization solution, I recommend checking out Googles Ganeti: http://www.ganeti.org

It doesn't look like much, but is rock solid and supports everything Proxmox does and more, save for the lack of a built-in web UI (but there are several 3rd party ones, as Ganeti is 100% API driven).

No affiliation, but have successfully deployed it at multiple sites (and would love to do so again, wink wink).

ymseon We’re Going HTTPS: Here’s How WIRED Is Tackling a Huge Security Upgrade

My hobby: investigate the subjectAltName of SSL certificates. Didn't know Conde Nast ran Vogue, New Yorker and sold wedding dresses.

    DNS Name: wired.com
    DNS Name: *.condenast.io
    DNS Name: *.wired.com
    DNS Name: ads.thestudio.condenast.com
    DNS Name: allure.com
    DNS Name: *.allure.com
    DNS Name: architecturaldigest.com
    DNS Name: *.architecturaldigest.com
    DNS Name: bonappetit.com
    DNS Name: *.bonappetit.com
    DNS Name: brides.com
    DNS Name: *.brides.com
    DNS Name: builtwhileflying.com
    DNS Name: *.builtwhileflying.com
    DNS Name: cntraveler.com
    DNS Name: *.cntraveler.com
    DNS Name: cntraveller.com
    DNS Name: *.cntraveller.com
    DNS Name: condenast.com
    DNS Name: *.condenast.com
    DNS Name: condenast.io
    DNS Name: condenastdigital.com
    DNS Name: *.condenastdigital.com
    DNS Name: condenaststudio.com
    DNS Name: *.condenaststudio.com
    DNS Name: condenet.com
    DNS Name: *.condenet.com
    DNS Name: details.com
    DNS Name: *.details.com
    DNS Name: epicurious.com
    DNS Name: *.epicurious.com
    DNS Name: glamour.com
    DNS Name: *.glamour.com
    DNS Name: golfdigest.com
    DNS Name: *.golfdigest.com
    DNS Name: gq.com
    DNS Name: *.gq.com
    DNS Name: newyorker.com
    DNS Name: *.newyorker.com
    DNS Name: self.com
    DNS Name: *.self.com
    DNS Name: style.com
    DNS Name: *.style.com
    DNS Name: teenvogue.com
    DNS Name: *.teenvogue.com
    DNS Name: vanityfair.com
    DNS Name: *.vanityfair.com
    DNS Name: vogue.com
    DNS Name: *.vogue.com
    DNS Name: webmonkey.com
    DNS Name: *.webmonkey.com
    DNS Name: wmagazine.com
    DNS Name: *.wmagazine.com

ymseon Show HN: passgo, a command line password manager written in go

This question comes up every time a "X written in Y" is submitted. Some times the language implementation is a novelity, but usually it's just a non-redundant piece of information.

Many people on this site care about the language, so why should we not include it? People who dislike the Y ecosystem are free to ignore it, and people who have been looking for an X implementation save some brain cycles figuring out what it's written in.

Personally I think more articles should include this. I'm always disappointed when a cool-sounding project is written in Node..

ymseon Ask HN: How do you come up with a good name for a startup?

Paul Graham has done a couple of pieces on naming things.

http://aux.messymatters.com/pgnames.html (2006)

And later this from 2015: http://www.paulgraham.com/name.html

The gist of it is that anything will do, as the name will be associated with your product, not the other way around. Hopefully this can boost your confidence a bit :)

ymseon Weather in your terminal, with ANSI colors and Unicode symbols

Yet another terminal weather app (Go):

https://github.com/jfrazelle/weather

ymseon Ask HN: Can't concentrate to focus, until it's last minute or later

While knowing your MBTI type can be useful in some aspects, it certainly does not help with the issues OP is describing. Excercise is probably the right answer.

Source: chronic procrastinator who has been studying MBTI for years.

ymseon What to do with the “rm -rf” hoax question

https://news.ycombinator.com/item?id=11496947

ymseon Unix’s file durability problem

See also Linux Torvalds' opinion on O_DIRECT:

The thing that has always disturbed me about O_DIRECT is that the whole interface is just stupid, and was probably designed by a deranged monkey on some serious mind-controlling substances.

https://lkml.org/lkml/2002/5/11/58

ymseon Ask HN: Best linux laptop right now?

The high-end Thinkpads are generally safe choices. I've been really happy with my Broadwell X250, although there were similar kernel issues when it was flunking new.

Still does ~20 hours with extended battery after more than a year of heavy usage. And they're some of the most robust portables available.

ymseon Gone in Six Characters: Short URLs Considered Harmful for Cloud Services

I sometimes "curl -I" first to check what it redirects to before clicking. Would love a mobile app that registered as the default app for various URL shorteners and did the same.

ymseon Man accidentally 'deletes his entire company' with one line of bad code

Other giveaways:

* "more or less 1535 customers"

* ansible would fail if variables are unset (though they could be empty)

* no mention of --no-preserve-root

* who mounts an off-site backup, instead of pushing with scp/curl/whatever

* googling his name does not dig up any company

ymseon Show HN: Min – web browser with better search and built-in ad blocking

I really enjoyed "dwb" until the author abandoned it late 2014. Now they seem to have picked up development again(!):

http://portix.bitbucket.org/dwb/

It's fully keyboard driven (to the extent possible) and has a decent amount of extensions, including ad blocking and a great requestpolicy manager for controlling 3rd party requests.

ymseon Namecheap live chat social engineering leads to loss of 2 VPS

I can't reply to the sister comment for some reason, so I'll piggyback on the parent.

I always fill these with awkward or absurd questions/anwers that would be amusing if a human operator ever needs to verify them. E.g.

Would you like to go on a date with me?

What color pants am I wearing?

What is the square root of insanity?

Obviously you need to store these in a password database in order to remember them, which kind of defeats the purpose. If I have to choose from predefined questions, it goes along these lines.

Q: What was your mothers maiden name?

A: Why, are you stalking her?

Q: Where were you born?

A: Oh I can't remember, it's been so long!

ymseon What do you call this in Ruby?

https://metacpan.org/pod/perlsecret#Goatse

That whole list is gold. My favourite so far is "space station": -+-

ymseon Ditching tmux

I don't find <prefix>-PgUp a lot harder than Shift-PgUp. The tmux buffer also has the benefit that you can search, copy, write to file and more.

Oh, and I think tmux' "mouse on" lets you wheel-scroll the buffer, although I haven't used it.