aaron42net

작년discuss

Cloudflare uses JA3 and now JA4 TLS fingerprints, which are hashes of various TLS handshake parameters. https://github.com/FoxIO-LLC/ja4/blob/main/technical_details... has more details on how that works, and they do offer an Nginx module: https://github.com/FoxIO-LLC/ja4-nginx-module

aaron42net

2년 전discuss

Will Prowse's favorite large panels are cheaper than that, including a 370w bifacial for $111 each in small quantities: https://signaturesolar.com/all-products/solar-panels/

Related video: https://www.youtube.com/watch?v=v33nbi7gKcY

aaron42net

4년 전discuss

By default, many compilers include things like local filesystem paths, build server hostnames, or build timestamps into their binary artifacts. These will obviously differ build-to-build.

Even without that, it's possible to accidentally leak entropy into the build output. For example, readdir() doesn't guarantee any kind of ordering, so without sorting the list of files it is possible for a binary artifact (or even tar) to produce different output from the same input.

aaron42net

5년 전discuss

Over the years, I've had direct knowledge of or involvement with maybe a dozen or so events that have ended up in the mainstream news. And in almost every case it has been inaccurate in some way, sometimes getting basic facts wrong and others having significant bias or spin that was misleading.

This hasn't given me great confidence in the accuracy of the reporting for things that I don't have direct knowledge of.

aaron42net

5년 전discuss

On cell networks, video content is by far the largest consumer of bandwidth. And the default for video generally is to auto-adjust the resolution to the highest quality that the network supports. This kind of sucks, since bandwidth is a shared resource for all users of a given antenna on a cell tower.

Though Speedtest on your cell might show your connection speed as 100 megabits/sec down, cell networks special-case video by identifying it as video and rate-limiting it to something like 1 megabit/sec. This is considered "efficient network management". For T-Mobile, this based on the plan (https://www.t-mobile.com/cell-phone-plans), they sell either "SD streaming" or "4k UHD streaming". "SD streaming" is a fancy way to express that they rate-limit identified video streams to 1 megabit/sec.

They identify video streams by watching the IP your phone is connecting to and/or the hostname mentioned in the TLS SNI header and checking if it is Youtube, Netflix, etc. Sending video content over a VPN removes their ability to understand what the content is.

aaron42net

5년 전discuss

The default region for global services including https://console.aws.amazon.com is us-east-1, but there are usual regional alternatives. For example: https://us-west-2.console.aws.amazon.com

It would probably be clearer that they exist if the console redirected to the regional URL when you switched regions.

STS, S3, etc have regional endpoints too that have continued to work when us-east-1 has been broken in the past and the various AWS clients can be configured to use them, which they also sadly don't tend to do by default.

aaron42net

5년 전discuss

Enabling Warp via the "1.1.1.1" Android app gets me an 8.x.x.x VPN address, at least. This /24 appears to be routed to my city's Cloudflare node, so presumably there's a /24 per city they run this service in.

Running a quick port scan from my phone against one of my machines works, so it doesn't look like they are restricting this too heavily.

And I'm not logged into this app and haven't granted it additional permissions, so I'm not sure they have any idea who I am here.

aaron42net

5년 전discuss

It's not edge location count that matters, but Cloudfront doesn't use BGP Anycast but rather does a more traditional DNS-based routing and tries to spread the requests across multiple edge locations (even those farther away) for redundancy, intentionally.

When I asked for detail about why they don't use Anycast, the Cloudfront engineering team basically said their customers care more about uptime than latency and that full Anycast was too sketchy. Apparently amazon.com disagrees, at least. I'm also happy getting much lower first page view latency out of Cloudflare.

aaron42net

5년 전discuss

We weren't having issues solved by basic documentation.

In the most recent example, we were occasionally hitting Java heap OutOfMemory under our workloads and wanted tuning or even architectural advice. It turns out that ElasticSearch didn't limit ingestion rate to control memory pressure and was happy to accept writes under load until it exploded. Heavy users of ElasticSearch commonly have to watch ES memory pressure and throttle their own writes client-side.

I would've loved to hear these limitations from elastic.co, be offered some tips on appropriate techniques for throttling, or have them accept a feature request to better handle this server side. We never got anywhere near that level of depth of understanding our problem, after months of trying. It felt like we were talking to first-level support who didn't understand the product much better than we did.

aaron42net

6년 전discuss

Not much value at all, from my experience.

Having given Elastic's support two tries at different companies, it doesn't surprise me that their business model is failing. Their support was _terrible_ both times; at no point were we ever in touch with anyone who seemed like they understood the product, cared about our issues, or were in any hurry to fix them. We were locked in year long, 6-figure support contracts in both cases, and issues dragged on for months until we basically gave up. We got better answers out of random Google searches and a 20 minute conversation with a friend of a friend.

AWS's hosted ElasticSearch only recently is able to handle the data set sizes we were dealing with, and their enterprise support on this (and other products) is vastly better than anything we ever got out of Elastic.

aaron42net

6년 전discuss

Based on reading the LinkedIn of the Parler execs, their code is node.js and some Go with Cassandra and Postgres for storage and RabbitMQ for queuing. That sounds like it will run anywhere they can rent a pile of Linux boxes.

They've tried to avoid lock-in, specifically mentioning avoiding any Google technologies in their mobile apps. However, they are using Route53 for DNS, Cloudfront as a CDN, and ALB for load balancing, so there are a few commodity services they'll need to swap out.

aaron42net

6년 전discuss

Where did you see the "per month" for Travis? The 10,000 free credits are a one-time trial from what I can see.

aaron42net

7년 전discuss

Wasn't it only has of version 3.4 that Jepsen stopped finding single-node data loss bugs in MongoDB? So it's been 3 years that MongoDB has been suitable for single-node data storage, and apparently 5 months that it's been reasonable to use in a sharded deployment.

Perhaps in another decade, MongoDB can shed its well-earned reputation for eating data.

aaron42net

8년 전discuss

Skimming the bucket code, it appears that the rate-limiting information is stored in a map. It doesn't appear to implement an LRU or attempt to clean up stale entries.

If I feed this user-supplied keys such as IP address or cookies, doesn't this mean it will grow without bound?

aaron42net

10년 전discuss

Previously when the Wired article was mentioned on HN (https://news.ycombinator.com/item?id=5089703), I did some digging and found that aaronsw.com and tor2web.org were hosted on the same Linode instance IP.

While the sniffing could've happened at any Tor exit node, Tor2web is an insecure public interface into the Tor network and is uniquely positioned to sniff any traffic passing through it. Aaron Swartz could've had tor2web.org record any requests made through it and supplied any interesting results to Wikileaks.

aaron42net

10년 전discuss

Recent Android on T-mobile US uses IPv6-only transport. T-mobile's DNS servers are only asked by these devices to translate hostnames to IPv6 addresses. If they can't find an IPv6 address, they will look up the IPv4 address for a hostname, and pack it into the bottom 32 bits of an IPv6 address that routes to a IPv6-to-IPv4 NAT device at T-Mobile.

This is called DNS64/NAT64 and has some small performance penalty. Making content directly accessible by IPv6 removes the penalty.

aaron42net

10년 전discuss

That was an explicit goal of OpenBTS when I was following it years ago. The GSM vendors want something like $250k per base station, which is unreasonable for third-world or very-rural applications. OpenBTS thinks they can get the radio hardware costs down to a tiny fraction of that to serve low volumes, backed by a Linux box running this software.

Interestingly, their first large-scale field tests were at Burning Man (http://openbts.sourceforge.net/FieldTest/), where there were thousands of active GSM handsets but no cell coverage. They were able to provide limited SMS support between local participants and in later tests allowed some outgoing VoIP calls.

aaron42net

11년 전discuss

There's a TPM-like mode with hardware isolation built into ARM for years, used for disk encryption keys, DRM, auth keys, fingerprints, etc on IOS and Android. See: https://en.wikipedia.org/wiki/Trusted_execution_environment

aaron42net

11년 전discuss

Do they just strip the color profiles? Or do they apply them and convert to sRGB?

aaron42net

11년 전discuss

That depends on how you define fair, I guess. If this isn't a hardcoded bonus for "google.com" and instead all established, high-PageRank sites receive the same benefit, is it still not fair?

There's a not well-known component of Google ranking that acts sort of like a slow-moving, domain-wide PageRank. And because they launched domains.google.com as a subdomain of google.com, which contains PageRank 10 pages and is therefore very trusted, the assumption is that domains.google.com is also very trusted, even though it currently seems to have no inbound links from other google.com pages.

This effect is usually hidden because it's rare to have a highly ranked page with no obvious inbound links competing on an established keyword.

comments