Top all-time · #1578
Packagecloud Blog
Company blog · blog.packagecloud.iosystemsprogramming
Packagecloud Blog is the company blog at blog.packagecloud.io, writing about systems and programming. Since 2014, 46 different Hacker News readers have linked it 84 times, most often “Attacks against GPG-signed APT repositories”. It is still writing: the last post was on 2025-03-18, and you can follow it by feed.
Sometimes recommended · 7 of 32 sampled comments recommend it?
Why HN links it
HN readers link packagecloud's blog for deep, low-level Linux writeups on system calls, strace, and the networking stack, plus an analysis of attacks on GPG-signed APT repositories.
Summarised by Claude from a sample of 32 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Page Packagecloud Blog
Most-linked posts?
- Attacks against GPG-signed APT repositories7 people · 9 mentions · first linked 2018-02-21
- Guide to Linux System Calls (2016)4 people · 8 mentions · first linked 2016-12-01
- Monitoring and Tuning the Linux Networking Stack: Receiving Data (2016)4 people · 4 mentions · first linked 2017-02-07
- How setting the TZ environment variable avoids thousands of system calls3 people · 4 mentions · first linked 2017-02-21
- How does strace work?3 people · 3 mentions · first linked 2016-12-01
- How does strace work?3 people · 3 mentions · first linked 2016-02-29
- Micro-optimizations matter: preventing 20M system calls3 people · 3 mentions · first linked 2017-03-06
- The Definitive Guide to Linux System Calls3 people · 3 mentions · first linked 2016-04-05
- Debugging SSL in Java using mitmproxy2 people · 2 mentions · first linked 2016-11-17
- /eng/2016/10/11/monitoring-tuning-linux-networking-stack-receiving-data-illustrated/2 people · 2 mentions · first linked 2018-10-12
What Hacker News says?
There are a variety of attacks against GPG-signed repositories - an article [1] by Joe Damato explains them, and that all can be trivially mitigated by serving the repositories with TLS. [1]: https://blog.packagecloud.io/eng/2018/02/21/attacks-against-...
Comment linking /eng/2018/02/21/attacks-against-secure-apt-repositories/
on “ACME v2 and Wildcard Certificate Support is Live”Submitted How setting the TZ environment variable avoids thousands of system calls as a story · 472 points
HN discussionUnfortunately, even the maintainers of dpkg/apt, who rely on GPG extensively, don't manage to plug all holes: https://blog.packagecloud.io/eng/2018/02/21/attacks-against-... Personally, I'm of the opinion that APIs should be as misuse-resistant as possible, and GPG is notoriously intransigent about actually acting as a well-designed API. Additionally, The Update Framework (TUF, https://theupdateframework.github.io/…
Comment linking /eng/2018/02/21/attacks-against-secure-apt-repositories/
on “GnuPG can now be used to perform notarial acts in the State of Washington”Submitted Two frequently used system calls are ~77% slower on AWS EC2 as a story · 415 points
HN discussionI'm somewhat surprised that no-one has (yet) linked to this post [1] by Joe Damato of Packagecloud, which digs into attacks against GPG signed APT repos, or the paper which initially published them [2]. The post makes clear in the third paragraph: "The easiest way to prevent the attacks covered below is to always serve your APT repository over TLS; no exceptions." [1]: https://blog.packagecloud.io/eng/2018/02/21/att…
Comment linking /eng/2018/02/21/attacks-against-secure-apt-repositories/
on “Why does APT not use HTTPS?”Submitted Guide to Linux System Calls (2016) as a story · 154 points
HN discussionAuthor of the post here: greetings. If you enjoyed this post, you may also enjoy our deep dive explaining exactly how system calls work on Linux[1]. [1]: https://blog.packagecloud.io/eng/2016/04/05/the-definitive-g...
Comment linking /eng/2016/04/05/the-definitive-guide-to-linux-system-calls/
on “How setting the TZ environment variable avoids thousands of system calls”Submitted Monitoring and Tuning the Linux Networking Stack: Receiving Data as a story · 144 points
HN discussionCheck out the post linked from the article: https://blog.packagecloud.io/eng/2016/04/05/the-definitive-g... to learn more about how system calls work on x86 Linux.
Comment linking /eng/2016/04/05/the-definitive-guide-to-linux-system-calls/
on “How setting the TZ environment variable avoids thousands of system calls”Submitted Monitoring and Tuning the Linux Networking Stack: Sending Data as a story · 119 points
HN discussionI really like the packagecloud one: https://blog.packagecloud.io/ With posts like these one: https://blog.packagecloud.io/eng/2016/06/22/monitoring-tunin...
Comment linking /eng/2016/06/22/monitoring-tuning-linux-networking-stack-receiving-data/
on “Ask HN: Which companies have the best blogs written by their engineering team?”Submitted Attacks against GPG-signed APT repositories as a story · 46 points
HN discussionUsually, the packages themselves are not signed with GPG, only the Release file is (containing the hashes of all .deb files). This is actually the default of both Debian and Ubuntu. I never quite understood the reasons behind it... I'd not expect this vuln to happen, though. More info: https://blog.packagecloud.io/eng/2014/10/28/howto-gpg-sign-v...
Comment linking /eng/2014/10/28/howto-gpg-sign-verify-deb-packages-apt-repositories/
on “Remote code execution vulnerability in apt/apt-get”Submitted The Definitive Guide to Linux System Calls as a story · 22 points
HN discussionNot quite. The vDSO provides a general syscall-wrapper mechanism for certain types of system call interfaces. It also provides implementations of gettimeofday clock_gettime and 2 other system calls completely in userland and acts precisely as you've described. Please see this[1] for a detailed explanation. For a shorter explanation, please see the vDSO man page[2]. Thanks for reading my blog post! [1]: https://blog.…
Comment linking /eng/2016/04/05/the-definitive-guide-to-linux-system-calls/
on “Two frequently used system calls are ~77% slower on AWS EC2”Submitted Monitoring and Tuning the Linux Networking Stack: Receiving Data as a story · 14 points
HN discussionI wonder if they tried this: https://blog.packagecloud.io/eng/2017/02/21/set-environment-...
Comment linking /eng/2017/02/21/set-environment-variable-save-thousands-of-system-calls/
on “Two frequently used system calls are ~77% slower on AWS EC2”Submitted Attacks against GPG signed APT repositories as a story · 12 points
HN discussionAuthor here, greetings. Anyone who finds this interesting may also enjoy our writeup describing every Linux system call method in detail [1]. [1]: https://blog.packagecloud.io/eng/2016/04/05/the-definitive-g...
Comment linking /eng/2016/04/05/the-definitive-guide-to-linux-system-calls/
on “Two frequently used system calls are ~77% slower on AWS EC2”Submitted Infrastructure as code might be literally impossible as a story · 9 points
HN discussionExcept none of these comments take into account the fact that actually no one verifies apt package signatures either, and this fairy tale world where all of this is a solved problem in some other domain is not manifest. https://blog.packagecloud.io/eng/2018/02/21/attacks-against-... The reason that package signing never really matters that much is that once you boil the thrat model down to package publish credential…
Comment linking /eng/2018/02/21/attacks-against-secure-apt-repositories/
on “Postmortem for Malicious Packages Published on July 12th, 2018”Submitted Debugging an MRI Ruby GC Segfault Caused by a Buggy RubyGem as a story · 7 points
HN discussionThis is especially relevant if you're running in the cloud. We've recently run into slow performance with gettimeofday on Xen systems, such as EC2 (see: https://blog.packagecloud.io/eng/2017/03/08/system-calls-are... ) This hits particularly hard if you're running instrumented code. Switching the clocksource from xen to tsc seems to help and we're still evaluating the ramifications of doing so (various sources inclu…
Comment linking /eng/2017/03/08/system-calls-are-much-slower-on-ec2/
on “The slow currentTimeMillis()”Submitted Using strace to understand a 10x Java performance improvement as a story · 6 points
HN discussionTo be utterly pedantic, on Intel Linux only "legacy" 32-bit int 0x80 mechanism uses iret to return. 32-bit "fast" syscalls use sysenter/sysexit. 64-bit "fast" syscalls use syscall/sysret. Haven't really looked but I suspect sysexit and sysret are somewhat special cased versions of iret. https://blog.packagecloud.io/eng/2016/04/05/the-definitive-g...
Comment linking /eng/2016/04/05/the-definitive-guide-to-linux-system-calls/
on “Unix Syscalls”Submitted More than you ever wanted to know about Linux system calls as a story · 6 points
HN discussionand https://blog.packagecloud.io/eng/2018/02/21/attacks-against-...
Comment linking /eng/2018/02/21/attacks-against-secure-apt-repositories/
on “Remote Code Execution in Alpine Linux”Submitted Setting the TZ environment variable avoids thousands of system calls as a story · 5 points
HN discussionThis is a thing that generates many useless syscalls despite vDSO: https://blog.packagecloud.io/eng/2017/02/21/set-environment-...
Comment linking /eng/2017/02/21/set-environment-variable-save-thousands-of-system-calls/
on “Meltdown Initial Performance Regressions”Submitted Illustrated Guide to Monitoring and Tuning the Linux Networking Stack as a story · 4 points
HN discussion
