crabique

This particular image is a bit different though.

By CVEs I mean the architectural stuff that was discovered after the original ingress-nginx repo was archived, so there is no "official" mitigation and it's not just a matter of bumping dependencies, the fixes are actual code.

Chainguard forked the repo and is maintaining their own distribution now, but it's not free.

Is their ingress-nginx-controller image similar to that of Chainguard: a drop-in replacement with the CVEs fixed?

At least on ZFS, VersityGW absolutely does use sync IO, found it out the hard way on an HDD zpool with no SLOG...

Very cool, I wish there were something similar to this for filesystem images though.

Just recently I needed to somehow generate a .tar.gz from a .raw ext4 image and, surprisingly, there's still no better option than actually mounting it and then creating an archive.

I managed to "isolate" it a bit with guestfish's tar-out, but still it's pretty slow as it needs to seek around the image (in my case over NBD) to get the actual files.

I, too, can vouch for ZFS+VersityGW being a great solution, we were able to scale it vertically on a single-node deployment to a pretty high throughput, both reads and writes.

Most notably, the PutObject operation (which had always been a pain in the ass on HDD with MinIO) is performing well now, even with many small objects.

There is a natural synergy in the gateway storing its metadata in xattrs and using ZFS special VDEV with dnode_size=auto to store the entire ZFS+S3 metadata on fast media.

The latency impacts of the gateway itself can be further minimized by running multiple instances of the gateway pinned to CPU cores, all behind a HAProxy load-balancer communicating with them over UDS.

Care to elaborate?

Yeah unfortunately mirrors is no go due to efficiency requirements, but luckily read performance is not that important if I manage to completely offload FS/S3 metadata and small files to flash storage (separate zpool for Garage metadata, separate special VDEV for metadata/small files).

I think I'm going to go with 8x RAIDz2 VDEVs 10x HDDs each, so that the 20 drives in the internal drive enclosure could be 2 separate VDEVs and not mix with the 60 in the external enclosure.

In their design document at https://garagehq.deuxfleurs.fr/documentation/design/goals/ they state: "erasure coding or any other coding technique both increase the difficulty of placing data and synchronizing; we limit ourselves to duplication"

For sure, there is zero expectations for any kind of hardware downtime tolerance, it's a secondary backup storage cobbled together from leftovers over many years :)

For software, at least with MinIO it's possible to do rolling updates/restarts since the 5 instances in docker-compose are enough for proper write quorum even with any single instance down.

It's a very beefy server with 4 NVMe and 20 HDD bays + a 60-drive external enclosure, 2 enterprise grade HBA cards set to multipath round-robin mode, even with 80 drives it's nowhere near the data path saturation point.

The link is a 10G 9K MTU connection, the server is only accessed via that local link.

Essentially, the drives being HDD are the only real bottleneck (besides the obvious single-node scenario).

At the moment, all writes are buffered into the NVMes via OpenCAS write-through cache, so the writes are very snappy and are pretty much ingested at the rate I can throw data at it. But the read/delete operations require at least a metadata read, and due to the very high number of small (most even empty) objects they take a lot more time than I would like.

I'm willing to sacrifice the write-through cache benefits (the write performance is actually an overkill for my use case), in order to make it a little more balanced for better List/Read/DeleteObject operations performance.

On paper, most "real" writes will be sequential data, so writing that directly to the HDDs should be fine, while metadata write operations will be handled exclusively by the flash storage, thus also taking care of the empty/small objects problem.

Thanks, but I forgot to specify that I'm interested in S3-compatible servers only.

Basically, I have a single big server with 80 high-capacity HDDs and 4 high-endurance NVMes, and it's the S3 endpoint that gets a lot of writes.

So yes, for now my best candidate is ZFS + Garage, this way I can get away with using replica=1 and rely on ZFS RAIDz for data safety, and the NVMEs can get sliced and diced to act as the fast metadata store for Garage, the "special" device/small records store for the ZFS, the ZIL/SLOG device and so on.

Currently it's a bit of a Frankenstein's monster: using XFS+OpenCAS as the backing storage for an old version of MinIO (containerized to run as 5 instances), I'm looking to replace it with a simpler design and hopefully get a better performance.

Is there an open source service designed with HDDs in mind that achieves similar performance? I know none of the big ones work that well with HDDs: MinIO, Swift, Ceph+RadosGW, SeaweedFS; they all suggest flash-only deployments.

Recently I've been looking into Garage and liking the idea of it, but it seems to have a very different design (no EC).

I wouldn't recommend doing it from a cronjob, there are sometimes things that require sudo to update, breaking changes and important notes from Brew maintainers in the output. It's really important to inspect the output in order to see everything Brew doesn't consider normal.

Lately I'm running this like once every 2-3 weeks and it's still surprisingly nice to use. The problems only really manifest when you never run this "maintenance" snippet and only use the `brew install`, which will attempt to do the housekeeping stuff when you want/expect it the least.

The trick for smooth experience is to treat it like `pacman -Syu`:

  brew update && brew upgrade && brew autoremove && brew cleanup && brew doctor

Most CAs offer them, the only requirement is that it's at least an OV (not DV) level cert, and the subject organization proves it owns the IP address.

Get a wildcard for the apex domain/higher-level subdomain, the "secret" subdomain will be covered implicitly.

If you don't want the certificate to be in the CT logs, your only options are a private CA or things like CF Origin certificate, depending on how the domain is intended to be accessed.

It's not the end user that "needs" CT, it is a mechanism to ensure no shady CA can misissue a certificate without being caught. Requirements like that are written in blood (see Symantec).

I remember WML <card> tag, essentially SPA 20 years before SPA even became a term.

This is how it works already, the DoH endpoint is "/dns-query", both CloudFlare and Google route this endpoint to their resolver services, while the rest of the site (one.one.one.one or dns.google) is just a website.

testssl.sh allows you to scan stuff inside private networks, supports custom ports/SNI, and things like StartTLS.

There's https://github.com/itchyny/gojq which is pretty popular, even GitHub CLI embeds it for their --jq filter.

It does not matter, the intent is obvious no matter how they try to spin it, the damage has been done.

I am uninstalling Firefox after 16 years of sustained everyday use in dual-browser split setup alongside Safari. I will also make sure everyone I know still using FF gets the note.

I am going back to Chromium-based browsers that are openly "sell-your-data" from day 1 and I am willing to accept the Google monopoly if it means that dung beetles like Firefox are not able to prey on loyal supporters by bait-and-switching the ToS whenever they feel like. Hopefully their telemetry shows them a good picture of how their decisions affect their market share.

Hell, my 2011 issue about wrong handling of ::first-letter pseudoclass on bugzilla hasn't got a single meaningful update since, but I was willing to sacrifice the standards compliance for the promise of "privacy". There is no more privacy.

Proper quake mode is just one shortcut to show/hide the entire terminal window, otherwise the app is completely hidden from the app switcher and the dock. This also involves handling macOS keyboard-to-app layout mapper not reacting to this event as the window loses its first-class citizen status in this mode.

Somehow this is the first time I see anyone else bring this up, but the fonts are absolutely displayed with wrong kerning on my mac, for my font (at 12pt) I was able to make it look the same as iTerm2 with adjust-cell-{width,height} both set to -5%.

Unfortunately, it's nowhere near close feature-wise just yet: proper quake mode, search, prompt navigation, line timestamps, tab output indicators, forced keyboard locales, customizable toolbar with user-defined variables/indicators, are all too useful to give up iTerm2 for anything.

On my system it's ctrl+tab to cycle through tabs, then escape to open the one that is currently highlighted.

How would one go about changing QoS for the system daemons and would it require disabling SIP? I don't see anything relevant in launchctl's man or launchd documentation, really interested to try it on the system VPN service.

Restic is awesome for moderate operational scale, but when it's got to backup thousands of storage block devices with arbitrary number of files on them, it just doesn't really work.

Is there anything cool people use for Ceph-RBD backups nowadays?

For now, the only thing in the OSS world that doesn't choke at this scale is Benji, but it looks like it's not really maintained anymore, and I worry it may not support newer Ceph versions.

How does one spin up a mirror of the entire WordPress.org registry, not to mention keeping up with plugin/theme updates that are uploaded there by the respective maintainers?

Furthermore, does WordPress even support custom resource registries?

Biggest showstopper for me personally is Make's inability to properly pass through arguments from `make run <arbitrary number and type of arguments>` to the underlying program.

Some of the issues could be avoided by requiring a -- and using the .SILENT modifier, but some are extremely difficult: e.g. it word-splits strings and you can't just pass "some string" as a single argument, everything will be separated by spaces.

In case the underlying program is a script-language wrapper that you also control, it is possible to hack around and let Make pass through its own $$PPID so that the underlying script could read the nul-terminated /proc/<Make's pid>/cmdline and pass it on to the actual program.

This, of course, only works where procfs is a thing, so e.g. on macOS (if it's among your target platforms) you'd have to reinvent the wheel and learn a whole lot of Darwin sysctl dark magic to read arbitrary process' arguments, at which point you'd ask yourself if this is even something a sane person would ever do...

Upd: searching in the github mirror by the commit hash from the issue, found that https://github.com/gcc-mirror/gcc/commit/1e3312a25a7b34d6e3f... is in fact in the 'releases/gcc-14.1.0' tag.

Even weirder that this one got swept under the changelog rug, it's a pretty major issue.