skibbityboop

Yeah, we have one legacy, abandoned PHP service that isn't readily updatable and is being replaced, so in the interim it runs fully isolated in its own VPC with only Cloudflare able to reach it to help protect it. The container runs non-root with read-only filesystem and the host has no egress allowed at all for the UID running the service (not even DNS, no new outbound traffic for that UID at at all), it can only be connected to by CF's hosts.

It has survived perfectly fine so far and is on a _very_ vulnerable PHP version based on the php2shell writeup. Management knows it could supposedly get popped at any time, and we'd have to rollback to a snapshot, spin it back up, and wait for it to get popped again. Rinse/repeat.

> The non default php settings he set break the exploit.

If that's the case, then there is a mitigation for all vulnerable versions, but the team that released php2shell said there is absolutely no complete mitigation and every PHP version between 5.4 and these latest updates is absolutely vulnerable. So which is true?

Not for PostgreSQL, but for MariaDB we run replicas in FreeBSD jails on a server with lots of ZFS space. The jailed Maria instances just stop every hour (so the DB flushes everything to disk), the host snapshots all of their data volumes, and then starts the jails back up. Within a minute or so they're fully caught up to the primaries again. Gives us months and months of recovery checkpoints.

It's great because it's a completely clean save from a shutdown state, so when we need a scratch copy of a database it only takes as long as cloning whatever snapshot we want (depending on how far back we need to to), then starting a scratch jail that runs from those clone filesystems. When finished, just shutdown scratch and delete the clones, it's like it never happened.

Yes, this really is an example of someone who "made it" and made a large amount of money that has allowed them to turn around and choose a simpler life. "Oh, I just moved myself and my family off to a little Greek island estate I bought and farming it (along with my existing money) is what provides for us..."

Money may not buy happiness buy money buys you all the freedom you could possibly need to do anything that fits your whimsy.

It's not like VMFS (not a cluster filesystem), for Proxmox+iSCSI you get a large LVM PV that gets sliced up into volumes for your VMs. All of your Proxmox nodes are connected to that same LVM PV and you can live migrate your VMs around all you wish, have HA policies so if a node dies its VMs start up right away on a surviving node, etc.

You lose snapshots (but can have your SAN doing snaps, of course) and a few other small things I can't recall right now, but overall it works great. Have had zero troubles.

Yes, when dementia has you terrified of, or raging at, your closest loved ones (who you don't remember at all so you think they're demons or strangers) all day every day to the point where they all can't stand you and feel terrible for wishing death would come to end your massive suffering. Beautiful moments, just beautiful.

Hanging in there with cancer? Sure, fight it and deal with the pain. Dementia? No, please end it. The two aren't even close in comparison, cancer feels easy and merciful.

Yeah, kinda have to agree. I like traefik fine but getting mTLS working with it was a serious pain and the docs for doing so were _terrible_, had to keep searching around and piecing together bits from various third party blogs. Coming from haproxy where the documentation is _so_ _much_ better and things like e.g. mTLS are vastly easier, it was not a fun experience but we did finally get traefik to work as we needed.

Anecdotal but btrfs is the only filesystem I've lost data with (and it wasn't in a RAID configuration). That combined with the btrfs tools being the most aggressively bad management utilities out there* ensure that I'm staying with ext4/xfs/zfs for now.

*Coming from the extremely well thought out and documented zfs utilities to btrfs will have you wondering wtf fairly frequently while you learn your way around.

Yeah, if your device is lost or destroyed and you rely on passkeys, you are well and truly f**ed. Your only hope is if you have recovery passwords stored in a password safe or manager. If you already have that safe or manager, than you can already very easily have 25+ character passphrases for every site you use, so what have passkeys gained you except having to be double-vigilant about having a recovery method for every login you create?

Same boat, the attempt at bot detection prevents the page from working at all for me.

Hit the same issue, but it goes fine if you just clone the repo, cd down into the cmd directory and 'go build -o doggo'.

I'm with you, I need to read up more on where timeseries could benefit, at work we have a PostgreSQL instance with around 27 billion rows in a single partitioned table, partitioned by week. Goes back to January of 2017 and just contains tons of data coming in from sensors. It's not "fast", but also not ridiculously slow to say e.g. "Give me everything for sensor 29380 in March of 2019".

I guess depends on your needs but I do think I need to investigate timeseries more to see if it'd help us.

I got a Latitude 9430 on eBay for $520. This thing is an amazing laptop and I'd put it right there with the Macs I have to work with at dayjob, as far as build quality/feel.