debinguy

Fair question. IP options in the header are generally not used due to performance degredation in parsing extended headers in hardware based packet filters. So they are part of the spec but generally not used due to this. I have worked in CDNs and large internet facing networks for over 20 years and we implicitly drop any IP headers over 20 bytes (meaning they have options set).

I find it odd that no public discussions are highlighting that iptables or nftables can drop this before the kernel CVE is exploitable by a U32 drop rule in raw PREROUTING...

sudo iptables -t raw -I PREROUTING -p tcp -m u32 ! --u32 "0>>24&0x0F=5" -j DROP

They may be more efficient but when you need to run a dozen different containers simultaneously and you want each one to use a modest amount of memory, 16GB falls short. The issue is not efficient vs. non-efficient. It is scale. If I was writing a single web app on two containers sure 16GB would be fine. I am not though, and the scope of what I work on requires more memory.

For my situation I work for a large CDN and we have over 15k servers deployed globally and software I write has to run on all of them. This means various OS and kernel versions. This means in a given day I can work on 20+ different containers. The more time I spend spinning up or down containers to save system resources the more angry I get. I also travel a lot for work, so connecting to a cloud based instance from a plane is not possible, plugging into a power outlet in a plane seat is.

For me the issue comes down to lack of choice. Previously lack of choice from Apple was not a concern because the choices I would make were inline with what they are offering. This is no longer the case.

For those that asked, I am replacing 10 years of using MBP's with a System76 laptop. I don't have it yet so I can't comment but I am excited for the change as have been growing more and more frustrated with Apple.

This exactly. As a developer applications like docker and vagrant are part of my normal activities. The 16GB limit just does not work in this model. FWIW I was waiting on a laptop upgrade, and after seeing the new lineup from Apple I ordered a Linux laptop with 32GB of memory.

Using DAQ's properly eliminate process blocking when using TCP delivery and there are connectivity issues. You can do TLS encryption natively. Rsyslog action templates are complex but extremely powerful. After reading this post I just wonder if you have ever read the Rsyslog documentation or done any large scale deployments with it? Our network is handling over 50k log messages a second using Rsyslog and while it's not perfect I can't think of any other standards based system I could rely on.