bluecmd

Maybe they didn't know there is a difference? I'm from Europe and I didn't. You register to be able to vote? Why isn't every citizen automatically allowed to vote?

Since you mention regulation, I think it is something to be proud of. GDPR, Germany saying hell-no to forced Facebook accounts, etc.

As for innovation? US isn't even top 10 when it comes to Nobel prize per capita (https://en.m.wikipedia.org/wiki/List_of_countries_by_Nobel_l...).

IKEA, SAP, Beretta, Airbus, Spotify, Linux, Prometheus, Grafana, Booking.com just from the top of my head of things that are proof of European innovation and tech sector.

IPV6 commonly does that. Your next hop is installed as a link-local fe80-entry which is derived from the mac address. Not exactly what you're after, but removes the IP numbering need.

That's not the "cattle vs. pet" as I understand it. The servers are identical, i.e. cattle. This is just a case of sticky sessions. It's a common pattern to help latency and keep resource usage down.

This doesn't help you now, but why didn't you keep the old site and just 301'd to the new page for a year or so?

Build systems usually don't care what you added. Modification of source means rebuild.

because the Rust way is actually the right way.

[Citation needed]

I mean, could? Sure. They specifically claim not to though: https://developers.google.com/speed/public-dns/privacy

No, you also need to be able to MITM. Snooping the traffic is not enough to do harm.

That Europe cost seems high, tbh. In the Nordics for example I'm pretty sure everything is paid for.

+1. When I had to use AWS for batch workloads, which at the time at least didn't have a TTL attribute on VMs, I made sure that the VM first scheduled a shutdown in like 30 min if the test was supposed to only run in 10 min.

And then have to live with asking yourself "could I have done more?"

I doubt that would be 1 and not developed using 2 followed by a "don't touch" policy, tbh

There are a few. https://github.com/tink-ab/login-service is one I wrote and open sourced when I worked at the associated company. Adding something like https://github.com/dhtech/authservice + https://github.com/dhtech/prodaccess would give you client certificate provisioning and handling.

In the end you'd easily get e.g. daily U2F with monthly cert rotation. Or whatever you end up wanting.

Open source have had this convered for years, but you'll have to look for it.

Disclosure: I'm the main author of all those three projects.

BeyondCorp is the effort/program name, ÜP is one of the software that enables it to be implemented. ÜP is just a fancy Envoy/nginx reverse proxy.

It's in the article

Signal is open source

Hostile APIs are a problem. If you require a dance for the correct outcome, people will fail. Make it easy to do the right thing.

I've never seen this advice, would you mind elaborating or citing a more elaborate source?

Since pivot_root requires the old root to be a child of the new root, traversing back to the full system seems trivial. Actually, I don't see why this syscall isn't worse than chroot due to this.

You don't even need that. The BIOS can just install vulnerable SMM handlers and then you're screwed.

I don't get why you say it doesn't affect you - bloated and crappy firmware affects everyone, regardless of OS.

Yes sure, but I question if these permissions would do anything to prevent that. It would reject an open() call on the file, but these are expected to be directories so that would never happen, and it doesn't stop an unlink()

What do the chmod do there? Removing files count as writes to the directory at least in Linux, so chmodding the dummy file wouldn't do much I'm thinking.

Search "PCIe bar space" and you should be fine

There is recurring costs as well, something like $400/mo in power usage bills, and another $400 in internet and space rental fees per month. The folks over at the datacenter have been very happy to have me so there might be some discounts in there as well, but I am not sure. My goal was to keep the recurring cost as low as I can, and compared to what hosting a beast like this in a conventional datacenter would cost I'd like to think it's a pretty good deal.

Given that it generates like 10k BTU/hr or something like that the drain on the datacenter is non-trivial, so I a running cost was to be expected.

Indeed, the 16 MiB virtual memory space is kind of limiting for anything remotely modern :-).

That is not really 100% true. You can certainly run z/OS if you want, and that incurs those costs you mentioned - but that is true if you want to run Windows as well for example.

However, the biggest thing to remember is that you can and should run Linux on these things as well. Linux on z, or zLinux as it for some reason is called, is just Linux on the redundant and fault tolerant mainframe hardware. Anyone with Linux experience could manage it really, and you would get a pretty damn good platform to build a high availability service on.

Cool! Thanks for sharing! I have heard that some banks interconnect directly with IMS but I have no source for that.

Would you have liked the project more if the price was not disclosed?

Author here, I agree 100%. It is just a different way of building software, which is why I find these things so interesting. It challenges my worldview and thus I want to learn more about its upsides and downsides.

CICS and IMS definitely made it easy to create scalable software decades ago. It is not that different from the frameworks we have invented to make distributed systems viable that you mention, which I find insanely cool.

One of the cool things of running e.g. Ceph is that it exposes a familiar API (POSIX filesystem) which makes things easy to integrate with. The mainframe is like that but for hardware. VMware has similar things to some degree where your VM can be kept alive across hardware failure, but not really on the same level.

Anyway, I will stop here but I could go on for hours :-)

Thanks! Glad you enjoyed it :-)