theanomaly

5 ms·

1.
by theanomaly 10mo ago
We're running Aurora PostgreSQL 15.12, which includes the fix mentioned in the release notes. Looking at this comment and the AWS documentation, I think there's an important distinction to make about what was actually fixed in Aur
2.
by theanomaly 10mo ago
AWS Support initially pushed back and suggested it's because of high replication lag but they were looking at metrics that were more than 24 hours old. What kind of failure did you encounter? I really want to understand what edge case
3.
by theanomaly 10mo ago
I'm surprised this hasn't come up more often too. When we worked with AWS on this, they confirmed there was nothing unique about our traffic pattern that would trigger this issue. We also didn't run into this race condition i
4.
A race condition in Aurora RDS(hightouch.com)
241 points by theanomaly 10mo ago|82 comments
5.
by theanomaly 10mo ago
While it's tough if you want new drives, I've found I could frequently get used drives on eBay that have significant history on Backblaze's report. Despite the increased risk from used drives, I've found I still end up m
6.
by theanomaly 9y ago
Because you could bypass filtering / approval mechanisms, or automatic image processing that could defang a malicious image.
7.
by theanomaly 9y ago
Right. So let's say we have file A, which is an innocuous image file, and file A', which is a malicious image file, where MD5(A) == MD5(A'). Based on the MD5 prefix collision attack, I should be able to construct two such f
8.
by theanomaly 9y ago
Ah I see, I forgot that in the SSL attack the attacker had to choose both certificate prefixes as opposed to just one. Thanks! It does seem to me though that if I could coerce/direct the site into accepting one image that I created,
9.
by theanomaly 9y ago
Looking at the image on the link, the "checksums" are a suspicious 32 characters... Hoping you guys are not using md5sums. Am I missing something, or would this let any node (supernode/browser) in the system potentially repla
10.
by theanomaly 10y ago
Thanks for the analysis -- it is good that people have this context in their heads when designing systems. The missing conversation from this article is that some people conflate scalability with performance. They are different, and you a
11.
by theanomaly 10y ago
Huh? I worked in school district IT for quite some time and a huge number of services are billed per-student.
12.
by theanomaly 10y ago
I'm confused It’s simple – here’s how it works: Say a community is built in Year 1. The community’s streets need to be rebuilt every 30 years. In Year 30 a new, identical community is built. Now twice the amount of taxes are com
13.
by theanomaly 10y ago
Yes, but you have to know to exclude their backend. And, that library may be several dependencies deep. Now you're expecting potentially junior developers to have the insight to grep their entire transitive dependency tree, find the
14.
by theanomaly 10y ago
Whoa. The author recommends including slf4j-nop as an explicit dependency of libraries?! This means that when a developer writes an application and forgets to include an slf4j backend, instead of getting a warning that no backend is confi
15.
by theanomaly 11y ago
The trick is to request random top-level domains, where each request will necessarily trigger a lookup to the root. Further, recent research has shown the number of open DNS resolvers to be in the range of 15-30 million[1]. Since the articl