ffk

5 ms·

1.
by ffk 6mo ago
A lot of the time once you get into multi-gig+ territory the answer isn't "make the kernel faster," it's "stop doing it in the kernel." You end up pushing the hot path out to userland where you can actually sca
2.
by ffk 1y ago
I think a more accurate version of this is: unit tests were not only per-method but also per functionality. This was often called BDD (Behavior Driven Development), e.g. Ruby's cucumber. Your intuition here is correct though.
3.
by ffk 2y ago
Since the 90s, New Zealand laws have been written in clear, modern, accessible English. The end result is the broader population understands it more and can also reason about it while it’s up for debate before being passed. I think the ambi
4.
by ffk 2y ago
Sometimes it’s done to fit into an existing tool/database that has a preexisting limit. Or when the hash is used only as a locator rather than for integrity. Not a good practice imo but people are pragmatic.
5.
by ffk 2y ago
Fun fact: docker started as bash, then moved to python before settling on golang. Also, in a 2013 docker meetup, someone wrote a docker clone in bash. People want to learn! Hopefully things like this help them.
6.
by ffk 2y ago
I'm guessing the decision comes down to ease of use for people to participate in mirroring. My underestanding is IPFS tends to require more infrastructure, and still requires someone to pin the data. Many bittorrent clients let you cli
7.
by ffk 3y ago
On the first point, OPA is much older than OpenFGA. To really illustrate the point, OPA became a graduated project about a year before OpenFGA had their first code drop in the public GitHub repo. The OpenFGA people are aware of OPA and I&#x
8.
by ffk 3y ago
Good question! The term is more generic, introducing something to an existing system to begin a chain reaction.
9.
by ffk 3y ago
There are some applications where the ability to vectorize the headers and operate on them with SIMD help. These types of apps tend to pin a full core to do only packet processing though. Also, syscall are expensive. A lot of work is going
10.
by ffk 3y ago
It depends on what you are trying to do though. I don’t think the kernel has an easy path to operating on a set of packet headers as a vector at this point. Not saying it can’t happen, but it’s an area where user space is already ahead. For
11.
by ffk 3y ago
Interestingly, the fastest CPU based network switches tend to do full kernel bypass. The kernel is generally slow compared to OVS and VPP, especially when they traverse over something like DPDK.
12.
by ffk 4y ago
If you secure a loan for or lease a car, isn’t insurance mandatory for completion of the transaction? If so, how are most people still driving Kias off the lot if they can’t get insurance? Ora are people getting insurance and finding their
13.
by ffk 4y ago
It’s probably validated by a human before the message is deployed.
14.
by ffk 5y ago
Agreed, one way to help mitigate this is to establish Layer 7 security controls, rather than implicitly trust the network. Tailscale shouldn't be the sole security control in any environment.
15.
by ffk 5y ago
Thank you for mentioning this! I wrote docker save and load, and I’m happy to hear that it helped you!
16.
by ffk 5y ago
Docker save (and presumably podman too) adds that metadata as a file in a tar. Each layer becomes a tar that is nested in the top level tar.
17.
by ffk 5y ago
Another insane idea, invite Japanese teams to play. Many Japanese people love baseball!
18.
by ffk 5y ago
Very cool! Found a gap, Linux Foundation's FD.io's VPP (a high performance network virtual switch) has native wireguard support as well, all in userspace. Support here means you can do full kernel bypass from the app all the way d
19.
by ffk 5y ago
Something to consider, if you are IO constrained, compression may speed up reads because you shift some of the cost of IO to the CPU. Ultimately, you'll need to measure this to know for sure, and those results will likely only be valid
20.
by ffk 5y ago
Been a while since I looked. My understanding is many of these techniques such as SMPC are useful only when operations are linear (eg no exponents or tan functions) and on simple branches. Others like homomorphic encryption require operatio
21.
by ffk 5y ago
Check out CBRS which is "licensed-by-rule." You should be able to use CBRS to deploy private 5G.
22.
by ffk 5y ago
Unfortunately, I don't think this is going to be the outcome. We're more likely to end up with "Here is the list of filenames, subcomponents, and associated hashes" as opposed to requiring NixOS style environments. Vendo
23.
by ffk 5y ago
It's not a joke, BGP servers used to authenticate each other with this in the late 90s. This was also before NAT was really a thing.
24.
by ffk 5y ago
Why not just implement Single Packet Authorization (SPA)? The port only opens to that specific source on a recent cryptographically signed request with a timestamp. https://www.linuxjournal.com/article/9621
25.
by ffk 5y ago
I believe grpc only uses the http2 frames, which are bidirectional. Double check this though.
26.
by ffk 5y ago
If it's using firecracker, it's probably using KVM virtualization while ensuring that the memory the VM consumes is not pinned... that is, that the VM can be swapped out of memory. For reference, firecracker was created by AWS to
27.
by ffk 5y ago
Pair X-Plane with PilotEdge, and you've got something that can help you with your radio skills so that you can effectively communicate with ATC. So many pilots go without flight following (asking ATC to watch your path and notify you o
28.
by ffk 5y ago
I think there is an inaccuracy in that comment. Double check this: wire guard encapsulates L3 IP packets, not L2 Ethernet frames. This means ARP is handled locally instead of being transmitted over the wire (or the need for an arp responder
29.
by ffk 6y ago
LEDs tend to give off a good range over the visible light spectrum. Incandescents tend to bias towards the higher end of the spectrum (towards red). Agreed that some research can also help find a good light. There are plenty of "full s
30.
by ffk 6y ago
They tried, but apparently the sale was blocked due to AI export control laws in China.

More ›