Josh Snyder hashbrowncipher

The %util column in iostat has always been something of a weird bird. It was created back in the day when hard disks could only effectively process a single request at once. Back then, if %util was 100, then the disk was completely saturated and could go no faster. Modern block devices have the ability to perform multiple operations concurrently, and so %util's usefulness has ebbed. The manpage gives a clear warning about the meaning (or lack thereof) of %util, describing it as:

Percentage of elapsed time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100% for devices serving requests serially. But for devices serving requests in parallel, such as RAID arrays and modern SSDs, this number does not reflect their performance limits.

tl;dr:

don't define security tiers; use security cells instead
each service should have its own security cell

One time at JOB_1, we had a problem: we were about to start serving a dataset that was significantly more sensitive than our typical dataset. Leaking it would likely produce scary consequences in the real world, with ripple effects beyond just the company and its shareholders. We hadn't dealt with issues of that kind before; and as engineers on the project, my colleagues and I felt duty-bound to find the "right" solution. We started looking for other places where high security data was stored, and we found one owned by another team in the org. Perfect! We would store our dataset alongside the existing dataset, and they'd both be safe together in the protective cocoon of the high security environment.

This didn't work. The folks who owned the existing dataset were rightly distrustful of sharing their meticulously constructed environment with our team. And for good reason: adding our application t

One time at work, my team was upgrading an open source search-engine-cum-database that had an unfortunate predilection for breaking its external API. We had already deployed the new version of the database with its breaking changes, and now it was time to herd our customers off of the old version and onto the new version. Our customers were naturally reticent: for most of them it was just a bunch of work for very little reward. The migration would require careful testing, and just generally it didn't sound like a fun time. To top the situation off, some of these customers' services hadn't been touched in years, and the original authors had long since left.

I'm proud to say that my team was significantly more interested in accommodating our customers' needs than some other DBA teams I've worked with or around. During the migration we spent a fair bit of time chewing on ways to lessen the burden we placed on our customers. At one point the possibility of simply "handing off" the outdated search engines was dis

	Moving from running to port closed took: 3.147979 s
	Moving from port closed to port open took: 0.000000 s
	Moving from running to port closed took: 2.366330 s
	Moving from port closed to port open took: 0.000000 s
	Moving from running to port closed took: 2.998677 s
	Moving from port closed to port open took: 0.000000 s
	Moving from running to port closed took: 2.605815 s
	Moving from port closed to port open took: 0.024404 s
	Moving from running to port closed took: 2.754971 s
	Moving from port closed to port open took: 0.009866 s

	/*
	* A little x86-64 loader for Linux's binfmt_misc.
	*
	* Compile with: gcc -O3 -static -nostdlib -o loader loader.c
	*
	* Register as:
	* mount -t binfmt_misc none /proc/sys/fs/binfmt_misc
	* echo ':amd64:E::amd64::/path/to/loader:O' > /proc/sys/fs/binfmt_misc/register
	*
	* Then just run your favorite shellcode. Sample:

	Scientific American
	May 1973
	Volume 228
	Number 5

	Cryptography and Computer Privacy
	by Horst Fiestel

	Computer systems in general and personal "data banks" in particular
	need protection. This can be achieved by enciphering all material and authenticating

	#!/bin/bash
	# Copyright 2021 Josh Snyder
	# See license and documentation in lambda_function.py
	set -x -o errexit -o nounset

	ebs_name() {
	nvme id-ctrl -o binary $1 \| cut -c3073-3104 \| tr -d ' '
	}

	export AWS_DEFAULT_REGION=$AWS_REGION

	#!/usr/bin/env python3
	"""Cross platform, rootless, and fast debootstrap.

	Designed to work anywhere you can run Python and Docker/Podman (e.g. a Mac laptop).

	* Tested only with Ubuntu Focal and Jammy
	* Right now LZMA decoding takes up most of the time. Parallelize it? Python's LZMA
	library does release the GIL.

	"""

	- this uses a squashfs root image with a writable overlay
	- only a single application service is running (sshd)
	- the instance was a c5.large that had already booted once

	//Invoke like `./bin <frequency in Hz (e.g. 100)> <filename to read>`

	#define _GNU_SOURCE
	#include <fcntl.h>
	#include <stdbool.h>
	#include <stdlib.h>
	#include <stdio.h>
	#include <string.h>
	#include <time.h>
	#include <unistd.h>