Top all-time · #11314
Philipp C. Heckel
Personal blog · blog.heckel.iosystemsprogrammingsecurity
Philipp C. Heckel's personal blog at blog.heckel.io covers systems, programming and security. Since 2019, 7 different Hacker News readers have linked it 14 times, most often “Using Let’s Encrypt for internal servers”. The last post was in 2021, but the archive is still widely read.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
HN readers link this blog's posts on ZFS encryption in OpenZFS. One commenter cites a post to warn that enabling deduplication can leak information.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Using Let’s Encrypt for internal servers4 people · 4 mentions · first linked 2021-03-23
What Hacker News says?
Ha! I did not expect a reference to `innodb_flush_log_at_trx_commit` here. I wrote a blog post a few years ago about MySQL lossless semi-sync replication [1] and I've had quite enough of innodb_flush_log_at_trx_commit for a lifetime :-) Depending on the database you're using, and on your configuration, they may NOT recover, or require manual intervention to recover. There is a reason that MSSQL has a VSS writer in W…
Comment linking /2021/10/19/lossless-mysql-semi-sync-replication-and-automated-failover/
on “Make Your Own Backup System – Part 1: Strategy Before Scripts”Submitted Using Let’s Encrypt for internal servers as a story · 4 points
HN discussionThat is correct. But it is possible to design a system with short lived auth tokens/keys and frequent key rotation. I designed such a system at $oldjob for remote access (see [1]). Obviously there is always a risk, and there are always syseng/ops people with access. That is correct. [1] https://blog.heckel.io/2019/11/19/providing-remote-access-to...
Comment linking /2019/11/19/providing-remote-access-to-devices-via-ssh-tunnels/
on “How to get root access to your Sleep Number bed”Submitted Using Let's Encrypt for Internal Servers (2018) as a story · 3 points
HN discussion> Python 2.7.18 I am not defending them for not keeping their stuff up-to-date, but it is very common practice for embedded systems to be hopelessly outdated. I've done what OP describes with IPMI/BMC systems for $mainboardmanufacturer1 and $mainboardmanufacturer2 (both really big name brands), and their BMC systems were equally outdated. It was almost comical, but really sad at the same time. Moral of the story is…
Comment linking /2019/09/18/image-based-upgrades-upgrading-software-and-os-of-80k-servers-every-two-weeks/
on “How to get root access to your Sleep Number bed”Submitted Using Let’s Encrypt for internal servers as a story · 3 points
HN discussionMy company uses Let's Encrypt extensively for many thousands of customers edge devices which live in their own LAN. As long as the hostnames are random or at least not too telling there's pretty much nothing that you're leaking. Except for the internal IP address (10.x, 192.x,) and how many servers you have. If you can live with that then it's perfectly fine. I wrote about it a few years ago: https://blog.heckel.io/…
Comment linking /2018/08/05/issuing-lets-encrypt-certificates-for-65000-internal-servers/
on “Should you use Let's Encrypt for internal hostnames?”Submitted Image based upgrades: Upgrading software and OS of 80k servers every two weeks as a story · 2 points
HN discussionI read the beginning of the post and it looks quite interesting. I'll read the rest tomorrow when my mind is sharper. I checked my blog and I also wrote a post about some crypto related things shortly after I purchased the book. It's a post about a bug in the JDK that I stumbled across, which I am certain I would not have understood without Bruce's book: https://blog.heckel.io/2014/03/01/cipherinputstream-for-aead..…
Comment linking /2014/03/01/cipherinputstream-for-aead-modes-is-broken-in-jdk7-gcm/
on “Learn How to Break AES”Submitted Use mitmproxy to read and modify HTTPS traffic as a story · 1 points
HN discussionTake care that if dedup is enabled, information is leaked. More information at: https://blog.heckel.io/2017/01/08/zfs-encryption-openzfs-zfs...
Comment linking /2017/01/08/zfs-encryption-openzfs-zfs-on-linux/
on “Ask HN: ZFS native encryption vs LUKS”> we have a very small cluster comprised of a main PostgreSQL instance and four replicas As you said, it depends on what you want: - If you are okay with losing data in the event of a failover, then a simple setup is fine. - If you want lossless failovers (i.e. not a single transaction is lost), then that's hard. - If you want entirely automatic failovers, that's also very hard. - ... My experience stems from MySQL,…
Comment linking /2021/10/19/lossless-mysql-semi-sync-replication-and-automated-failover/
on “Why you should probably be using SQLite”There's a write-up here with some details on the why/how and a few experiments (deduping >56T in 125 raw disks): https://blog.heckel.io/2019/07/22/deduplicating-ntfs-file-sy...
Comment linking /2019/07/22/deduplicating-ntfs-file-systems-fsdup/
on “Show HN: Deduplicating NTFS file systems (fsdup)”If you mirror and snapshot the package repo you can get reproducible-ish builds. We have done this at very large scale at $job, see my post here: https://blog.heckel.io/2019/09/18/image-based-upgrades-upgra...
Comment linking /2019/09/18/image-based-upgrades-upgrading-software-and-os-of-80k-servers-every-two-weeks/
on “Debian vs. Yocto for Embedded Systems”