Viewing profile — ffk

A lot of the time once you get into multi-gig+ territory the answer isn't "make the kernel faster," it's "stop doing it in the kernel." You end up pushing the hot path out to userl…

I think a more accurate version of this is: unit tests were not only per-method but also per functionality. This was often called BDD (Behavior Driven Development), e.g. Ruby's cuc…

Since the 90s, New Zealand laws have been written in clear, modern, accessible English. The end result is the broader population understands it more and can also reason about it wh…

Sometimes it’s done to fit into an existing tool/database that has a preexisting limit. Or when the hash is used only as a locator rather than for integrity. Not a good practice im…

Fun fact: docker started as bash, then moved to python before settling on golang. Also, in a 2013 docker meetup, someone wrote a docker clone in bash. People want to learn! Hopeful…

I'm guessing the decision comes down to ease of use for people to participate in mirroring. My underestanding is IPFS tends to require more infrastructure, and still requires someo…

On the first point, OPA is much older than OpenFGA. To really illustrate the point, OPA became a graduated project about a year before OpenFGA had their first code drop in the publ…

Good question! The term is more generic, introducing something to an existing system to begin a chain reaction.

There are some applications where the ability to vectorize the headers and operate on them with SIMD help. These types of apps tend to pin a full core to do only packet processing …

It depends on what you are trying to do though. I don’t think the kernel has an easy path to operating on a set of packet headers as a vector at this point. Not saying it can’t hap…

Interestingly, the fastest CPU based network switches tend to do full kernel bypass. The kernel is generally slow compared to OVS and VPP, especially when they traverse over someth…

If you secure a loan for or lease a car, isn’t insurance mandatory for completion of the transaction? If so, how are most people still driving Kias off the lot if they can’t get in…

It’s probably validated by a human before the message is deployed.

Agreed, one way to help mitigate this is to establish Layer 7 security controls, rather than implicitly trust the network. Tailscale shouldn't be the sole security control in any e…

Thank you for mentioning this! I wrote docker save and load, and I’m happy to hear that it helped you!

Docker save (and presumably podman too) adds that metadata as a file in a tar. Each layer becomes a tar that is nested in the top level tar.

Another insane idea, invite Japanese teams to play. Many Japanese people love baseball!

Very cool! Found a gap, Linux Foundation's FD.io's VPP (a high performance network virtual switch) has native wireguard support as well, all in userspace. Support here means you ca…

Something to consider, if you are IO constrained, compression may speed up reads because you shift some of the cost of IO to the CPU. Ultimately, you'll need to measure this to kno…

Been a while since I looked. My understanding is many of these techniques such as SMPC are useful only when operations are linear (eg no exponents or tan functions) and on simple b…

Check out CBRS which is "licensed-by-rule." You should be able to use CBRS to deploy private 5G.

Unfortunately, I don't think this is going to be the outcome. We're more likely to end up with "Here is the list of filenames, subcomponents, and associated hashes" as opposed to r…

It's not a joke, BGP servers used to authenticate each other with this in the late 90s. This was also before NAT was really a thing.

Why not just implement Single Packet Authorization (SPA)? The port only opens to that specific source on a recent cryptographically signed request with a timestamp. https://www.lin…

I believe grpc only uses the http2 frames, which are bidirectional. Double check this though.