Viewing profile — theanomaly

We're running Aurora PostgreSQL 15.12, which includes the fix mentioned in the release notes. Looking at this comment and the AWS documentation, I think there's an important distin…

AWS Support initially pushed back and suggested it's because of high replication lag but they were looking at metrics that were more than 24 hours old. What kind of failure did you…

I'm surprised this hasn't come up more often too. When we worked with AWS on this, they confirmed there was nothing unique about our traffic pattern that would trigger this issue. …

While it's tough if you want new drives, I've found I could frequently get used drives on eBay that have significant history on Backblaze's report. Despite the increased risk from …

Because you could bypass filtering / approval mechanisms, or automatic image processing that could defang a malicious image.

Right. So let's say we have file A, which is an innocuous image file, and file A', which is a malicious image file, where MD5(A) == MD5(A'). Based on the MD5 prefix collision attac…

Ah I see, I forgot that in the SSL attack the attacker had to choose both certificate prefixes as opposed to just one. Thanks! It does seem to me though that if I could coerce/dire…

Looking at the image on the link, the "checksums" are a suspicious 32 characters... Hoping you guys are not using md5sums. Am I missing something, or would this let any node (super…

Thanks for the analysis -- it is good that people have this context in their heads when designing systems. The missing conversation from this article is that some people conflate s…

Huh? I worked in school district IT for quite some time and a huge number of services are billed per-student.

I'm confused It’s simple – here’s how it works: Say a community is built in Year 1. The community’s streets need to be rebuilt every 30 years. In Year 30 a new, identical community…

Yes, but you have to know to exclude their backend. And, that library may be several dependencies deep. Now you're expecting potentially junior developers to have the insight to gr…

Whoa. The author recommends including slf4j-nop as an explicit dependency of libraries?! This means that when a developer writes an application and forgets to include an slf4j back…

The trick is to request random top-level domains, where each request will necessarily trigger a lookup to the root. Further, recent research has shown the number of open DNS resolv…