So you're buying expensive hardware as insurance for the case that your cloud provider turns against you and you have to switch to another of the twenty offering the same model https://openrouter.ai/z-ai/glm-5.2 or in the worst case buy the same hardware later? How does that make sense?
You don't need Colossus-level compute or a genius-level IQ to evaluate the question "Will the steam machine cost more than $700 at release", or "Will 2026 be the hottest year on record".
So does that mean you are tracking how many times data is being entered into redis, and rejecting it if the entry rate is too high?
Why would you not track this before, at the point of calculating the data to enter into redis, rather than querying redis to see how much data is entered in a given timeframe?
Again, genuinely curious as to the reason for architectural decisions.
>Also security is not binary, it's layered. Sometimes we can address an attack vector by using multiple levels. And sometimes it's simply worth checking for low hanging fruits if only to make the attack more expensive.
Defense in depth and multiple redundant layers is a legitimate technique.
But it should usually be 2 virtually unbreachable layers, like 99.999% effective, because there may be a memory leak somewhere and it will be exploited once per year or so. Because 1 layer is just shy of 100%, 2 layers is already overkill, we would do 1.1 layers if possible (but of course it's not)
Maybe if it's a multibillion dollar product you'd add a third or more impenetrable layers.
And once you have those two redundant security layers, then you add deterrents and monitors, if you want.
But relying on security measures that will maybe catch 20% of attacks or 40% of attacks as a main mechanism will lead to what some have described as swiss-cheese models. https://en.wikipedia.org/wiki/Swiss_cheese_model
So yes, sometimes you can add a cheap measure that might make things more difficult to an attacker, on top of your main line of defense, then do it. But keyword cheap, if it takes 2 minutes like using a custom port, yeah for sure do that, but if you have to write an article and invent a new theory of hooks, then it's not it.
Antivirus techniques are not used by serious development professionals that I know of, I've seen it used in IT contexts were there's non technical users that might download stuff, but even then it's not really a central technique, just something that security firms sell to non-technical execs. And it's in the context of sys admins trying to control the security environment of hundreds of employees whose actions they cannot control. In the context of developers who have to ensure the security of systems they have code for, you do not need these faith based techniques, you are importing the code, you have access to it, and you have the time resources to inspect it. These antivirus technologies are used either by personal end users that don't have the ability to verify the software or audit its source, or for IT departments that cannot even inspect the contents and packets of the software their employees are using for security reasons.
> A least-cost combination of all the technologies has also been identified (shown in Fig. 3 as Least Cost Mix). Under the IEA/WEO 2023 cost assumptions, the least-cost solution comprises a combination of offshore wind power (66%), solar PV (8%) and CCGT (26%). Onshore wind power cannot compete with offshore wind power, and nuclear power cannot compete with any of the other technologies. This is due to the relatively low offshore and high onshore wind power cost assumptions in WEO 2023. As we shall see later, onshore wind power comes into the least-cost mix when using WEO 2024 or any of the two DEA cost assumptions.
...
> At the case level, we find that in countries such as Denmark with available wind and solar energy resources, nuclear power does not seem to be part of the least-cost solution, neither in today's energy systems nor in future systems of climate neutral societies. This conclusion is valid for the present cost of nuclear power in Europe as well as for IEA/WEO future expectations. The future overnight cost for nuclear power of 4500 EUR/MW in 2050 represents the so-called “nth-of-a-kind” cost for new reactor designs, with assumed substantial cost reductions from the first-of-a-kind projects, while this violates the historical experience of nuclear power technology.
The flaw in the argument is postulating a subscription model for a product that a normal customer needs very sporadically. Even old-school selling of perpetual licenses and support fees would be inappropriate.
Instead, sell expensive one-off consultancy projects to help some company understand one specific code base, with the only long-term relationship of satisfied customers recommending you and calling you again for new projects.
I think if nothing happens from the government, then this would be a very good example of the benefit of keeping your mouse shut especially if you are lying to get some hype like Anthropic did for months.
Pretty sure the secret sauce is in the summarised thinking.
Maybe better though process… But I have a feeling it’s server side tools and a scratch space to prepare the reply.
Sometimes the summarised thoughts include stuff that makes no sense unless it’s got a workspace on the server. Stuff like “I am now writing x to file y”.
That was before SaaS became a thing. Products didn't degrade over time because they couldn't easily reach out to your machine and remotely overwrite bytes on the CD-ROM the product came on.
Yeah, there are clavicle features that clearly don't need any surgery, but when in doubt, always slap on some titanium. Just try to get rid of the plate before the next fracture opportunity, because then you'll get an AC joint separation instead of a fracture and that stuff won't grow back. Ask me how I know, I had surgery to swap a fracture plate for an AC plate (those AC plates really, really suck)
> Or I guess the inverse question: why aren't they allowed that audit?
There's undeniably a lot of unsecured software in the world.
Given that ID verification is hard and these companies are clearly new at it (or don't understand the implications of it, cough Worldcoin's eye-scanning orbs cough), which is worse:
(1) sufficiently good AI* is released to everyone: critical infrastructure and open source projects gets better hacking tools to white-hack their own code at exactly the same time as black hat hackers
(2) sufficiently good AI* is released to critical infrastructure and open source projects first: everyone else, the average paying customer has to wait but so too do the black hats
Because (2) is either the status quo or better depending on if you have access or not; and because (1) seems to me to lead to an acceleration of zero-days, I lean towards (1) being the worse.
* having no experience of pen-testing, I take no position on if this is "it" or not
I can only submit the screenshot of the mail they sent. At the time of writing this I haven’t found anything about this on their blog, and the status page (https://www.ionos-status.de) currently shows all services as green.
Here is the full text:
Customer Advisory: Capacity Constraints in FRA (de/fra) Datacenter
Dear IONOS user,
We are currently experiencing exceptionally high demand for resources in our FRA (de/fra) datacenter. You are receiving this notification because at least some of your resources are provisioned in a cluster in this datacenter that is facing acute capacity constraints as a result of the demand.
Because of these circumstances, attempts to provision additional resources may fail and then return the error code VDC-5-601.
What this means for you and your workloads:
- Existing Deployments: Your current clusters and resources are unaffected and will continue to operate normally without interruption.
- New Deployments & Scaling: Requests to provision new resources, scale out or rebuilding nodes may fail with the VDC-5-601 error.
- Managed Kubernetes Maintenance: Due to the situation, we are pausing Managed Kubernetes maintenance for this cluster
- Database as a Service Clusters Provisioning and Scaling: Depending on how the situation develops over the next few hours, we may need to temporarily limit provisioning and scaling of DBaaS clusters in this cluster. If these precautions become necessary, we will inform you in a separate email.
Estimated Timeline: We anticipate that the resource constraints in this cluster will improve over the next few days. Expanding capacity in the affected cluster is our highest priority. We will notify you once the situation improves.
What you can do:
- Where possible, avoid scaling operations to existing resources (e.g, adding cores/RAM)
- Use alternative datacenters: If your architecture permits, routing new workloads to other datacenters (e.g., de/txl) will bypass these constraints and allow you to continue scaling.
- Adjust resource requests: If your provisioning requests result in a VDC-5-601 error, please try requesting fewer resources. CPU cores and RAM are the primary bottlenecks right now. Also, requesting specific CPU types may make your request less likely to succeed. Thus, reducing your requested cores and RAM or using a different CPU type (or vCPUs) may allow your deployment to succeed.
A Note on Support:
- Please note that our Support Team cannot bypass capacity limits or directly resolve VDC-5-601 errors.
- A live migration of workloads across clusters is not currently possible. Our Support Team will not be able to move your VDCs to a different cluster in the datacenter.
- Due to the highly dynamic nature of resource consumption, our Support Team cannot currently suggest suitable combinations that are guaranteed to lead to successful provisioning.
We appreciate your patience and understanding as we work to expand our capacity and resolve this situation. We will proactively inform you about any changes related to this situation.
If you have any questions, please contact our IONOS Cloud Support via e-mail or telephone at any time.
It's interesting to see additions to HTTP methods as it much feels like the existing ones are set in stone. At least for the time that I have been a developer.
I'm curious to see how fast the adoption/support for HTTP QUERY will be. I've had my fair share of situations where I wished for something like HTTP QUERY.
Cool. I particularly like the O'Reilly book cover that never was. Although I fear you may have misunderstood what wasm is...
Question/critique. Isn't getting the mime type by file extension a bit windowsy? Would it not be easier to read the magic number when you're at the assembly level?
I don't think you're wrong. Virtual functions is a two-pointer dereference operation (vptr, vtable[vptr]), and there we can have a d-cache miss but the main cost of using virtual functions is the increased likeliness of the i-cache miss. Cost of 30-60 cycles as per article assumes an icache-hit, and since virtual call is an indirect call (jump), it also heavily depends on the branch-target predictor and its buffer. I can easily imagine that iterating over a heterogeneous collection of objects would incur much larger cost than ~50 cycles/iteration. Branch target misprediction flushes the whole pipeline (15-20 cycles) and icache miss can easily end up being a fetch from main memory (200-300 cycles)
The article in general is interesting since it gives a rough idea of cost of operations relative one to each other but since CPUs are much more complex beasts it also gives us an incomplete picture, and if you're unaware of it the chance is that you will use it derive incomplete conclusions from it - understanding performance implications of a software running on an actual hardware is much more involved than what one article can fit.
"If Lucifer decided not to take your soul, why not throw yourself at Mammon's feet instead?"
We keep asking why society got to such this stage of decay, and I need to reminding myself that part of it is because most people just keep giving away so much power to sociopaths in exchange of virtual trinkets.
maybe your C suite. ours just joined the hype train. We got an email a few weeks ago saying all new code must be ai generated by 2027 and introducing internal metrics for ai usage by team
This is exactly what I find frustrating. I get comfortable with the latest model X. Then a new sparkly model Y launches.
I am like, I don't need your new fangled Y, that consumes more tokens. My needs are small and i am happy with the older X.
But then X starts to degrade. At first subtly, and then drastically. So then I am forced to upgrade to Y.
What I do not understand is:
> is this a sneaky way for companies to push users up the chain?
> Or is this a genuine fault in model design/resource allocation?
