Posts by Nate Amsden

perhaps no fix coming

If the vendor no longer develops the software, seems likely the fix would be to upgrade the system, I find it unlikely most hotels would be willing to spend the $$ to upgrade so many systems for such a vulnerability, unless it starting being widely exploited.

The article is not clear but I think the good news may be that the vulnerability only affects systems that use NFC-like technology to authenticate the lock and not systems that use mag stripes(which I've read have their own issues).

In my hotel traveling experience in recent years maybe I can count on one hand the number of hotels I've stayed at that wireless key cards, one hotel in particular I stay at regularly upgraded to wireless key cards, their previous key card system looked as if it was at least 15-20 years old(had never seen a lock design like it at any other hotel I stayed at anyway).

el reg sure has it out for facebook

Kind of funny to see. Now do the same for amazon and google! go get 'em!

is it secure?

In the era of API keys and security compromises it seems a lot safer if you actually want to retain that data to store at least a copy of it OFFLINE, where something like a compromised API key(or admin website login) can't be used to magically wipe out all your data. Most people don't realize this for some reason or another.

Restoring from offline tape(or disk) would often require some human intervention to get the right tape(s) into the tape drive before they could be messed with.

In just doing a brief web search I see there is a WORM storage provider for Azure but the big catch from what I read on their blog is you have to give them all of your data and access it through their interfaces only, they admit if you had direct access to the azure controls you could bypass all of their controls and wipe out the data. Perhaps there are other solutions I haven't looked too closely but in my own conversations with folks over the years there doesn't appear to be any awareness of this critical shortfall of most cloud storage solutions for archiving data. WORM isn't quite the same thing as offline storage but it's as close of a term as I could come up with to search by.

Some enterprise storage arrays have similar built in retention stuff, though I've never used any of it. I remember when 3PAR came out with VirtualLock, where you can lock volumes and not even storage admins can bypass the lock preventing you from removing the volume(in most(all?) cases I assume it would be a read only snapshot so you couldn't modify it either). I suspect support could not either, though they could wipe the data by wiping the underlying drives.

Also don't forget about the bandwidth required to retrieve the data if it is any significant volume. Perhaps there is a cloud->tape/disk service as well which would accelerate that.

I see some WORM like storage on amazon cloud but the doc implies it is easily overridden if you have admin access to adjust the policies.

risk adverse

I remember a time many years ago at a company we were in the midst of maybe a 6 hour outage, we determined the most likely way to get the app up and going again was to truncate some tables on the Oracle server that the app was stuck with. In theory the data in these tables was not critical and could be re generated if needed but the developers were not 100% sure.

So the time came for I think the VP of engineering at the time to request the DBA to truncate those tables or maybe he was a director I forget this was over 10 years ago. I'll never forget the response it was so funny. The DBA said something along the lines of "I'm not truncating shit until you get the CEO of the company on the phone to approve that change", a few minutes later the CEO approved it, tables were truncated and the app came back online. Had to repeat that process a couple of more times over the next year I think(not needing the CEO's approval anymore).

maybe those engineers

can get a job at Violin systems, I don't know why but I poked around the Pavillion website seeing where they had offices(actually I guess was interested how likely it was they were shipping those jobs overseas). Looked on google maps and kind of ironic I suppose that Violin is literally in the same building as Pavillion(looks like Violin is perhaps 1 floor above).

how does tesla manufacturing compare to others?

Keep seeing headlines how they are doing bad about keeping up with their targets. But am curious how they compare to production lines of the bigger manufacturers (preferably taking into account size of factory etc). e.g. not fair to compare 10 toyota factories to 1 tesla factory (no idea how many factories toyota may have or how big they are), is there any stats on this kind of thing? I guess my point is more is Tesla doing a good job at making cars given the resources available? (seems that they may only have the one factory for cars in the bay area, excluding the battery factory(ies))

everyone dispises?

Really? I think that is overstating things by quite a bit. There is a newish growing vocal minority who despise facebook, just like I am in a minority who despise Amazon(~8 years running now, if only their recruiters would stop contacting me).

But I'd wager the vast vast majority of people who use it do not despise it. I bet the majority of those people who have also embraced Instagram don't realize and/or don't care that Facebook owns that as well.

At least 3 others in my family use facebook quite a bit and I haven't heard any of them say a peep about this whole thing, they just don't care, I don't think it has changed their usage of the system at all.

I bet the majority of those same people don't blink an eye when they install apps on their mobile devices that want to harvest your data. It's pretty sad, but even more sad, not surprising.

The only social media account I have is linkedin, though I am very careful to give as little behavioral information to them as possible(as in I do not comment on posts, I do not "like" anything), and pretty much all info they have on me is publicly available anyway. Add to that I do massive amounts of cookie blocking (over 10,000 sites in the past ~14 years), not perfect but it does a good enough job for me.

Also am obviously careful about what gets installed on my main phone. I have two other phones with pretty much no personal information on which I use to install apps that are of more dubious quality (though my standards even there are very high), so they really get no data, and no mobile devices are not allowed on my internal home network either(wifi is "DMZ" only hanging off the 3rd port of my yes -- OpenBSD firewall).

I'm sure they got encryption

State of the art export grade 1990s era anyway.

I'm filing my taxes via USPS priority mail, same way I pretty much always do(one year I used Turbo tax because that year was more complicated than I was comfortable with doing by hand,though still almost got screwed last minute as one of the tax forms from my then company had numbers transposed on it and Turbotax claimed I owned $9,999,999 in taxes, fortunately their support was quick to identify the error in the transposed fields and my tax owed went down to about $2k).

Though CA state taxes I've done online.

reminds me of a friend who tried to recruit me into apple

He was an outside vendor with lots of close connections internally at Apple. I was over at his house one time and he started to tempt me with an opportunity at Apple, but he couldn't tell me more than that. Until he had a half dozen drinks then he surrendered and told me it was with the maps group who had yet to launch (maybe even announce, I don't recall the specific timeline) their product. I still wasn't interested but thought it was funny. He was tight lipped until he had a few drinks then said aw fuckit and spilled the beans. He left that company a few years ago now.

Still no interest in working for apple or any other big company, at the time he tried it to me as apple was like a lot of little independent startups so it didn't have a big company feel. Still not something I am interested in pursuing.

missing the point?

The platform was designed to invade privacy(paraphrasing Zuckerberg's early quote "dumb fucks"), as were pretty much if not all other social media platforms.

I'm sure google goes even further they just haven't been exposed to the extent facebook has been yet.

It is unfortunate that so many people are happy to give up all of this info in exchange for using these services. I saw one headline on a news site I think it was from a U.S. senator saying "facebook should be paying US(the users) for this data!", obviously went over their head that they are giving you value back in "free" usage of the platform, paying for all those developers and servers and data centers etc.

I would pay money to see what data facebook and google have gotten on me but even if they did offer that service(I think google does to some small extent), I have too much fear that they would then validate "that is me" in their data by me doing such a thing. (I have never had a facebook account, I do have a google accounts for android(I don't use gmail, and use firefox as my browser, and am careful about what apps get installed), and I do have a google account for work for google docs(rarely use))

so is glass better than DNA?

http://www.theregister.co.uk/2016/07/07/microsoft_dna_storage/

"Previous research by UW and Microsoft has estimated that the "raw" storage limit of DNA is an exabyte per cubic millimeter. That said, it takes a long time to actually read the data – hours at a time – so this isn't going to replace Flash any time soon."

private registation

Seems there has been a solution available for a long time already called private registration (maybe that is the wrong term), where the registrar obscures the actual registrant of the domain and often times offers an email forwarding service in order to contact them. But of course registrars like to charge a premium for that service.

So the technology exists, perhaps they just don't want to use it in a broader scale.

I've never felt the value of knowing who a domain is registered to has much use to it myself, a domain can point to anything. IPv4 addresses on the other hand in general are far less portable. I actually did a WHOIS on one of the IPs I had at a colo maybe 6 years ago and it still had my name on it.

That reminds me of a strange phone call I got maybe back in 2013. Woke me up from sleep in a hotel room. Turns out it was the FBI. I was nervous of course never having talked to them before. They were trying to get in touch with my former employer but there was no contact info on the website and they could not find a phone number anywhere. My name was on their company domain(I had left the company 1+ years prior) so they tried to call me. The FBI had interest in getting access to the company's logs I assume for questionable user generated content on their site. I got them in touch with people at the company(the company has long since gone out of business now).

deja vu?

Didn't HP spin out their services/consulting arm ? Now they are wanting to build a new unit that does something similar?

As for pension, curious what kind of work did you do for HP mister AC ? My father worked for HP for I want to say 20-25 years(perhaps more), he even personally knew the founders, he retired from HP in the mid 90s though have never heard him mention the word pension.

coverage sucks

Seems telcos are hyping up 5G when it would be nice if they did the more boring thing of improving existing coverage. I live in the U.S. but I can count on two fingers the number of times I have gotten awesome 4G speeds(over 20Mbit) over the past 5 years.

One time was in a Las Vegas convention center where they obviously had cell repeaters in the room, and the 2nd time was staying at a hotel in San Jose CA a couple of months ago where I got an astonishing 50Mbit down and 20Mbit up(that was faster than the cable modem connection I had when I lived in the bay area for 5 years ending in 2016 though I did not live in San Jose, I lived 1 mile from the Youtube HQ as a point of reference as that has been in the news recently).

The mobile speed test app I use has a history going back to 2015, and has tons a single digit numbers, or in many cases numbers that start with 0.x Mbits.

I remember when I went to Barcelona a couple of years ago, pretty much any building I went into coverage went to either 2G or no signal(I believe because of the stone buildings).

In the city in California where my current home is there are several spots in busy areas (population ~220,000) where signal is bad enough I can't even get a DNS query to complete.

On my phone I have an app that is supposed to measure signal strength, the weakest one always seems to be "LTE RSRP Signal", which at home now currently measures at 14% (-114 db), however overall LTE signal strength it says is 52% (16 db), phone reports 2 bars of signal (I would consider this level of signal to be good). With this rating the speed test app reports 10.68Mbps(quite a bit more than I expected) of download and 0.63Mbps of upload.

It's not my phone because I bought my wife a brand new Sony XZ1 last November running Android 8, it's signal reception abilities are almost identical to my late 2013 Galaxy Note 3. Re-affirmed when I was able to lock in those 50Mbit speeds at the hotel a couple of months ago.

My carrier is AT&T, the 2nd largest carrier in the country.

With 3G life would probably be better on some occasions, unfortunately in order to force my phone to 3G requires shutting the phone down, removing the SIM card, booting it up again, typing in a code, and shutting it down again, re-inserting SIM card and booting it up again. I worry that is too much wear and tear on the device(mainly SIM removal and re-insert) that I don't do it unless I am traveling internationally. I already get the occasional "UNABLE TO READ SIM - REBOOT" message on bootup.

seems reasonable to me

Intel is really only on the hook for stuff that is supported, the warranties are usually just a few years (I see in the case of embedded they may support up to 7 years on extended support).

So chips outside of this window should not expect fixes. While it'd be nice if they got fixed it's not reasonable to expect to get support past the support window unless you have a special agreement with Intel for extended support.

I just stopped a support case for a firewall product yesterday for example. I had had the issue reproduce about once every 2 weeks for almost a year now(unable to reproduce on demand). Workaround is to reboot the unit(happens on both units in HA pair). Product ran fine for a good 4+ years without this condition until a particular software version was installed early last year(took 4-8 weeks for problem to be discovered at which point rollback was not practical, older software was end of life anyway). Vendor unable to find the cause yet alone find a resolution. Support for the product officially ends in about two weeks. Fortunately the decision was made to shut down the site that the affected product is operating in within the next month so I won't have to deal with it anymore.

But the point is I know when support for the product was ending, and while I certainly am frustrated they could not make any meaningful progress on the issue for just over a year at this point, I'm not expecting them to support past the support window.

You'd have every right to be upset if you reported the Meltdown issue to Intel within the warranty/support period of their product and they did not produce a fix. But that is not the case with all of the chips they are not going to fix(I haven't tried to check to see if any of their extended support embedded chips with 7 years won't be fixed if they were released in 2011).

If you REALLY feel you are that much of a target or have that lax of habits with regards to pretty safe computing then you should upgrade the hardware.

if they really cared about being good with privacy

I'd think they'd offer their service on another IP as well that doesn't have the data sharing, for those folks who are a bit more paranoid (not me though I have run my own DNS since 1996 along with email etc). But maybe that would confuse too many people or something.

all those billions in profits

Buys a lot of stress relief for those executives.

Not sure if it's a new thing that came out of the silicon valley area or if it was thought of long before, but the saying goes, it's easier to ask for forgiveness afterwards than ask for permission ahead of time.

While I have no doubt facebook has a shadow profile of me stored I have never registered an account with the service, and have been blocking their cookies for a decade or more(along with 13,800 other hosts and domains that don't have the word facebook in them).

Same goes for all other social media except LinkedIn where I have maintained an account though I take care not to feed them any behavioral information beyond what would be in my resume.

order direct

I read on a forum that you can buy the cards directly from nvidia's site at msrp. Though got the impression they don't support backorders so you have to get lucky to see them in stock.

https://www.nvidia.com/en-us/geforce/products/10series/geforce-store/

May be the spot.

sort of reminds me

Was at a ATT conference maybe 9 years ago. They had one bit where they talked about multiple provider network redundancy. Then they showed a slide of a (real)huge fiber cut that had probably a dozen or more carriers in the same pipe, I want to say the pipe or conduit was 1 to 2 feet wide buried in the ground.

Certainly was interesting to think about wrt datacenters and normal requirements that there be at least 2 fiber connection points on different sides of the building. How far might those fibers go before they converge? (If they converge) have never gotten a confident answer for that.

Docker's future is bright

The quote doesn't seem to distinguish between the technology (which appears to be mostly "free") vs the organization trying to sustain itself off that free technology.

Becomes even more cloudy I think if your betting your success at companies moving their stuff to public clouds, when those clouds are likely just to offer the same technology as Docker can and cut them out of the process entirely.

For me I think the whole concept of Docker is just sad, to be at a point where application quality has degraded so much and inter dependencies have exploded to the point where the only way to "manage" them is with something like Docker.

Containers in general have their use cases I have been using LXC containers in production for about 3 years now (on bare metal hardware in colocation facilities, mission critical e-commerce websites), works really well. Though my containers enclose almost a full OS with IP address(over bridged network interface), running services etc. The systems are managed similarly to VMs in that patches are installed, code is deployed within them etc. The biggest benefit for me is the vastly superior CPU scheduling opportunities running on bare metal, having 48-96+ physical CPU cores to pool from. I only put stateless services on them though.

Docker though, no interest in that stuff. Other folks at the organization I am at are interested and have been working with it, not me.

maybe those hyperscalers will make their own SSDs too

Buy the flash direct from the manufacturer and make(or at least design) whatever ssd config you want if the bulk of the logic is higher up in the stack.

It seems Pure and IBM and HDS have been doing this at least(making their own SSDs), so not too uncommon.

similar to HP?

Each DX-1 system appears to be a single Xeon server with 8 V100 GPUs in a 3U enclosure consuming 3500W of power

HPE's offering is a single xeon server with 8 V100 GPUs in a 4U enclosure, a bit bigger but the HP offering supports a lot more memory and local storage, power capacity is 8800W or 4400W if you were operating on one pair of active/standby power circuits(4 power supplies). So power usage is likely to be about the same as well (not surprising).

Comparing 4 servers each with 8 GPUs to a single server with 8 doesn't compute well.

Does it have a good terminal emulator ?

The one(s) that come with cmd and powershell seem pretty terrible..

My favorite terminal emulator under windows is the native rxvt from cygwin, much to my dismay is no longer available in cygwin (you have to use X now), I asked the developers one or two years ago on that since there was no mention on the site and they said it wasn't maintained anymore and they couldn't update it or something. So I just keep the old cygwin around for as long as it keeps workin.

My usage of cygwin is pretty limited to basic command line stuff and ssh. Without rxvt though it would be quite a bit more painful, and running full X doesn't sound appealing just for a few terminal windows. Cygwin user for a good 16-18 years now.

I struggle to think of use cases for this subsystem but come up mostly empty. I browsed Scott's blog posting on the developer aspect and it sounds like it could be useful there, though not for me since I am not a developer.

I'm sure a Linux subsystem is quite a bit less overhead than a VM though systems are so powerful these days, so much ram and so many cpu cores, even laptops that for most folks I think they are better off with a VM where you can back it up easier, experiment more(if needed), take snapshots of the VM and things like that.

I was running the earliest versions of vmware (pre 1.0) back in 1999 with windows on top of Linux at the time. Those were days of constrained resources for virtualization on the desktop. I remember trying Bochs too with Win9x, which worked as long as you were comfortable with 30 minute boot times(or so it seemed like from memory).

Windows 10 has so many downsides to it I can't imagine anything they could put into the system that would make me want to upgrade from 7.

strange to drop SD card with 2 SIM slots

If it has two sim slots, seems fairly common for phones in Asia to offer two SIM slots with the 2nd slot doubling as SD card slot if you don't want to use a 2nd SIM.

I could understand more dropping SD card if they lacked the 2nd SIM slot entirely. 128GB of storage may be passable for not having SD card.

My ~4 year old Note 3s which are my daily drivers have 128GB and 256GB SD cards. Storing thousands of pictures on those SD cards is slow but for tons of HD video it works well in combination with MHL for HDMI TVs when traveling(I have a Note 4 that I bring along on travel as well with another 256GB SD card). To think the phone I had before the Note 3 with (at the time) 96GB total flash(32GB base + 64GB SD), was a HP Pre3 with 8GB total flash(no SD card).

My SD cards, like my removable batteries aren't things that are swapped often, I change batteries probably once per year(to new battery), and SD card at this rate every 2 years(to larger size).

memories

It was a long time ago.. I remember I used to get excited about reading "kernel traffic" each week (looks like the last issue was 2005, website online still). Then they got overwhelmed or bored or something and stopped. Used to read Linux Weekly News(looks like that is still going), but maybe been a decade since I looked there too. Until the 2.4 series kernels at least I would frequently build custom kernel config and custom patches on occasion too.

I have used Linux daily for about 22 years now, though for the past maybe decade or more for me it has been "good enough", and I suppose as such I haven't found anything to get excited about since.

Linux news that would excite me however is introduction of a stable ABI that crosses minor and at least 1 major version number(realistic version numbers over the span of years). I gave up on that happening probably 15 years ago, but that's one thing that would get me excited.