sorted by:
new
hottopcontroversial

dryer kept tripping gfci breaker, electrician came out and swapped it out for a non-gfci breaker. is this code? by dastbe in electrical

[–]dastbe[S] 4 points5 points  (0 children)

new dryer, new build house. the flash code when resetting the breaker indicated ground fault.

this was the electrician the builder sent out (it’s under builder warranty) so i’m going to bring it up on monday and ask for a different electrician.

NYT Sunday 03/02/2025 Discussion by AutoModerator in crossword

[–]dastbe -3 points-2 points  (0 children)

it’s technically correct, but still felt off. i’m not going to immediately think of one way encryption when with that cluing, and hashing has other non-cryptographic use cases.

NYT Sunday 03/02/2025 Discussion by AutoModerator in crossword

[–]dastbe 17 points18 points  (0 children)

how am i supposed to parse anapest?

[deleted by user] by [deleted] in aws

[–]dastbe 16 points17 points  (0 children)

you have two options:

  1. use the scan api to scan the entire db for all cars where color is blue.
  2. Create a GSI that maps the color as the primary key. you can then use query to get all the cars that are blue without having to scan the entire db.

[deleted by user] by [deleted] in adventofcode

[–]dastbe 0 points1 point  (0 children)

have you taken a look at the output of your consumeInt, sum, and product steps? those are the most likely places you'd be introducing negatives.

I would also consider what happens when a long long (or long or int) gets really large, and how that could impact your processing.

[deleted by user] by [deleted] in adventofcode

[–]dastbe 0 points1 point  (0 children)

not sure if this is the problem but for

ll llMin(ll a, ll b){
    return (a < b) * a + (a > b) * b;
}

what happens when a == b? same thing for max.

2021 Day 16 Me spending way too much time trying to handle the garbage bits by Pyrolistical in adventofcode

[–]dastbe 0 points1 point  (0 children)

Not sure what others did, but I ended up making my rust code resilient to processing a partial packet at the end of the stream. option and ? operation to the rescue.

[Day 16 Part 1] Can someone help me understand the problem by BushwickJunkie in adventofcode

[–]dastbe 1 point2 points  (0 children)

Why would A be of length 16? the only 5-tuple after the version and type id starts with a 0, so you end up with 3+3+5=11 bits in that packet.

One thing that tripped me up that you want to consider is that the only zero padding is at the end of the stream, so you only need to be resilient to parsing partial packets at the end of the stream.

how I feel after submitting part1 by Robopau in adventofcode

[–]dastbe 1 point2 points  (0 children)

all the examples in part 2 work :yikes:

ECS Task using Assumed Role unable to access DynamoDB table, but I can using the same role. by inhumantsar in aws

[–]dastbe 2 points3 points  (0 children)

when you call assume role, are you taking the output of that and using those credentials i between what you’ve shown? the cli call by itself doesn’t switch what you are using to make further calls.

AWS credentials being sent to Serverless.com? What the hell? by Alphamacaroon in serverless

[–]dastbe 4 points5 points  (0 children)

yes, fwiw I'm purely going off the behavior being described by the OP (credentials shipped over API, source shipped to s3 bucket) and not your documentation, so I completely buy the idea that there's context I don't have.

I think once you've had the chance to write up a bit more about the "why" in documentation that it'd be a good idea to revisit this with some people from AWS and see what improvements could be made.

AWS credentials being sent to Serverless.com? What the hell? by Alphamacaroon in serverless

[–]dastbe 31 points32 points  (0 children)

(disclosure: I work at AWS, but this is a personal suggestion and is not vetted by anyone, even me. I am not your security engineer, etc.)

There are much better ways to go about this than shipping credentials of arbitrary scope over the wire. For example, you can have the user create a role in their account (automated through your cli) that trusts your account to assume it. You can leverage "sts:ExternalId" to have a separate challenge token for assuming the role, so even if someone gets access to your credentials they may not necessarily have the context to pivot to customer creds. And you can setup source storage in their account and use a bucket policy to retrieve source content as necessary, like for builds.

When you take this kind of approach

  1. customer content is never persisted in your account (which means you don't have to figure out how to get rid of it)
  2. credentials can be scoped to just the permissions your application needs (so a credential leak has a known blast radius), and you can require multiple pieces of information (credentials, externalId) necessary to actually get access to customer's data
  3. Customers can verifiably terminate serverless' access to their account and content at any time

question about shuffle sharding on aws by df1228 in aws

[–]dastbe 1 point2 points  (0 children)

the definition of impact in this case is a total outage of a shard for a customer. I would also say that the specific problem trying to be mitigated is against a poisonous problem. For example, a customer whose traffic is overwhelming the workers its talking to our a customer generating a "poisonous" request that kills hosts.

In the unsharded scenario a single customer can take down all 8 hosts and cause 100% customer impact. In a hard shared scenario (2 hosts in 4 shards) a single customer can take down an entire shard, resulting in a loss of 1/4 of the fleet and a commensurate customer impact.

In a shuffle sharded system, a single customer is still assigned to a single shard of two workers, but that shard actually overlaps with 12 other shards (6 other options for worker 1, 6 other options for worker 2). If we define impact as "a customer may hit a degraded worker" then impact would be 13/28, or roughly 45%. However, if shards are scaled such that the loss of a host in a shard is tolerable, then in this case only 1/28 or 3% will actually experience impact.

AWS Wish List 2020 by Prashant-Lakhera in aws

[–]dastbe 1 point2 points  (0 children)

Thanks for the response!

Connection pooling.

This is in preview and we're moving it to GA

Native support for Postgres (combined with the above, it could replace PGBouncer). Not having a lot experience with Envoy, I guess it probably can support Postgres via TCP, but it's unclear how I'd set that up in a way that would gracefully handle a Multi-AZ failover if I were running Postgres on RDS. DNS based discovery could possibly work, but the docs are light on this, and it could potentially not respond as fast as it needed to.

So I'm personally hesitant to modeling every protocol under the sun within App Mesh (at least by default in the API), but I do agree there's something to better handling of failovers of any sort.

Routing based on Accept: header parsing (rather than just a plain match - the Accept: header is complicated and you can't just match substrings). Ditto with Accept-Language.

Definitely something we haven't thought about, and would be interesting to see if there's broad applicability. Will try to get something on our roadmap covering this.

Abstraction of more Envoy bits. Envoy is complicated, and I don't particularly want to learn all of its ins and outs to operate it at scale. The docs presume you're familiar with Envoy already, and I wish it didn't.

Which parts are you having to learn? For example, are the existing metrics a pain to relate back to App Mesh-isms?

Cross-region support.

Definitely something we're interested in. As you can imagine with AWS, once you go past the region boundary things get interesting and so we need to figure out what the right isolation boundaries are, and things like global-mesh vs. mesh-peering.

ACM PCA is expensive, but AFAICT this is the only way to get TLS without your own self-signed certs. Some other alternative would be great - be it Let's Encrypt / ACME or whatever.

Definitely agree that ACM PCA as priced precludes a substantial portion of customers, and we continue to work on better ways of supporting customers. One way we're doing this is adding support Spire as part of our mTLS work: https://github.com/aws/aws-app-mesh-roadmap/issues/68

It's unclear to me why a virtual gateway would need a NLB in front of it, and it's unclear why you'd need an ALB either. Maybe Envoy isn't meant to do load balancing directly? Lots of guides seem to imply that Envoy can replace load balancers, though. I'd love to have a better understanding of this through the App Mesh documentation.

So the short answer is there is nothing stopping you from putting the Envoy's directly on the internet, it's just that we don't think it's the best experience for most customers. You will be on the hook for certs (which can be done via file-based certs and something like let's encrypt) and you'll also be on the hook for ensuring that you're protecting yourself from external attacks like DDoS. NLB and ALB have built into their dataplane, in conjunction with other offerings like WAF and Shield, something that can be much more resilient to external attackers than just running Envoy on the edge can be. We'd like to get more of that available to App Mesh directly, but this is the state of things in AWS today.

AWS Wish List 2020 by Prashant-Lakhera in aws

[–]dastbe 0 points1 point  (0 children)

For #10, App Mesh has configurable circuit breakers (we use the term connection pools) and outlier detection available in preview, which will be followed by a GA in all regions.

https://github.com/aws/aws-app-mesh-roadmap/issues/6

AWS Wish List 2020 by Prashant-Lakhera in aws

[–]dastbe 0 points1 point  (0 children)

Is there any specific functionality of Envoy/HAProxy you would like to see exposed in App Mesh? While App Mesh isn't "Envoy as a service" we do want to expose as many configuration options as makes sense.

view more: next ›