conradludgate (u/conradludgate)

conradludgate commented on Ban me at the IP level if you don't like me boston.conman.org/2025/08... · Posted by u/classichasclass

ronsor · 3 days ago

> The latest was a slow loris approach where it takes forever for robots.txt to download.

I'd treat this in a client the same way as I do in a server application. If the peer is behaving maliciously or improperly, I silently drop the TCP connection without notifying the other party. They can waste their resources by continuing to send bytes for the next few minutes until their own TCP stack realizes what happens.

conradludgate · 3 days ago

How do you silently drop a TCP connection? Closing the socket fd usually results in a FIN packet being sent whether I want it to or not.

Additionally, it's not going to be using that many resources before your kernel sends it a RST next time a data packet is sent

conradludgate commented on AWS in 2025: Stuff you think you know that's now wrong lastweekinaws.com/blog/aw... · Posted by u/keithly

mdaniel · 8 days ago

You'll be glad(sic) to know they have specialized hostnames for IPv6 control plane endpoints, because AAAA records scare the olds https://github.com/aws/aws-cli/blob/2.28.14/awscli/botocore/...

conradludgate · 8 days ago

We enabled ipv6 for our APIs at work. Nothing broke immediately, but we've had a steady stream of unreachable host errors related to ipv6 since then.

Turns out there're many incorrect implementations of Happy Eyeballs that cancel the ipv4 connection attempts after the timeout, and then switch to trying the AAAA records and subsequently throwing a "Cannot reach host" error. For context, in Happy Eyeballs you're supposed to continue trying both network families in parallel.

This only impacts our customers who live far away from the region they're accessing, however, and there's usually a workaround - in Node you can force the network family to be v4 for instance

conradludgate commented on AWS in 2025: Stuff you think you know that's now wrong lastweekinaws.com/blog/aw... · Posted by u/keithly

darkwater · 9 days ago

I think they know it. They are complaining it's not enabled by default (and so do I).

conradludgate · 8 days ago

I've been testing our PrivateLink connectivity at work in the past few weeks. This means I've been creating and destroying a bunch of VPCs to test the functionality. The flow in the AWS console when you select the "VPC and more" wizard does have an S3 Gateway enabled by default

conradludgate commented on A fast, growable array with stable pointers in C danielchasehooper.com/pos... · Posted by u/ibobev

listeria · 22 days ago

They mention using this as the backing array for a power-of-two-sized hash table, but I don't think it would be very useful considering that the hash table won't provide stable pointers, given that you would need to rehash every element as the table grows. Even if you just wanted to reuse the memory, rehashing in-place would be a PITA.

conradludgate · 22 days ago

I think they mentioned it's for an arena, where stability is necessary. You might happen to use said arena for a hash table

conradludgate commented on Australia widens teen social media ban to YouTube, scraps exemption reuters.com/legal/litigat... · Posted by u/Brajeshwar

forgotoldacc · a month ago

And then the government sees where those tokens are used and they can easily monitor your every action, and revoke your ability to use certain sites if they don't like what you're saying.

North Korea wishes they came up with an idea this good.

conradludgate · a month ago

Signature schemes can be validated without the signers involvement. No tokens need to go back to the government

conradludgate commented on Playing with more user-friendly methods for multi-factor authentication tesseral.com/blog/i-desig... · Posted by u/noleary

smokel · a month ago

One aspect I find puzzling is why most two-factor authentication (2FA) applications restrict authentication to only a single valid code at any given time. This constraint inevitably creates a window during which it is inconvenient or impractical to copy the code to another device. Allowing the previous code to remain briefly valid would eliminate this unnecessary delay, enhancing usability without significantly compromising security.

conradludgate · a month ago

Have you actually tried writing a code close to the expiry window? I've definitely submitted codes a few seconds after the expiry and had them still be accepted

conradludgate commented on Man wearing metallic necklace dies after being sucked into MRI machine bbc.com/news/articles/cx2... · Posted by u/brudgers

moralestapia · a month ago

Hehe, in my case I used to have a metal filling that was removed, but I was still worried about a missing piece of it or something.

Apparently it's not an issue, even if you do have them.

conradludgate · a month ago

My first MRI I confirmed I have no metal on my body to the technician, but by the time I was inside I suddenly remembered I have metal fillings. I was so stressed by the time the machine turned on, but yeah no problems at all

conradludgate commented on The borrowchecker is what I like the least about Rust viralinstruction.com/post... · Posted by u/jakobnissen

palata · a month ago

I choose a language that is as ergonomic as possible, but as performant as necessary. If e.g. Kotlin is fine, there is no way I will choose Rust.

Many projects are written in Rust that would absolutely be fine in Go, Swift or a JVM language. And I don't understand: it is nicer to write in those other languages, why choose Rust?

On the other hand, Rust is a lot nicer than C/C++, so I see it as a valid alternative there: I'm a lot happier having to make the borrow-checker happy than tracking tricky memory errors in C.

conradludgate · a month ago

For a sufficiently large program, i am faster at writing a correct rust implementation than I am with Go. I find myself a lot more able to reason about the program thanks to the work the compiler makes me do upfront.

conradludgate commented on The borrowchecker is what I like the least about Rust viralinstruction.com/post... · Posted by u/jakobnissen

loeg · a month ago

Non-UB data structure corruption and other incorrect behavior isn't like, super obviously better than UB corruption and other incorrect behavior.

conradludgate · a month ago

The obvious upside is that it's so much easier to debug when there's no UB. Debugging UB is never enjoyable.

conradludgate commented on The borrowchecker is what I like the least about Rust viralinstruction.com/post... · Posted by u/jakobnissen

tptacek · a month ago

Whoah, hold on, the author isn't comparing writing graph structures in Rust to writing it in memory-unsafe languages --- they're comparing it to writing it in other memory-safe languages. You can't force a false dichotomy between Rust and C to rebut them.

conradludgate · a month ago

I think it's reasonable enough. The author already argued that there are reasons for non GC languages to exist, even if the performance doesn't matter to them.

One interpretation of the article is just the author doesn't personally like the borrow checker, but another interpretation is the author saying the borrow checker is just a bad abstraction.

So under the assumption that we don't have a GC available, what else can we compare the borrow checker against?

u/conradludgate

KarmaCake day1231August 1, 2019

About

I write code sometimes. https://conradludgate.com

View Original