Posts by fg_swe

Even Netflix struggles to identify and understand the cost of its AWS estate

Hetzner Versus Amazon

https://www.reddit.com/r/hetzner/comments/g4unpe/aws_vs_hetzner/?rdt=44412

Looks like a great option IF you have skilled administrators and developers on board.

Also, very little lockin as compared to AWS.

Hetzner

You can order resources in very small increments, starting from 2 ARM cores. Full control of these increments at root level. Transparent cost.

They also have storage services, though probably not as complex as AWS.

Of Course

...the US giants will claim that only they can do "enterprise" workloads.

Which is wrong. Hetzner has a full blown API for creating and deleting cloud resources

https://docs.hetzner.cloud/#overview

Probably not as exquisite as AWS, but more transparent ?

Competition ?

We have OVH, Hetzner, 1und1, Schwarz IT/StackIT and quite a few more cloud providers here in Germany and France.

Hetzner now also has a DC in Finnland, where leccy is cheaper than Germany.

OVH can use competitive french nuclear power and has DCs in several countries.

Why be locked in to the giants if smaller and easier to understand competitor exist ?

I can recommed Hetzner, fixed, predictable price and excellent reliability and customer service.

Edit: Hetzner has even more DC locations: https://www.hetzner.com/de/unternehmen/rechenzentrum/

We told Post Office about system problems at the highest level, Fujitsu tells Horizon Inquiry

Re: The Bright Side

Well, I assume you never followed the corruption in other spheres.

And maybe you fell for foreign B.S. that will of course minimize their problems while inflating ours.

Check the Russian moon rocket attempt if you want to see reality there.

Re: The Bright Side

Master of corruption BIDEN has been ejected...

The Bright Side

What makes the US/European powerful and civilised is that we can openly discuss these affairs. In other nations, stuff like this will be swept under the carpet and secret police would deal with whistleblowers.

So, glass is 2/3rd full.

A320, Jãger 90, A330, A330, A340, A380, A400M

V-Model works very effecively for these aircraft. Not a single airframe lost due to software engineering. Full software authority !

One loss of an A400M due to a mess-up in the loading of calibration parameters end of line.

If Airbus can do that, likewise SAP and Oracle can do it for the banking industry. It"s a matter of the right regulation and a minor finacial expense in the grand scheme of things.

MCAS, Ahr Valley Flood, Covid Scam

Arguably even worse, but no serious consequences. We live in a corrupt world and many of our leaders think it is OK because Moscow, Beijing and New Dehli are even more corrupt.

Banking Software Quality

I have worked in internet banking in the past and can tell you that very often software has very serious bugs. Sometimes the hardware, too. Including IBM mainframes.

No software QA to speak of seriously.

The government should mandate V-Model development standards, similar to what is in force for auto, train, aerospace and medical industries. Essentially, document everything, test everything on multiple levels.

Also, mandate extensive logging and archiving of logs.

Proper engineering instead of social science B.S.

Re: Lessons ?

That is what I meant with 3.

Multiple independent, machine- and human-readable logging is key to any serious banking operation.

Lessons ?

1.) Unnecessarily complex system architecture. Why no online connection to the mainframe?

2.) Childish belief in said supercomplex system. "Computer is never wrong"

3.) No proper logging at the postmaster terminals to have a ground truth to check against.

Aliens, spy balloons, or drones? SUV-sized mystery objects spotted in US skies

Sure Lefty

You are still not over the loss of your lunatics ? Those who think that man and woman are "social constructs" ?

Electronic Warfare Soldier Bu11$h..

Always funny to see how the Groom Lake guys mess with the minds of electronic-idiots.

https://de.wikipedia.org/wiki/Area_51

Then their collaborators in HorrorWood latch onto it.

BASIC co-creator Thomas Kurtz hits END at 96

False

A good programming language has a proper syntax, grammar and quite a few semantic rules.

If you look at a compiler or interpreter as a bunch of sub-programs, you miss the important parts.

Bash

Bash exactly exposes the punctuation craze, even worse than C.

Just because it comes preinstalled on most Unix like machines means little.

From a pedagogic point of view, Pascal, Ada, Java, C# or VB.Net are probably the best beginner's languages. Pupils should be shown the light before you take them down into the dungeons of C and C++. And of course there should be proper algorithms+data structures education, otherwise "learning a programming language" is rather pointless.

Pupils should know what variables and mathematic functions are. Which means that bothering 10 year old children with Scratch is not a good idea.

Palo Alto Networks tackles firewall-busting zero-days with critical patches

Clusterf**k Engineering

The entire PHP contraption of the firewall should be locked behind a tiny crypto library, which can be mathematically proven correct.

https://github.com/DiplIngFrankGerlach/MST

Only a counterparty with the right symmetric key can ever send a send a single octet or more to the PHP stuff.

But hey, why make things secure, if you can expose a PHP hairball ?

Bonus points if some of the 400 000 LOC of the SSL/TLS library has exploits, too !

The informatics world seems to indulge in the latest insecure design pattern, instead of using simple, proven approaches.

Rust haters, unite! Fil-C aims to Make C Great Again

Broken Window Fallacy

Europe became the leader of all human knowledge by not believing in such stuff.

https://en.wikipedia.org/wiki/Parable_of_the_broken_window

Kepler, Gauss, Newton, Leibniz, Volta, Ampere, Zuse, Planck, Heisenberg, Turing, Gödel, Shannon, Wirth, Hoare - stand on their shoulders !

Garbage Collection

Typically, garbage collected systems need 2x the amount of RAM an equivalent reference counted system needs. Reason is simple: you cannot run the GC all the time or efficiency goes to zero. So the program must "accumulate" serious amount of garbage, before the next GC run.

Also, the non deterministic GC execution point in time is bad for semi-realtime things such as ergonomics.

GC is great for academic systems such as functional languages or for various accounting efforts. Not so much for the real world that interact with fingers, signals, sensors, actors, motors, brakes and so on.

Pointer Arithmetics, Funny Casting

It is very much possible to write fully functional C application programs without these two things.

The only reason for pointer-magic I can see is system-level programs, which need to perform special things such as copying program images and the like.

C can only be made "somewhat" memory safe by extremely expensive efforts such as

A) valgrind

B) 16 octet fat pointers

C) Always-atomic, always-expensive reference counting

I still fail how "Fil-C" can stop the casting of an integer into a pointer(can be part of a struct that is casted to) and then all hell breaking lose.

Somewhat Yes

valgrind will slow down your program by a factor of 100 to perform type checking. Other memory safe languages such as Java, Rust, C#, Sappeur only reduce performance by a factor of 3 to 7.

Re: Probably it was, for the time

According to Sir Hoare, there was a Fortran to Algol Transpiler for an ICL machine. It exposed tons of indexing bugs in "proven' Fortran code.

Syntax Not Equal Semantics

Ficus on semantics, Rust is imperative, while Ocaml's key aspect is functional programming.

Male Cow E..

All multithreading needs atomic operations for the collaboration of threads. All you can and should do is to limit the atomic operations to a minimum. But not zero.

Fat Pointer Disease

Sane languages need only 16, 32 or 64 bit(depending on hardware size) pointers. Sane languages do not have pointer arithmetics. The objects/structs pointed at typically need 16 or 32 bit of reference counter. Only mulithreaded objects need to operate on this counter using atomic instructions. The language type system should make the difference between single and multithreaded records/objects/structs crystal clear.

Then memory safe pointers/references can be compact and very fast.

Indeed !

Algol was high quality technology as opposed to the C-Hamburger-fast-food stuff.

Re: Yolo-C/C++

There is zero need to make every pointer operation atomic, IF the type system has a notion of single- and multithreded data rypes. ST code needs only simple refcounted pointers for memory safety. MT data structures/objects do need atomic locks, though. Efficoent, well designed code will operate on ST data 99,99% of time.

see http://sappeur.di-fg.de

Bloat

There is zero need for bloat due to memory safety.

My memory safe transpiler needs in the order of 10000 LOC. Generated programs can be tiny, too, if only few standard libraries are used.

http://sappeur.di-fg.de

FALSE

Memory errors of C and C++ programs can be very hard to track down, especially in multithreaded programs. They also enable Silent Subversion of anything facing the outside world.

The "programmers should be better" argument has proven to be unrealistic. Hundreds of times in anything from VxWorks to the Windows Kernel. Or SSL implementations.

Mystery Palo Alto Networks hijack-my-firewall zero-day now officially under exploit

Not Browsers

I would imagine a standalone GUI to administer the firewalls. No insecure SSL bloat. No CAs. Symmetric ciphers that are keyed by physical access to the firewall via RS232.

Re: Wonder how long before the US CISA stops issuing warnings and recommendations.

Trump can intercept the firewall physically and then do some reflashing on the PCB.

FALSE

Any non trivial intranet will contain an exploitable thingy, from which an attacker can lauch the attack.

So- the command interface of a firewall must either be a dedicated RS232 or a minimalist secure crypto interface.

E.g. https://github.com/DiplIngFrankGerlach/MST

Hamburger Security Engineering

A proper control interface would not even interpret a single octet from the outside until a proper administrative crypto session has been established. No need for the SSL abomination as a crypto layer.

Something like this:https://github.com/DiplIngFrankGerlach/MST

Linus Torvalds affirms expulsion of Russian maintainers

Yes, Probably

Given the bellicosity of Moscow, this might be necessary.

The Russian government can easily coopt each of their citizens. "Nice FOSS project you contribute to. Include this backdoor, OR go to the GULAG".

FALSE

He acted upon obvious security risks. Where he failed was in the calm explanation.

Linux Governance, Security, OpenSSH Supply Chain Attack

The Linux Foundation, Mr Thorvalds, Redhat, Suse, Canonical etc would be well advised to conduct a conversation about:

1.) How are FOSS contributors identified and vetted ? There are obvious an severe security risks from state and organized crime actors.

2.) What are the minimum security standards of contributor's systems ?

3.) Is it really necessary to have bloated(read: easy to hide a backdoor) access systems such as OpenSSH ?

4.) Should certain types of code such as the /dev/random generator, OpenSSH and the TCP/IP stack be under special controls ? All of them could crack open millions of servers in the internet. Impact would be massive and world-wide.

5.) What is the relevant government legal framework covering Linux kernels and distributions ?

Linux has become a critical resource and must be protected by more than angry shouting and willy nilly actions.

@Thorvalds: Hire A PR Expert

Apparently Mr Thorvalds is unable to explain this affair in a calm and rational manner.

Something like "Russian contributors could be government agents and could implant backdoors. See the current war. For this reason we have suspended them until the security situation improves".

No need for angry stuff.

Mr Thorvalds and the Linux Foundation should use a PR expert to make such sensitive statements.

US Army should ditch tanks for AI drones, says Eric Schmidt

Joint STARS

Did I mention you can now see vehicles from 300km standoff ?

https://en.wikipedia.org/wiki/Northrop_Grumman_E-8_Joint_STARS

Just datalink the positions to ATGMs that launch vertically from a forest.

We live in the age of electronics, not in the age of steel !

Yes, It Was in 1944 Already

That allmighty Tiger was a sitting duck against the US and UK air forces then. Large, slow sitting duck.

It has now become worse, as the infantery and helicopters with long distance arms have joined the game.

Ukraine proved this. The talk of "combined arms" is theoretical babble - because the ATGM gunner can hide 3000 or more meters away.

The heavy tank industry has a vested interest and produces lots of heavy steel and hot propaganda air.

No

Recent history from Yemen to Ukraine proves Mr Schmidt right.

Your dislike of this oligarch might be clouding your mind ?

Schmidt Has a Point

In Yemen, in Lebanon, in Syria and in Ukraine we have seen the MBT being a blind old tiger in a dark hole, surrounded by vipers. The vipers (ATGMs and drones) had it easy with the cat.

Can active defense systems put light into the hole ? Questionable.

Combustion engines grind Linus Torvalds' gears

Re: Makes perfect sense

So were the Russian space things. And the Russian nukes. And their nuke bomber Tu95 is also powered by a "nazi" engine. To the present day the most powerful turboprop.

It's about time Intel, AMD dropped x86 games and turned to the real threat

Re: "amid growing adoption of competing architectures"

AI generated code ?

Steganography ?

It's true, social media moderators do go after conservatives

Bribe

https://www.berliner-zeitung.de/news/gates-stiftung-unterstuetzt-den-spiegel-mit-weiteren-29-millionen-dollar-li.194183

Oligarchy Media Corruption

"high value media" means it is financed and corrupted by oligarchs. Soros, Gates and the like. They peddle their half baked medical products and their marxist ideas by these channels.

Facts such as CDC VAERS are getting suppressed, because these financiers demand that.

World Wide Web Foundation closes so Tim Berners-Lee can spend more time with his protocol

Errata

Must read Gutenberg, of course.

Re: He's an inept dolt and the project is a distraction and a money pit.

So you claim he is responsible for "evil" information/ideas being published on the WWW?

Like Guttenberg being the cause of the 30 years war ?

It would be so much better if the old information monopolies/empires(newspapers, TV, Radio, book publishers) kept their power ?

If there were only the catholic church ?

Let me propose this: on the WWW you can show your best or your worst side. You can parrot nonsense. You can be tricked by hostile actors. But you can also act in good faith to help others. You can find very good advice in a heap of rubbish, just like there are good books amomg a mountain of others.

Kyndryl follows in IBM's footsteps with rolling layoffs likely affecting thousands

Great Germans

There were plenty of officers, great engineers, scientists, technicians in Germany between 1933 and 1945. They invented many things that we use to the current day, including the computer using binary signals and fully programmability. Most of them had no connection to the Nazi ideology.

https://de.wikipedia.org/wiki/Konrad_Zuse

https://de.wikipedia.org/wiki/Erich_Fellgiebel

In addition to modern computers, Fellgiebel also made large-scale carrier frequency telephony happen.