TheSwordsman

As an American, I regret to inform you that you're trying to use logic to understand a situation where it seems like logic wasn't used (in terms of the economic impact). These are the same fuckwits that tried to claim a trade deficit is the same as a tariff.

Yep. The issue is most people I've seen who lean most on these tools do not have that discipline.

Hahahaha. That's actually amazing.

I'm waiting for the AI apologists to swarm on this post explaining how these are just the results of poorly written prompts, because AI could not make mistakes with proper prompts. Been seeing an increase of this recently on AI-critical content, and it's exhausting.

Sure, with well written prompts you can have some success using AI assistants for things, but also with well-written non-ambiguous prompts you can inexplicably end up with absolute garbage.

Until things become consistent, this sort of generative AI is more akin to a party trick than being able to replace or even supplement junior engineers.

Yeah, I'd bet their burnout risks aren't going to go away by just replacing k8s with ECS.

I also hope they have a good support contract with AWS, otherwise they are going to be in for a fun surprise when ECS has some weird behavior or bug.

Maybe it's just me, but it was a bit of a disappointing read when the author decided not to provide any details about what's replacing it. Would have loved to hear a bit more about the decision to move.

Although, considering the author mentioned a loan with a partner maybe they were trying to rebuild it in Google Docs or something so they could more-easily see it together.

The 11,000 may be limited by the suspension system.

So in terms of comparisons I don't think you're wrong, but it might be better to compare it to the F-150 Lightning for more of an apples to apples comparison. The F-150 Lightning Platinum vs Cybetruck AWD is probably the most fair comparison in terms of specs, but the CT is ~$20,000 cheaper

If we compare the F-150 Lightning Lariat with XR Battery to the Cybertruck AWD, because of price:

F-150:

Range: 320mi

Towing: 7,700lbs

Curb Weight: 6,361lbs

---

CT:

Range: 340mi

Towing: 11,000lbs

Curb Weight: 6,603lbs

---

F-150 Lighting Platinum to CT Cyberbeast, because of price:

F-150:

Range: 300mi

Towing: 8,500lbs

Curb Weight: 6,893lbs

---

CT:

Range: 320mi

Towing: 11,000lbs

Curb Weight: 6,843lbs

This does assume they aren't able to also compromise the encryption key used to protect the secret:

https://news.ycombinator.com/item?id=10845985

https://news.ycombinator.com/item?id=11136948

It's extremely risky to use MFA via text messages, due to the commonality of SIM swap attacks. Attacker calls your cell phone provider, executes a social engineering attack to authenticate as you, and can now route your phone calls and text messages to a device they own. It's a good idea to avoid SMS/Phone MFA.

If you use a token generator (Google Authenticator, Authy, or the one built into products like 1Password), a shared secret key is used to generate the MFA token. You store this secret in that software, and it uses the current time + that secret key to generate the MFA token.

This is a far better mechanism than the SMS or phone call based approach. And in this mechanism you can store the secret in any software that's able to generate the token using that algorithm.

Most commonly it's this algorithm: https://datatracker.ietf.org/doc/html/rfc6238

So as I mentioned in another comment, it's not entirely security theater. If the site enforces that an MFA token is truly one time use, then this can prevent replay attacks of your credentials being used to create a new session.

If someone compromised your password store, then yeah it's all over. But if the compromise happens elsewhere, it can be a useful layer to the security onion.

I have my password manager and can login with 1 click to all my sites. 2FA is always a pain in the ass and always extra effort on something my password manager already protects me from.

So I think there are a few potential issues with this argument based on assumptions you're making. I'd argue this isn't entirely true because:

1. Many password managers allow you to manually copy the password into your clipboard, which mean you could paste it somewhere that's unsafe / untrusted. Someone could then use this password to authenticate as you. Many sites disallow token reuse, so once used if you accidentally pasted that somewhere as well an attacker couldn't reuse the token.

2. Similarly, if someone has managed to exfiltrate login details you provide without being able to also obtain the session cookie sent back, and the site enforces one time use of MFA tokens, then the MFA token can also avoid a replay attack of your login details.

I'll admit the second one may be a bit contrived, because if they can exfiltrate login details it seems likely they could also just obtain the session cookie. But if said cookie is tied to a certain IP address, then that cookie is useless to them and they wouldn't be able to replay the credentials.

Disregarding the other replies for a moment where they rightfully call out that it wouldn't be radar, wouldn't they still need a publicly available API for this data if they wanted to access it outside of their house (e.g., when at the park)? So at that point, why add the additional complexity if there's already someone sharing ADS-B data to OpenSky for your area?

In the timeless words of Jay-Z:

    I didn't pass the bar, but I know a little bit. Enough that you won't illegally search my shit.

Seems kinda lame that you created a new account just to make this comment. Maybe instead of being mad that a mouse ate your food, get some proper food storage?

Dry facial hair.

I think there are many people who legitimately feel unsafe when they feel uncomfortable, which is an a super unfortunate situation because it makes critical conversations much harder. Even harder when the people delivering critical feedback do so in a poor way. If only humans weren't so complicated.

Gotta pad that performance review/promo packet.

Wayback Machine snapshot for anyone else getting the "exceeded bandwidth" error: https://web.archive.org/web/20230716210954/https://duskos.or...

This state machine is inherently unsafe for concurrent use, because the CurrentState and Transitions fields aren't completely protected by a mutex. You already have an unexported mutex that you lock when mutating those fields, but then consumers trying to read those exported fields are not able to lock the same mutex to prevent concurrent read/write operations.

You should not export those fields, and instead make them available via methods where the reads are protected by the mutex. You'll probably also need to make a copy of the map since it's a reference type, OR make the accessor take the key name and fetch the value directly from the map and return it. I learned this when I wrote a similar simple state machine in Go ~7 years ago. :)

I'd also make sure to return `T` from the CurrentState accessor method and not `*T`, just to make it easier for consumers to do comparison operations with the returned result.

Reference on Go memory safety: https://go.dev/ref/mem

I think the Supercharger network was a significant competitive advantage. With the news today that Ford will be adopting NACS in the near future for North American vehicles, I do think their EV options will start to become more compelling.

Could be some really awful ploy to get more people to pay for Twitter Blue.

I also don't use the account for anything that could get a suspension. No public user content, not used for SSO, and I don't have anything programmatically accessing my account. I know there's still a non-zero chance of getting nuked, but my risk as near zero as it gets.

Yeah. I've moved most of my critical stuff off my GMail address onto a Google Workspace account, just sucks that not everything works with a Google Workspace account. I am just hoping that actually paying them money makes it a little less likely my account will get suspended.

I've seen many systems that disallow the password reset flow when you sign in via SSO, since the expectation is that you as the service provider are not the authority for the user's identity.

Worrying about situations like this is exactly why I try to avoid SSO at almost all costs for personal stuff, and instead prefer to use a username/email and a unique password.

I really feel for any developers who are impacted by this, as well as users who may not be able to get to some of their data.

Hopefully it's temporary, although with the Doge icon who knows...

I think it's a "yes, and..." because it's conceivable that the alert itself could fail to notify pilots for some reason. So the pilots shouldn't rely on the automation to work 100% of the time, nor that the system will alert them to a problem with 100% accuracy.

So it's both correct to recommend that the Boeing 777 try to alert the pilots to the misconfiguration, and to reinforce pilot behavior to reduce the risk of being in a position where that misconfiguration happens.

At least where I am in SoCal, AT&T literally just deployed fiber with plans up to 5 gigabit/s. I'm so glad to be leaving Spectrum behind, because when moving here I never thought I'd have a cable Internet provider that made me miss Comcast...

So hopefully you have some other options soon. :)

If you're talking about the sidecar process I think you're talking about, that thing sorta sucked. It was a great idea, but execution lacked and it caused all sorts of issues as a result. Also ended up becoming sort of abandoned, while people still relied on it for critical stuff.

Netflix eventually moved away from HTTP+JSON to gRPC for backend services, and also started to expose internal DNS-based service discovery. This removed the need for that sidecar from _most_ places, since you could just generate code from protobufs, but it created other problems. Specifically, it was hard to apply the same resiliency patterns across multiple languages when calling those APIs, and so that would then contribute to weird incidents.

I'm not there anymore, but last context I have is that things are moving to an Envoy-based model now. The idea is that everything will use the sidecar, and resiliency patterns will be baked in at that layer. I suspect that'll be a better architecture in the long run.

Hi. This is my comment you keep linking to. Your understanding of what happened is flawed. I do not have signs that Linode was rooted in that compromise. The signals I do have is that they had their database compromised, and likely secret key material. That allowed attackers to crack the hashes offline, and then authenticate using MFA.

IMO, it's plain wrong to categorize that one as "getting full root control plane", where it was instead the compromising of individual accounts that may have had no access to the resources on an account.

As someone who commented on Linode hacks earlier, I can vouch for lbotos having worked there and feel the same way as they do. I don't believe any of the attacks were an inside job, because I don't believe anyone would have done that and if they did they knew how not to leave a trail behind.

Also hey lbotos, hope you're doing well!