dward

6 ms·

1.
by dward 6y ago
Spanner and Dremel/BigQuery are both SQL database in that you interact with them by sending them SQL. Maybe I don't understand the terminology.
2.
by dward 6y ago
Just run apt install billion-$$$-arr regulated-institution and write a systemd unit file, then run apt upgrade occasionally. What’s the problem?
3.
by dward 7y ago
GKE can't offer financial backed SLOs without charging for the service. This is something that, I assume, significant customers want and that competitors already have: https://aws.amazon.com/eks/sla/
4.
by dward 7y ago
https://cloud.google.com/armor/ GCP Network has built in DoS mitigation as well (e.g. in the load balancing layer) so you get some protection from that for free.
5.
by dward 7y ago
HMACs do not require collision resistance from the underlying hash to provide secure message authentication. HMAC-MD5 is still considered "secure", although that doesn't mean you should use it. http://cseweb.ucsd.e
6.
by dward 7y ago
Identity aware proxy supports SSH tunneling which means you don't need to manage a bastion. https://cloud.google.com/iap/docs/using-tcp-forwarding#tunne... For connecting VMs without public IPs to the outside
7.
by dward 7y ago
See also std::embed.
8.
by dward 7y ago
An ecosystem has evolved around Borg. Custom hardware, kernel, schedulers, telemetry, atomic clocks, networking, security, management... have all evolved around Borg proper to meet the "enterprise" needs of one of the largest ente
9.
by dward 7y ago
A zero-day is an interesting label to put on a bug disclosed "after the company failed to fix the issue within 90 days". I guess, you learn something new every zero-day.
10.
by dward 8y ago
The policy seems sane. * They know when they can serve 0RTT from their cache safely because they can be reasonably certain if handling a cached request is side effect free. * If connections to backend origins are reasonably persistent, ther
11.
by dward 8y ago
Oomd reminds me of userspace OOM handling mechanism proposed by David Reintjes of Google: https://lwn.net/Articles/590960/
12.
by dward 8y ago
Use go for what? DNS resolution? The default behavior is to use the system DNS resolver. The Go resolver will be used if the system is resolver is not avaialble (e.g. if the binary is compiled as pure go) or if the net.Resolver has the Pref
13.
by dward 8y ago
By default, go compiles binaries linked to libc to use the system DNS resolver. It does re-implement a DNS resolver but it's only used if CGO is disabled at compilation time.
14.
by dward 8y ago
Jerk is the derivative of acceleration. I haven't heard jank used in that context.
15.
by dward 8y ago
Albeit this was years ago but I was referring to the construction linked from the original paper proposed in: https://cs.nyu.edu/media/publications/TR2013-962.pdf It’s pretty unweildy compared to HMAC construction
16.
by dward 8y ago
The published asymmetric macaroon constructions were pretty gross last time I looked. We were missing a practical asymmetrically verifiable append only signature. This deficiency rules macaroons out of numerous use cases (namely where the r
17.
by dward 8y ago
Token binding changed a few things as it evolved from origin bound certificates, notably: * moving from using client certs to signing exported keying material[0] to prove key possession * adding support for RSA keys * adding support for mul
18.
by dward 8y ago
A couple corrections to the section on token binding: 1. It works on all TLS connections, not just mTLS connections. It even works on unauthenticated TLS (although I wouldn't advise forgoing server authentication). That's the beau
19.
by dward 8y ago
You can map ingress/egress channels of a network device directly into a processes memory inuserspace. These are just memory pages in what's known as the DMA region that the device can write to without interacting with the CPU.
20.
by dward 8y ago
> Package ptrace provides a ptrace-based implementation of the platform interface. This is useful for development and testing purposes primarily, and runs on stock kernels without special permissions. From: https://godoc.org&#
21.
by dward 8y ago
It's been used in production to sandbox specific workloads for years.
22.
by dward 8y ago
I don't think ingress filtering on Google's edge would have helped if the rerouting happened in any of the transit ASs between AWS and Google.
23.
by dward 8y ago
Allo supported e2e encryption in incognito mode. https://signal.org/blog/allo/
24.
by dward 8y ago
I’d say that’s the how. Why do you look at it when you do not wish too? Habit? I’d suggest trying to be mindful of your body/subconscious/emotional feedback next time you have the urge to look. Try to figure out what feelings cue
25.
by dward 8y ago
Why does it distract you?
26.
by dward 8y ago
These services offer hardware bound keys, are maintained by O(hundreds) person security orgs (read managed auth[n/z], audit, intrusion/tamper detection, backup, etc...), stored in data centers with strict physical security. For th
27.
by dward 8y ago
I was speaking of the "odd workaround", not about using cpu isolation.
28.
by dward 8y ago
This wouldn't even work with the completely fair scheduler, which is the Linux default scheduler. https://en.m.wikipedia.org/wiki/Completely_Fair_Scheduler
29.
by dward 8y ago
Google has been experimenting with and deploying blockchain technology since before 2013. Certificate Transparency[0], designed at Google, stores certificates in a distributed merkle tree. Any certificate that Chrome accepts as valid is sto
30.
by dward 9y ago
> The people that work on upstream k8s in Google (Tim et al) have a pretty limited overlap with the Google Cloud people that run GKE. Upstream k8s is a full time job so they are most certainly not spending their time also writing interna

More ›