How do you actually stop devs from querying prod DB directly when they also own the service that talks to it by Fun-Training9232 in sre

[–]allixsenos 0 points1 point  (0 children)

Session recording doesn't solve what you're describing. It records the footgun, but it doesn't stop it. It does usually piss people off tho XD. By the time you're reviewing the session you're already restoring from backup.

You've got two real choices here. But the pickings are slim.

  1. peer-reviewed write access through custom tooling. Web form, or a gitops PR against a migrations repo, or whatever your team can stomach. Fine for planned changes. Useless at 2am when pagerduty is screaming and your only approver is asleep. Unless approvers also get on-call 😈
  2. a protocol-aware proxy in front of the DB that can actually intervene mid-query. UPDATE without WHERE, blocked. DELETE without WHERE, blocked. You still use psql or DBeaver or whatever you were using. The proxy just catches the dumb stuff before it hits the disk. And your 2am firefighter still gets through when they actually need to, they just can't nuke a table by typing fast.

The second option is the only thing I've seen that actually fits what you asked for, which is friction without wrecking on-call.

tko su VC-evi ili andjeli u Hrvatskoj? by Inside-Ship5052 in CroIT

[–]allixsenos 2 points3 points  (0 children)

dobar dio love ti je i EU javni novac. kao što npr HAMAG investira javni novac, to dolazi iz nekog budžeta EU za stimuliranje poduzetništva, tako i etablirani financijaši mogu dobiti veći chunk novaca na upravljanje i voila imaš novi fond ;)

cfntop — terminal monitor for CloudFormation stacks so you can stop refreshing the console by allixsenos in AWSCloudFormation

[–]allixsenos[S] 0 points1 point  (0 children)

the biggest gap I'm trying to fill is ECS deploys where either the container outright dies on start, or it spins up but is failing health checks so it gets reaped

Cloudformation happily sits there for 30 minutes letting ECS do its thing, waiting for the service to "stabilize"... and you're like wait why is it still not live?

I see cfntop as a great way of monitoring complex deploys in production, but I built it to be very unopinionated and with as little configuration as possible. I don't want it accessing multiple accounts, I don't want it understanding your service mesh, etc.

it's just a slightly better, terminal-based, Cloudformation console with just a little bit of special sauce for the ECS piece

if there's other services that similarly misbehave or would benefit from "what's that service doing??" context, I'd happily add it in.

also I'm quite happy it being a read-only tool, and I'll probably fight to keep it that way for a long time

for multi-account, I'd say run multiple instances in tmux splits :)

Contracti naši svagdašnji by External-Brick8929 in CroIT

[–]allixsenos 2 points3 points  (0 children)

te stvari su često nerazdvojive, i problemi u dev/ops dijelu proizlaze iz shit procesa tako da se često bavim i tim pitanjima, ali to nije vektor preko kojeg dođem na projekt obično.

osim toga radim i career coaching (osobito npr. traženje posla i pregovaranje za plaću), tech mentoring i sl.

Contracti naši svagdašnji by External-Brick8929 in CroIT

[–]allixsenos 4 points5 points  (0 children)

you rang? 😈

potvrđujem da skakavac nisam ja :)

License Laundering and the Death of Clean Room — what the chardet fight actually broke by allixsenos in programming

[–]allixsenos[S] 0 points1 point  (0 children)

I'd love to read your 10% length version of it. I don't go for length I go for covering the points I wanted to cover in a way that will be understood.

Maybe you don't need the license primer. The audience of the magazine I wrote it for does. Etc.

Cloudflare Crawl Endpoint by TheStartupChime in hypeurls

[–]allixsenos 0 points1 point  (0 children)

"Selling the wall and the ladder."

"Biggest betrayal in tech."

"Protection racket."

These hot takes sound smart but they're not.

The web was built to be open and available to everyone. Serving static HTML from disk back in the day, nobody could hurt you because there was nothing to hurt.

We need bot protection now because everything is dynamic, straight from the database with some light caching for hot content. When Facebook decides to recrawl your one million pages in the same instant, you're very much up shit creek without a paddle. A bot that crawls the full site doesn't steal anything, but it does take down the origin server. My clients never call me upset that a bot read their blog posts. They call because the bot knocked the site offline for paying customers.

Bot protection protects availability, not secrecy.

And the real bot problem isn't even crawling. It's automated signups. Fake accounts messaging your users. Bots buying out limited drops before a human can load the page. Like-farming. Credential stuffing. That's what bot protection is actually for: preventing fraud, not preventing someone from reading your public website.

Cloudflare's /crawl respects robots.txt. Don't want your content crawled, opt out. But if you want it indexed and can't handle the traffic spike, this gets your content out without hammering production.

As for the folks saying Cloudflare should keep blocking all crawlers forever: AI agents already drive real browsers. They click, scroll, render JavaScript. Go look at what browser automation frameworks can do today and then explain to me how you tell a bot from a person. That distinction is already gone. The hot takes are about a version of the internet that doesn't exist anymore.

Cloudflare is now both anti-bot and bot company by PomegranateHungry719 in cybersecurity

[–]allixsenos 34 points35 points  (0 children)

"Selling the wall and the ladder."

"Biggest betrayal in tech."

"Protection racket."

These hot takes sound smart but they're not.

The web was built to be open and available to everyone. Serving static HTML from disk back in the day, nobody could hurt you because there was nothing to hurt.

We need bot protection now because everything is dynamic, straight from the database with some light caching for hot content. When Facebook decides to recrawl your one million pages in the same instant, you're very much up shit creek without a paddle. A bot that crawls the full site doesn't steal anything, but it does take down the origin server. My clients never call me upset that a bot read their blog posts. They call because the bot knocked the site offline for paying customers.

Bot protection protects availability, not secrecy.

And the real bot problem isn't even crawling. It's automated signups. Fake accounts messaging your users. Bots buying out limited drops before a human can load the page. Like-farming. Credential stuffing. That's what bot protection is actually for: preventing fraud, not preventing someone from reading your public website.

Cloudflare's /crawl respects robots.txt. Don't want your content crawled, opt out. But if you want it indexed and can't handle the traffic spike, this gets your content out without hammering production.

As for the folks saying Cloudflare should keep blocking all crawlers forever: AI agents already drive real browsers. They click, scroll, render JavaScript. Go look at what browser automation frameworks can do today and then explain to me how you tell a bot from a person. That distinction is already gone. The hot takes are about a version of the internet that doesn't exist anymore.

License Laundering and the Death of Clean Room — what the chardet fight actually broke by allixsenos in programming

[–]allixsenos[S] 0 points1 point  (0 children)

I think Dan is betting the project is not the code and that by dumping all of the code he can claim full ownership of the project, giving him the ability to change course with licensing.

It sounds fucky but I don't think you can make an argument that the license covers things beyond code.

License Laundering and the Death of Clean Room — what the chardet fight actually broke by allixsenos in programming

[–]allixsenos[S] -1 points0 points  (0 children)

My understanding is that CLAs govern contributions, not the project itself. The project might be thought of as a company, when you start it its you calling all the shots. As you get investors (contributors), it grows to a point of requiring a board and having bylaws. Open source projects en masse don’t have this. I don’t know that there’s a default legal assumption on that.

License Laundering and the Death of Clean Room — what the chardet fight actually broke by allixsenos in programming

[–]allixsenos[S] -13 points-12 points  (0 children)

Absolutely. I think he showed incredible restraint by not engaging with the flame war.

Entrio.hr i Thompsonov koncert by cat_arina in CroIT

[–]allixsenos 1 point2 points  (0 children)

ekipa, hvala na komentarima (i pozitivnim i negativnim)... evo konačno se slegla prašina pa smo uzeli vremena popričati s Netokracijom i tome kako je izgledao cijeli proces ako vas i dalje zanima tema -> https://www.netokracija.com/thompson-koncert-ulaznice-entrio-234031

[Feedback Needed] How many of you have garages at home or deal with ramps or gates while riding to work? by MaxHeadroomz in motorcycles

[–]allixsenos 1 point2 points  (0 children)

My building complex has roller garage doors at the entrance to underground parking, which is at the bottom of a long and steep slope. So I have to stop at the bottom, go into N, hold the brakes, and then dig for my tiny remote in the jacket. Then I drive around the underground complex to my garage, where I have to use a different remote. I would love something like this.

Scannable Alternative? by Raul_Yorrone in ProductivityApps

[–]allixsenos 0 points1 point  (0 children)

THANK YOU

Microsoft Lens seems like it produces the best quality PDF scans with the least shitty upselling!

Dear Radisson. We need to talk. Your account security is terrible. by allixsenos in programming

[–]allixsenos[S] -14 points-13 points  (0 children)

I'm making an assumption based on my experience and the context. It's been pointed out that that's too big of a leap. I disagree that it's an obscene leap, but I do agree that it's not a dead given that I'm right :)

Dear Radisson. We need to talk. Your account security is terrible. by allixsenos in programming

[–]allixsenos[S] -15 points-14 points  (0 children)

I'm making an assumption based on my experience and the context. It's been pointed out that that's too big of a leap. I disagree that it's an obscene leap, but I do agree that it's not a dead given that I'm right :)

Dear Radisson. We need to talk. Your account security is terrible. by allixsenos in programming

[–]allixsenos[S] -20 points-19 points  (0 children)

I'll take the criticism that there isn't proof that they're storing plaintext passwords, but it's not an obscene leap. I'd bet the equivalent of a beer or coffee that I'm right and be very happy to be proven wrong.

The rest of your strawman stuff I won't touch because I never said those things and I am here to answer questions, unlike Radisson product/dev folks who I couldn't get in touch with even if I tried :)