frozenice

S/MIME is about the mail (content) itself, not the transport. For the transport part there are things like (START)TLS and MTA-STS. With S/MIME you include your certificate in the mail and can either sign the mail with a signature (with your private key, others can verify it using your public key from the certificate) or encrypt the mail (with the receiver's public key, so only he can decrypt it using his private key). Certificate trust is determined normally via the CA chain and trusted CAs.

It didn't need to in my simple case. k6 doesn't do crawling / auto-discovering, from what I can tell - I just wanted to give the tool one URL and press start.

Funny timing. Just yesterday I was looking for an easy Windows tool to do a simple stress-test on a website (legally ofc). A requirement of mine was to just give it the root URL and the tool should discover the rest automatically (staying on the same domain). Also, parameters like parallelism had to be easily manageable. After trying some crawlers / copiers and other tools I went back to a simple one I already knew from saving static copies of websites in the past: HTTrack. It fit the bill perfectly! You can add the root URL, set it to "scan only" (so it doesn't download everything) and tweak the settings like connections and speed (and even change some settings mid-run, save settings, pause, ...). So thanks xroche for HTTrack! :)

I also use HeidiSQL almost daily. Besides MySQL / MariaDB it also can connect to MSSQL and Postgres.

I recently had to import a CSV with some million rows into MariaDB. Neither HeidiSQL nor DBeaver could do it (tried various settings). IntelliJ worked like a charm.

A useful feature! I have this available to me as part of Refined Hacker News [1], which does a bit more. But if you only want the user popup, a slim extension is nice.

[1] https://github.com/plibither8/refined-hacker-news

  time.Second * time.Second

The type of this is `time.Duration` (or int64 internally), not `time.Second` (which is a const with a value).

I agree, though, that this is not quite sound, because it can be misused, as shown above with `time.Sleep(delaySecs * time.Second)`.

In Kotlin you can do `1.seconds + 1.minutes` but not `1.seconds * 1.minutes` (compilation error), which I quite like. Here is a playground link: https://pl.kotl.in/YZLu97AY8

I use them on my desktop, too. There are none in this WebView embedded in this mobile app, though.

OT: popups and banners managed to cover the whole page... :/ https://photos.app.goo.gl/PqV9FpqyPCujtFTJ6

> I hate email-based authorization.

Authentication, not authorization. ;)

Think of it this way: there is always a GROUP BY (implicitly), i.e. GROUP BY rownum(). So there is always a big group with all the rows (or rather many small groups).

> Positive Technologies found that both of these checks can be bypassed using a device which intercepts communication between the card and the payment terminal. This device acts as a proxy and is known to conduct man in the middle (MITM) attacks. First, the device tells the card that verification is not necessary, even though the amount is greater than £30. The device then tells the terminal that verification has already been made by another means. This attack is possible because Visa does not require issuers and acquirers to have checks in place that block payments without presenting the minimum verification.

That's the first time I hear about RFID/NFC MITM, neat.

+1 for TeamCity. We tried GitLab CI before, but are happier with TeamCity now.

> There are only two hard problems in computer science: cache invalidation and naming things.

There are only two hard problems in computer science: cache invalidation, naming things and off-by-one errors.

translation: https://translate.google.com/translate?hl=en&sl=de&tl=en&u=h...

Troy Hunt is already looking for the data ;) https://twitter.com/troyhunt/status/1038368815778648064

I'm re-evaluating k8s again - tried it one or two years ago and hit some roadblocks for my use-case.

Kelsey's tutorial is a bit outdated (Oct 2 2017 with k8s v1.8, v1.11 just got released). Here is a link to the official kubeadm guide for Creating a single master cluster with kubeadm:

https://kubernetes.io/docs/setup/independent/create-cluster-...

It basically is just running

  kubeadm init

on a server / VM (after installing docker and kubeadm, of course). Add a pod network add-on (Calico seems to work well, 2 commands to install), remove the mentioned taint and optionally join more worker nodes (also a single kubeadm command). Every step is in the guide, just copy & paste. ;)

Note: This is no production-ready cluster (it has a single master), also you should have some basic understanding of k8s, which the OP provides. I also highly recommend to dig around kubernetes.io/docs - good material there.

I started with kubeadm some days before the release of k8s v1.11, which made some stuff I wrote obsolete, oh well... :) I really like the new kubeadm phase stuff, though.

There is also an official guide for Creating Highly Available Clusters with kubeadm (it's updated for v1.11) which I just went through:

https://kubernetes.io/docs/setup/independent/high-availabili...

I opted for the "stacked masters" approach (run HA etcd right on the k8s master nodes), wrote some ansible tasks to automate to boring stuff like copying configs/certs etc., and am currently (re-)exploring add-ons and advanced functionality (helm, network policies, ingress controller, ceph via helm, ...).

Let's see how far I get this time!

I'm very satisfied, too. Servers are ready in minutes, not hours, after ordering. We currently run ~30 servers there (dedi) and over the last ~7 years roughly had 1 HDD fail per year. Each time the replacement was done on our chosen time and quickly in about 5 - 20 minutes (the installabled images come with pre-configured software RAID 1). We recently tried a AX60 (Ryzen 7 1700X Octa-Core) and had some sporadic crashes, support changed some BIOS settings, no problems since. Service and prices are unbeatable, imho.

rook (which was linked in the README) looks pretty nice, though it's still in alpha (it wraps Ceph and etcd to easily run a ceph cluster, managed internally by rook). https://github.com/rook/rook

That reminds me of a trick I discovered nearly 10 years ago on an Acer to reset the BIOS Password from Windows.

There was this eSettings.exe which let you change some BIOS Settings from Windows, including the password. Of course it first asked for the old password and showed a prompt, denying the request if it was wrong.

I fired up good old OllyDbg and traced the prompt in the ASM code. I changed only one bit IIRC (jne to je, or similar), saved the .exe and tried my luck.

It let me through the prompt and I entered the new password. Amazingly the BIOS gladly accepted it!

I didn't bother to find out what functions it exactly called to set the new password to write a small tool, because I already had one. ;)

I wonder if this still works... If not with an Acer, maybe with some other make?

Abstract

The lower layers in the modern computing infrastructure are written in languages threatened by exploitation of memory management errors. Recently deployed exploit mitigations such as control-flow integrity (CFI) can prevent traditional return-oriented programming (ROP) exploits but are much less effective against newer techniques such as Counterfeit Object-Oriented Programming (COOP) that execute a chain of C++ virtual methods. Since these methods are valid control-flow targets, COOP attacks are hard to distinguish from benign computations. Code randomization is likewise ineffective against COOP. Until now, however, COOP attacks have been limited to vulnerable C++ applications which makes it unclear whether COOP is as general and portable a threat as ROP. This paper demonstrates the first COOP-style exploit for Objective-C, the predominant programming language on Apple’s OS X and iOS platforms. We also retrofit the Objective-C runtime with the first practical and efficient defense against our novel attack. Our defense is able to protect complex, real-world software such as iTunes without recompilation. Our performance experiments show that the overhead of our defense is low in practice.

Funny, just this week I was looking for an easy solution to cluster storage for containers.

I found SXCluster and posted it here https://news.ycombinator.com/item?id=11812566 - not directly geared towards containers, but very easy to setup (no need for etcd and the like).

Stumbled upon this when searching for an easy way to give my docker containers data volumes, that can move to another host, when the container moves to another host.

I wanted to go with Flocker (although it is a bit complex) seeing it has some nice features, but it only supports rather complex block device backends (https://docs.clusterhq.com/en/latest/flocker-features/storag...) and I'm not on AWS / GCE. I have free space lying around on some servers' disks (not extra devices or partitions, mind you) and there was no easy way to make this space accessible as / to a cluster.

This blew me away! Setup was a breeze, just add an apt repo, install a deb + maybe 6 deps and answer some prompts, done. The docs are easy to read and not cluttered, see http://www.skylable.com/manuals/sx/manualch3.html (use sxsetup --advanced to change the port, if needed).

They have support for mounting a volume from the storage cluster as a normal directory via FUSE (http://www.sxfs.io/#install).

Did I mention it's free and has Users and basic ACLs for volumes?

A basic web GUI is also available (as an alternative to the enterprise version) here: https://github.com/skylable/sxconsole-lite (runs via docker, just answer some prompts)

But wait there's more! Some other goodies include an S3 compatible API (https://www.skylable.com/products/libres3/) and Dropbox like apps (http://www.sxdrive.io/) - which I haven't tested, yet.

Bonus: One founder of Skylable is the author of ClamAV.

So my curent plan is to just create a volume or several, mount them on each docker host via sxfs (FUSE) and bind them into the containers, where needed. I'm curious if anyone has other suggestions on how to make use of spare space on servers for multi-host data volumes.