BenTheElder
Joined 12 years ago
Karma
242
Submissions
94
Member since
Nov 21
https://elder.dev
View on Hacker NewsRecent submissions
Comment · 3 years ago
> Unfortunately, if you've used Google Takeout or other systems that can both downsample your photos and videos, as well as actually deleting _or changing_ metadata, deduplicating becomes a big wad of heuristics.
I thought takeout exported the original files? (alongside metadata entered into the application)
Comment · 5 years ago
Thanks!
Comment · 5 years ago
> Uber built a remote kill switch for their tax docs in canada, this isn't unprecedented for them.
Do you have a pointer to more on this? Naive searching doesn't seem to turn up anything for me.
Comment · 5 years ago
FWIW: That project was started as an internal tool with a playful acronym and then went from obscure to well-known enough to making renaming a somewhat regrettable concept rather quickly just due to momentum. I think we'd have named it differently if we were aiming for widespread usage :-)
We had no reason to worry about making it popular, the effort was staffed to improve developing Kubernetes itself.
As for googling, I recommend adding keywords like "kubernetes" and for issues searching the repo itself or reaching out to the community for help https://github.com/kubernetes-sigs/kind#community
That tool is written in "Go" which also somewhat famously doesn't search well without changing your terms up a bit.
Comment · 5 years ago
Ok but the premise of physical harm in person comes from the parent comment, not mine:
"Most of those dependencies represents at least one human being who can be threatened with a crowbar and forced to ship an exploit, which can then infect vast numbers of production applications."
Comment · 5 years ago
Good points.
I suspect for a lot of projects reproducible builds are themselves a bit of a hurdle and not being verified in the rarer case that they already exist, but the point of reproducible + signed builds as indirect source-signing stands.
Comment · 5 years ago
Those are interesting points / possible approaches, however is there any indication that this particular project enables any of that?
This seems focused on signing binaries / build artifacts.
IMHO it seems like if you have the threat model of "crowbared maintainer forced to insert backdoor" you probably don't trust sources let alone binaries and need to vet your dependency sources and then compile your own binaries from them.
Many open source dependencies will not have a jurisdictionally diverse review team, or any review team at all (single maintainer).
Comment · 5 years ago
Why can't they be "threatened with a crowbar" to sign the exploit?
Comment · 5 years ago
A zero-sized type + hashmap for sets is also done in Go with a `struct{}`. [1][2]
But without generics it must be implemented again for each entry type ...
Kubernetes uses a code generator to automate this, but it's a bit kludge. [3]
[1]: https://pkg.go.dev/k8s.io/apimachinery/pkg/util/sets#Empty
[2]: https://dave.cheney.net/2014/03/25/the-empty-struct
[3]: https://github.com/kubernetes/code-generator/blob/master/cmd...
Comment · 5 years ago
Those things don't have to be inherently slow and e.g. external IP don't need to block bring-up.
I've worked on KIND and on clusters on clouds (at Google, but on multiple clouds) and both can be very quick, if anything there's still low hanging fruit to make KIND faster that I'd expect a production service with more staffing to handle.
KIND is Kubernetes, typically on much weaker hardware :-)
Within a few minutes is a perfectly reasonable expectation even for "real"-er clusters, see e.g. under 4 minutes:
- https://kubedex.com/google-gke-vs-azure-aks-automation-and-r...
- https://stackoverflow.com/questions/53839292/is-a-3-minute-g...
Comment · 5 years ago
`go mod vendor` will populate all dependency sources into `./vendor/` in a modules project for easy grepping.
Some projects still use this to ensure sources work airgapped as well.
https://golang.org/cmd/go/#hdr-Make_vendored_copy_of_depende...
Comment · 5 years ago
Is what appears to be less than 2,000 lines including detailed comments etc. "quite a lot"?
This seems like a manageable amount to very carefully maintain and not at all like writing something entirely in C.
Comment · 5 years ago
this seems like a pretty trivial amount of C, by comparison, and a pretty solved problem now.
Comment · 5 years ago
FWIW Google did this ("letting go" of an asset) with Kubernetes / the CNCF.
I work on this at Google, but Google no longer owns this since 2015.
Comment · 5 years ago
As I understand it they only removed these after their underlying server provider banned Epik over it ...
They also still provide DNS for 8chan/8kun, and continue to host the daily stormer ...
Seems like they are only not bulletproof because they are a reseller and their vendors have limits.
https://en.m.wikipedia.org/wiki/Epik_(company)#Hosting_of_fa...