whiatp

6 ms·

1.
by whiatp 2mo ago
Yeah, if the CPU has a an embedded TPM that would be way better than the external ones. I'll admit that my experience comes from somewhat dated hardware. The point I was making was about registering new EKs/certs into your set of
2.
by whiatp 2mo ago
Something worth calling out is that, as far as I've seen, most server TPM implementations are not great against physical access attacks. If servers might be physically compromised (eg. you are leaving a server unsupervised in a colo) s
3.
by whiatp 2mo ago
This article is about using TPMs on servers, not employee devices.
4.
by whiatp 4mo ago
Many large distributed systems are built around pushing data through web requests, and human readable request/response formats (JSON, XML) are the most popular, and require integer to string conversions for serialization.
5.
by whiatp 5mo ago
I remember a coworker having to fight with an old platform's build not working because our user/group IDs were bigger than 2^16. I can't remember which utility was causing the problem, I'd have to guess tar. This is when
6.
by whiatp 5mo ago
I'm curious what the concern is with the rust editions mechanics in place. Each crate gets to define the language edition it is compiled with. Even if dependencies up convert to later editions they can still be linked against by crates
7.
by whiatp 9mo ago
Something I've noticed that I never really see called out is how easy it is to review rust code diffs. I spent a lot of my career maintaining company internal forks of large open source C programs, but recently have been working in rus
8.
by whiatp 11mo ago
Long time back I'd play PS2 games in a chat window in EverQuest while waiting for mobs to spawn. I had a capture card that would overlay over a particular shade of purple that I discovered while trying to screen shot something from a g
9.
by whiatp 1y ago
CF had their route covered by RPKI, which at a high level uses certs to formalize delegation of IP address space. What caused this specific behavior is the dilemma of backwards comparability when it comes to BGP security. We area long ways
10.
by whiatp 1y ago
PMTU just doesn't feel reliable to me because of poorly behaved boxes in the middle. The worst offender I've had to deal with was AWS Transit Gateway, which just doesn't bother sending ICMP too big messages. The second worst
11.
by whiatp 2y ago
This made me think of a series of "war room" meetings I had been part of early in my career. Strangely enough, also a defect revealed when the platform was low on memory. This was also the issue where I learned the value of docume
12.
by whiatp 2y ago
bitbake -e <recipe> is super useful for that game. It dumps out a complete history of where all variables were set/changed, and their values along the way. I also use it to do what I call "variable shopping," where I ro
13.
by whiatp 2y ago
I spent a lot of time debugging an internal fork of an open source BGP implementation (really old quagga.) The confederation code always struck me as being nothing but weird exceptions to how BGP normally worked. I was happy to never hear a
14.
by whiatp 2y ago
Someone accidentally commented the translation in another post about AWS: https://news.ycombinator.com/reply?id=40541919&goto=item%3Fi...
15.
by whiatp 3y ago
Ah, should have googled. I stand corrected.
16.
by whiatp 3y ago
With all that investment in addresses I'm surprised AWS is still the first cloud provider to charge for them. (As far as I know.) It will be interesting to see if other cloud providers will follow, and if the cloud providers compete ov
17.
by whiatp 3y ago
I think the primary problem with domain fronting that ECH would solve is that ECH doesn't involve using a third party's domain name, potentially dragging a single third party into the censorship muck. My read of the support email