0xbkt

It always is.

I can't deploy as often as I want because some Sidekiq jobs run for several days, and deploying code means disrupting those jobs

Sounds like a use case for Cadence/Temporal-style fault-oblivious stateful execution with workflows. At last job, we did Unreal Engine deployments with pixel streaming at scale on a huge fleet of GPU servers, and the way we could persist execution state so hassle-free that the code would magically resume at the line right where it got interrupted was so astounding.

This read, for some reason, reminded me of Farnam Street's “Why Life Can’t Be Simpler”[0].

[0] https://fs.blog/why-life-cant-be-simpler/

but has this been tried in court?

Yes, it seems: https://torrentfreak.com/ovpn-wins-court-battle-after-pirate...

Tangentially related: what do you use today to make authn/z work for your web sites/applications where you only do first party login (i.e. you don't do social login etc.)? Create a `users` table in your database and implement the logic on your own? Or proxy to stuff like Ory Kratos and act as a translation layer through a network call?

If possible, collect fingerprint information through a side channel such as WebRTC or WebTransport, and use the info to correlate payments. Or, if the attack is executed from a non-browser environment, you can pattern match the order of TLS cipher suite to that sent by the attacker and block them straight away.

Does anybody know about the current status of SR-IOV for graphics cards? It is highlighted for NICs but I want to know if there is anything upcoming for GPUs too.

What's going on in this code for someone completely alien to C++?

I think the closest thing to "nanofunctions" today are V8 isolates.

You can be able to identify those requests by inspecting the TLS cipher. Cloudflare Workers has that value in `request.cf.tlsCipher`[0]. Keep in mind the collateral damage it may have, though.

[0] https://developers.cloudflare.com/workers/runtime-apis/reque...

I had to resolve a similar connectivity issue for a client a couple months ago. The server was in Canada, but for some reason, Cloudflare's Asia-Pacific PoPs didn't want to reach this server and returned 525 SSL Handshake Failed error instead. So, I went ahead to install Cloudflare Tunnel, because I know that instead of waiting for Cloudflare to move through the Internet up to the last mile to the origin, I could establish long-lived connections to them over multiple PoPs so that the traffic from entry PoP(s) would stay in Cloudflare's network perimeter. This is assuming that your Tunnel connections are healthy no matter what. And the problem was gone.

The path basically transitioned from:

Entry PoP <----> Origin

to:

Entry PoP <----> Tunnel PoP <----> Origin

What is Ersatz?

Is this feature fully rolled out yet? I still see unicast IPs connecting from the entry colo and traceroute confirms that.

TLDR: they're now using anycast for egress, not just ingress.

I don't see this behavior in my setup. I have a server in AMS and connect from IST, but `netstat` reveals a unicast IP address that is routed back to IST.

I am interested in knowing more about possible deployment options that workerd is going to offer. Any plans to cluster workerd nodes up to propagate code changes through a central orchestrator API? Or can we expect to have something like Krustlet on K8s but for workerd instead of wasmtime?

Mind elaborating?

Why is server-side rendering considered "legacy" nowadays?

[...] if they were rewritten in native code, [...] Throw it all on a minimal OS that provides networking and some file IO.

You may want to check out MirageOS[0]. It gives you a library OS with the primitives you say you need, and then all you have to do is import them in your application code as if you are writing your typical OCaml, build the virtual appliance and boot it up anywhere you want.

[0] https://mirage.io/docs/overview-of-mirage

How does this compare to Vagrant or devcontainers[0]?

[0] https://code.visualstudio.com/docs/remote/create-dev-contain...

PHP front end

Do you mean that you are fetching data from an internal API and sending server-rendered HTML response to the browser? I always naively thought GitHub worked this way. Build a GraphQL/REST API that exposes all of your system's internals, query/mutate through it and send an HTML response in the "frontend" (Ruby on Rails etc.). Frontend, but in terms of an application server that in turn accesses everything through an internal API.

I was never successful in getting both mic and HQ audio working with BT on PulseAudio. Configuring to use A2DP gives the most fulfilling sound quality while nullifying the mic, thus becoming a huge deal-breaker for me. Does PipeWire incorporate any wizardry to overcome this and let me have simultaneous access to both mic and high quality audio? I have a JBL Everest Elite 700 and I am running on Ubuntu 21.10.

only using a single CPU core

How does it go when you deploy a unikernel on EC2 (or on any IaaS where the hypervisor is managed unlike bare-metal) with multiple cores? Is there a way to start a unikernel per core on a single instance, or are you bound to use single core instance types only?

This might also be an interesting read for those curious about TLS fingerprinting: https://news.ycombinator.com/item?id=29472624

See https://github.com/Fyrd/caniuse/issues/5707 and https://chromestatus.com/feature/4854144902889472#consensus.

Same here in Turkey. But this one is an int'l transit provider.

Posted this[0] months ago, even sent emails to Cloudflare NOC multiple times and nobody did even care.

[0] https://community.cloudflare.com/t/censored-pop-orpheus-not-...

Wow, that's interesting. Does a network stack also have a characteristic that would factor in the fingerprinting of a client? TTL, maybe? And hardware (e.g. network card) too.

Yes, the whole point is to absorb user traffic into their own backbone in the first-ish mile rather than let it travel across public Internet up to last-ish mile.

What the fuck? They don't even allow hosting of adult content[0].

[0] 8.2. of https://www.hetzner.com/assets/Uploads/downloads/AGB-en.pdf

NTT/RagingWire VA1.

Here's the details about the sea shipment that was sent from Hetzner Online GmbH in Germany to the US subsidiary: https://www.importgenius.com/importers/hetzner-us

Spamming HN while looking to promote their own product in a rather off-putting way... I can't be the only one to think this looks like a project born dead, producing no sufficient traction in its own entirety to attract people, hence the OP's acts. *sigh*