bvandewalle (u/bvandewalle)

bvandewalle commented on We need to do the math, even on “small” projects strongtowns.org/journal/2... · Posted by u/oftenwrong

saghm · 5 years ago

I read their comment more as saying that building a better construction company wouldn't fix the issue (e.g. they might not get hired), not that it wasn't possible to build a better company.

bvandewalle · 5 years ago

I think you hit the nail on the head.

Elected officials unfortunately don't have that much incentive to hire the "cheapest" company as the debt will be incurred over the next 100 years while they will be long gone.

They probably hire the company that they feel will give them the least amount of trouble, which is the easiest to navigate or that will do something for them in exchange. It's the "not my money" issue at play.

Deleted Comment

bvandewalle commented on Ask HN: How does your company manage its encryption keys? · Posted by u/2mol

scott00 · 5 years ago

So then how do you manage the secret that authenticates an application's identity? And what good is the logging if after an application has the secret it can do whatever it wants with it?

bvandewalle · 5 years ago

if it is an instance on the cloud, GCP and AWS let you define ServiceAccounts that get populated on the Instance at boot time.

you should only let the instance access the secret it requires.

bvandewalle commented on Ask HN: How does your company manage its encryption keys? · Posted by u/2mol

mmm_grayons · 5 years ago

I can't seem to understand how a "secrets manager" helps things. Could someone who does ELI5 why it's better than a config file with permissions locked down?

bvandewalle · 5 years ago

It makes sense at scale. If you are a company of two there are probably better solutions.

At scale, you can very granularly define policies for each secret. When a secret is accessed, it is done so through a user or application identity. Each access is also logged.

bvandewalle commented on Ask HN: How does your company manage its encryption keys? · Posted by u/2mol

varikin · 5 years ago

This just pushed the problem further down the stack. You should have keys to unlock vault when it is restarted. How do you secure those keys?

bvandewalle · 5 years ago

If you use Vault, you should use it as an RBAC system as well.

That means that each application got a ServiceAccount (SA) and each user got a username/password. Based on your identity, you get access to specific secrets from Vault.

bvandewalle commented on Why is Kubernetes getting so popular? stackoverflow.blog/2020/0... · Posted by u/a7b3fa

garethmcc · 5 years ago

There are organisations with 1000's of services on Serverless seeing enormous benefits in reduced management overhead and reduced costs compared to the Kubernetes solution they previously ran.

bvandewalle · 5 years ago

My issue with serverless though is that you need to refactor your code to make it work specifically for it. If you don't start to think serverless on day one it gets more and more difficult to convert to it down the road.

bvandewalle commented on Why is Kubernetes getting so popular? stackoverflow.blog/2020/0... · Posted by u/a7b3fa

bvandewalle · 5 years ago

I'm using Kubernetes extensively in my day to day work and once you get it up and running and learn the different abstraction, it becomes a single API to manage your containers, storage and network ingress needs. Making it easy to take a container and getting it up and running in the cloud with an IP address and a DNS configured in a couple API calls (or defined as YAMLs).

That being said, I will also be the first one to recognize that PLENTY of workloads are not made to run on Kubernetes. Sometimes it is way more efficient to spawn an EC2/GCE instance and run a single docker container on it. It really depends on your use-case.

If I had to run a relatively simple app in prod I would never use Kubernetes to start with. Kubernetes starts to pay itself off once you have a critical mass of services on it.

bvandewalle commented on Spotify signs ‘The Joe Rogan Experience’ to an exclusive multi-year deal techcrunch.com/2020/05/19... · Posted by u/mmq

paulgb · 5 years ago

Agreed. I don't think people appreciate how unique podcasting is as a distribution medium in that it has lasted so long as a completely open ecosystem. Nobody needs anyone's permission to write a podcasting app or launch a new podcast.

Sad to see that start to change, but I'm also kind of optimistic for one reason: there's just so damned much audio content out there that it is people's attention, not audio content, that is scarce. I don't think platforms have the upper hand in audio content the way that, say, Netflix does. I think that's why platforms like Luminary haven't really taken off.

bvandewalle · 5 years ago

It feels like this became the life-cycle of Internet.

The same thing happened with decentralized websites and blogs.then everyone got attracted by the managed platforms and now the web is more centralized than ever.

bvandewalle commented on Spotify signs ‘The Joe Rogan Experience’ to an exclusive multi-year deal techcrunch.com/2020/05/19... · Posted by u/mmq

slg · 5 years ago

I don't listen to his show, but as a general podcast fan this is sad. This isn't the first podcast to move away from having a free and open feed of the show, but it is certainly the biggest and it opens the doors for a lot more exclusivity deals in the future.

bvandewalle · 5 years ago

you make the right point. A lot of people see this as youtube censorship, but the podcast was also available in its purest form: through a RSS decentralized feed.

Now it moves to a walled garden with content unavailable to the outside world.

Deleted Comment

u/bvandewalle

KarmaCake day257May 28, 2019View Original