Hacker News: komuW

Founder Mode and the Art of Mythmaking

komuW — Wed, 18 Dec 2024 13:35:33 +0000

Article URL: https://charity.wtf/2024/12/17/founder-mode-and-the-art-of-mythmaking/

Comments URL: https://news.ycombinator.com/item?id=42450294

Points: 6

# Comments: 0

New comment by komuW in "Show HN: I combined spaced repetition with emails so you can remember anything"

komuW — Thu, 05 Dec 2024 07:14:24 +0000

Take a look at FSRS.

The paper: https://dl.acm.org/doi/10.1145/3534678.3539081?cid=996605471...

Various implementations: https://github.com/open-spaced-repetition/awesome-fsrs

Some benchmarks of various srs algorithms: https://expertium.github.io/Benchmark.html

New comment by komuW in "Dito – an advanced Layer 7 reverse proxy server written in Go"

komuW — Thu, 10 Oct 2024 06:57:59 +0000

Have you looked at Tyk? https://github.com/TykTechnologies/tyk/

New comment by komuW in "Ask HN: Who wants to be hired? (September 2024)"

komuW — Wed, 04 Sep 2024 07:02:33 +0000

Location: Nairobi, Kenya

Remote: Yes

Willing to relocate: No

Technologies: Golang, Python, Django, SQL, PostgreSQL, AWS

Résumé/CV: https://www.komu.engineer/cv/komu-CV.pdf

Email: komuw05@gmail.com

Blog: https://www.komu.engineer/blog

I'm a software engineer with ~8yrs experience. Here's somethings that I've done;

- Reduced cloud costs for a production kubernetes service by 20%. This was done by analysing pod utilisation on kubernetes and then right-sizing the pods to match the expected usage.

- Read the SMPP specification and implemented a client for it from scratch. Integrated the client into a production application and used it to send out SMS at averaget rates of 800/second.

- Created an open source ACME client based off the ACME specification.

Africa's infrastructure-led growth is failing. It's time to focus on agriculture

komuW — Wed, 14 Aug 2024 11:18:02 +0000

Article URL: https://carnegieendowment.org/research/2022/12/africas-infrastructure-led-growth-experiment-is-faltering-it-is-time-to-focus-on-agriculture

Comments URL: https://news.ycombinator.com/item?id=41244818

Points: 1

# Comments: 0

New comment by komuW in "Ask HN: Who is hiring? (August 2024)"

komuW — Fri, 02 Aug 2024 09:08:09 +0000

Hi, could you guys please reply to job applications. I had applied in April and up to now I haven't received even a rejection email.

New comment by komuW in "Why is observability so expensive?"

komuW — Thu, 04 Apr 2024 06:44:09 +0000

My solution[1] to this problem is to do what they did in the Apollo Guidance Computer; log to a ring buffer and only flush it (to disk or wherever) on certain conditions.

1. https://www.komu.engineer/blogs/09/log-without-losing-contex...

New comment by komuW in "How does Sidekiq really work?"

komuW — Mon, 05 Feb 2024 20:09:24 +0000

Nice article. If you ever wondered how the python equivalent(celery) works, I wrote a blogpost about that ~4years ago; https://www.komu.engineer/blogs/07/understand-how-celery-wor...

How to propagate context without cancellation

komuW — Fri, 25 Aug 2023 10:06:28 +0000

Article URL: https://tyk.io/blog/how-to-propagate-context-without-cancellation/

Comments URL: https://news.ycombinator.com/item?id=37259942

Points: 1

# Comments: 0

Small Dog

komuW — Tue, 11 Jul 2023 18:49:32 +0000

Article URL: https://bikozulu.co.ke/2023/07/11/small-dog/

Comments URL: https://news.ycombinator.com/item?id=36685556

Points: 2

# Comments: 0

New comment by komuW in "Clog: Making a homegrown ClickHouse log for $20 a month"

komuW — Mon, 13 Feb 2023 13:43:20 +0000

My favorite technique for reducing the cost of logging is the same technique that was employed in The Apollo Guidance Computer(though I'm not sure if they did it for cost purposes).

To quote from Annotations to Eldon Hall's Journey to the Moon[1]: "The Coroner recorded every instruction executed, with its inputs and results, writing over the oldest record when it filled up. When a program crashed, you could punch out a full record of what it was doing in most of its last second and analyze the problem at your ease. I have often wished that PCs offered such an advanced feature."

So essentially buffer all logs into an in-memory circular buffer of capacity N. If a log record is emitted that has a certain severity/level; flush all records from the buffer to disk/clickHouse/grafana/whatever.

The python MemoryHandler[2] almost implements the said technique, except that it also flushes when buffer is full; which is not particularly what I would want.

I also wrote a blogpost[3] about how to log without losing money or context, ~3yrs ago.

1. https://authors.library.caltech.edu/5456/1/hrst.mit.edu/hrs/...

2. https://github.com/python/cpython/blob/v3.11.1/Lib/logging/h...

3. https://www.komu.engineer/blogs/09/log-without-losing-contex...

Plain text Kubernetes secrets are fine

komuW — Thu, 26 Jan 2023 12:04:47 +0000

Article URL: https://www.macchaffee.com/blog/2022/k8s-secrets/

Comments URL: https://news.ycombinator.com/item?id=34530674

Points: 2

# Comments: 0

Libxev: A cross-platform, high-performance event loop

komuW — Thu, 26 Jan 2023 05:26:07 +0000

Article URL: https://github.com/mitchellh/libxev

Comments URL: https://news.ycombinator.com/item?id=34528009

Points: 5

# Comments: 0

Gleam gets Incremental Compilation

komuW — Mon, 23 Jan 2023 14:52:22 +0000

Article URL: https://gleam.run/news/v0.26-incremental-compilation-and-deno/

Comments URL: https://news.ycombinator.com/item?id=34489415

Points: 2

# Comments: 0

Type Checking If Expressions

komuW — Mon, 16 Jan 2023 07:22:08 +0000

Article URL: http://journal.stuffwithstuff.com/2023/01/03/type-checking-if-expressions/

Comments URL: https://news.ycombinator.com/item?id=34397857

Points: 1

# Comments: 0

New comment by komuW in "CircleCI says hackers stole encryption keys and customers’ source code"

komuW — Sun, 15 Jan 2023 11:54:27 +0000

Note that dumping the Vault's process memory is beyond hashicorp/Vault's threat model. See: https://github.com/hashicorp/vault/issues/1446#issuecomment-...

I'm bringing this up because the circleCI blogpost says that the attacker did memory-dump encryption keys from a running process. See https://circleci.com/blog/jan-4-2023-incident-report/

So even if they were using hashicorp/vault, the attacker could probably still have been able to mem-dump vault's process.

New comment by komuW in "CircleCI says hackers stole encryption keys and customers’ source code"

komuW — Sun, 15 Jan 2023 11:50:44 +0000

Note that dumping the Vault's process memory is beyond hashicorp/Vault's threat model. See: https://github.com/hashicorp/vault/issues/1446#issuecomment-...

New comment by komuW in "CircleCI says hackers stole encryption keys and customers’ source code"

komuW — Sun, 15 Jan 2023 11:43:12 +0000

yeah this just kicks the can down the road.

New comment by komuW in "CircleCI says hackers stole encryption keys and customers’ source code"

komuW — Sun, 15 Jan 2023 11:03:47 +0000

> That requires client-side SSL authentication,

I do not think it requires client side SSL. See: https://engineering.salesforce.com/tls-fingerprinting-with-j...

What is been fingerprinted is the TLS negotiation between client and server.

New comment by komuW in "CircleCI says hackers stole encryption keys and customers’ source code"

komuW — Sun, 15 Jan 2023 09:36:14 +0000

From the circleCI blogpost[1]: "Our investigation indicates that the malware was able to execute session cookie theft, enabling them to impersonate the targeted employee in a remote location"

I haven't seen much discussion on how this specific attacker entrypoint can be mitigated. So I'm going to make a naive attempt in this comment.

How about storing the client's IP address in the session cookie. Then whenever the server recieves the cookie, it compares the client's IP address against the one stored in the session cookie. The server denies the login if there's a mismatch. The cookie would of-course have to be signed(hmac etc) so that it is tamper proof.

One problem with this is that client IP addresses are easily spoofed[2].

So, instead of storing the client's IP address; how about we instead store the clients' SSL fingerprints[3][4]. I haven't looked much into the literature, but I think those fingerprints are hard to spoof.

1. https://circleci.com/blog/jan-4-2023-incident-report/

2. https://adam-p.ca/blog/2022/03/x-forwarded-for/

3. https://github.com/salesforce/hassh

4. https://github.com/salesforce/ja3