Viewing profile — mac-chaffee

That's really cool! I actually did download an archive of aol-sucks while researching this, but the software I was using to look through the mbox file was kinda buggy so I gave up.…

I'd generally confirm that suspicion: https://www.macchaffee.com/blog/2023/wafs/ WAFs have a few valid uses in my opinion: "virtual patching" and the ability to create custom rules…

I agree but there's a lot of nuance to the next question of "well what IS bad for the environment" and tech's role in that question. I've been unsatisfied with how people in tech a…

I wrote up a bit of background on non-competes in mid-2024, I see my fears came true: https://www.macchaffee.com/blog/2024/non-competes/

I welcome a k8s replacement! Just how there are better compilers and better databases than we had 10-20 years ago, we need better deployment methods. I just believe those better me…

Author here. Yes there were many times while writing this that I wanted to insert nuance, but couldn't without breaking the format too much. I appreciate the wide range of interpre…

Shocked that there was a tiller instance running. That's been deprecated since 2020: https://helm.sh/blog/helm-v2-deprecation-timeline/

The use-case seems to be intentionally narrow: > The Secrets Manager Agent provides compatibility for legacy applications that access secrets through an existing agent or that need…

Some of the use-cases mentioned would mean FERPA applies: https://studentprivacy.ed.gov/faq/i-want-use-online-tool-or-... Surprised FERPA wasn't mentioned explicitly. At least this…

Each with a unique public IPv4 address too!

It's especially frustrating that I firmly believe operations is a solved problem, but good luck getting a company to adopt the practices that every other mature tech company has al…

Build-related fixes are only treating the symptoms, not the disease. The real fix would be better sandboxing and capability-based security[1] built into major OSes which make backd…

That would only be true if WAFs weren't so easily bypassed: https://habr.com/en/companies/dsec/articles/454592/

I personally consider the ArgoCD UI an anti-feature. Attaching some hulking mass of Javascript dependencies to the thing that has cluster-admin rights to my production cluster is u…

In actuality, WAFs hurt more than help. They give a false sense of security since they are so easily bypassable, plus they have a significant performance cost and a significant cha…

WAFs are 2000s-era software that have long overstayed their welcome: https://www.macchaffee.com/blog/2023/wafs/

We have been working this year to increase our US presence, and we're hiring now: https://join.com/companies/qdrant/9929148-cloud-platform-dev... Source: I work at Qdrant from the …

I wrote about this here: https://www.macchaffee.com/blog/2023/ethics-self-attestation... Too many jaded technologists throw their hands up and just ignore ethics. At least ACM are …

The encryption Chrome uses isn't just some key on disk that can be scooped up. On macOS at least, it's stored in the secure enclave which only signed Chrome binaries can access. No…

What I want next is for FireFox to do something to protect my cookies on disk. Chrome at least encrypts them using a key backed by the system keychain (although Chrome allows remot…

I actually wrote this post in preparation for a fight about WAFs with a SOC2 auditor, wish me luck! :) The specific control says "Boundary protection systems (for example, firewall…

DDoS prevention is outside my area of expertise, so I'm not sure. I should clarify that this blog isn't referring to that use-case :)

Kin selection takes place within a single species: > The DNA confirmed that both the sailors and tiny passengers inside the hemisphere belong to the same species.

Unfortunately, differentiating good behavior from malicious behavior is a central pillar of security, and the existence of this feature undermines that pillar. * The fact that it's…

Funnily enough, "the end of time" for NFSv3 is in about 15-83 years, depending on whether the implementation uses signed or unsigned 32-bit integers for timestamps: https://lwn.net…