Hacker News new | past | comments | ask | show | jobs | submit | circusfly's comments login

It burns purple too.


kubectl rollout undo deployment/foo then replicate. The article predates kube though.

If it can't be replicated, loop back to the reporter and seek any clarifying details. If that fails, then communicate to management the extremely high risk of attempting a fix.


If the bug resulted from a rollout, you might be able to undo it. Or it might be a data problem, or it might be the result of factors out of your control.


If the code in PROD was fine before the rollout, and there is a bug in the newly deployed code; then I was saying above to undo that deployment going back to the previous version then replicate the bug, preferably locally.

It seems like there a misunderstanding about what I wrote or there is a misunderstanding about how kube works and the misunderstanding isn't mine.


> If the code in PROD was fine before the rollout, and there is a bug in the newly deployed code

Yes, if. My point is that that's a distinct subset of the possibilities, and you might not know whether it's true. Maybe you roll out a change at 10:00 and at 10:20 you start getting reports that certain key functionality isn't working. So you run your rollback... and now instead of 20% of users complaining, it's 100%, because that last update included a database migration. Okay, maybe you're very good about your data model so that doesn't happen, but you roll back... and nothing changes. It turns out that the problem was caused by a 3rd-party API you consume falling over. With the right guardrails, rolling back can often be an early option to improve the situation, but it's not a 100% cure-all.


I'm happy to get into a legacy Java stack and make it nice!


AI thanks you for your efforts.


AI needs the help honestly. Because it's based on training (from the past, and only what's published that it can get its greedy 6-fingered hands on), it's always going to be behind HI (human intelligence !). OP might have taught it how to make a form builder, but there are a lot other concepts at play here - a lot more than a language engine could spit out about making a form builder - which may or may not even be that accurate or relevant to the context. We'd need other engines, at least. We're in very early stages of AI, early enough that people should be excited about the [human] jobs it necessitates in order to get even close to a threatening point - which, who knows if it will even be a threat by the time that finally happens, if ever.


> Apparently they encrypted customer passwords instead of one-way hashing [1].

Pretty incredible, I use one way hashing for my own sites and I don't even have customers, just a couple of accounts I use when I want to demo something.


I saw a job posting for Aha! which bills itself as #1 product development software. It seems to be a mashup of a Gantt chart, web forums, virtual sticky notes, document database and a Kanban looking board, and they mention "AI" near the bottom.

I'm not against it but the whole thing does look quite anti-Agile to me, which might not be a bad thing.


“Plans are useless, planning is everything.”

Agile means you can drop what you’re working on at the drop of a hat when you discover that something else is higher priority. It doesn’t mean you shouldn’t plan.

Aha and their ilk are basically fancy todo list apps. With any todo list, if you put too much stuff in there, you’re lying to yourself. That doesn’t mean you shouldn’t have a todo list.

Edit: people absolutely do put too much stuff in there though.


I Googled "online gantt tool" and there are whole companies that do nothing but Gantt charts. Pretty wild.


At the speed of the ISS, a very long time, pack tuna sandwiches.


Could the backdoor have targeted Wireguard instead of ssh?


Down voted for asking a valid question? Or is every reader of every HN post expected to be an in depth expert in every article posted every minute of every day of the year? What kind of asshole who has earned the right to down vote comments on HN would down vote a legitimate question?


My first instinct would be no, as wireguard runs in kernel space(if you're using kernel wireguard, not wireguard-go/some other userspace implementation),and couldn't link in liblzma, a userspace component.


Ssh is shell, whereas wireguard is a vpn.

You will still be vulnerable as you can connect to an ssh server through your wireguard tunnel.


I don't think that's what OP is asking. I think OP is asking if wireguard functions could be hooked in the same way as sshd functions are in this exploit.


Well, yes, I can, but unlike ssh which is open to the world, my VPN is only open to me and the family. It seems like that greatly reduces the potential attack surface.


Originally I saw this at the following link but the title was editorialized from The Register's article:

https://www.reddit.com/r/cybersecurity/comments/1bqq79u/jetb...


Waiting for the new YouTube videos on this. "Woah! Linux has a back door dudes!". My distribution, Ubuntu (now Kubuntu) 2022 isn't affected.


Still better than TwoMinuteToiletPapers and other AI-bamboozled channels hyping over proprietary OpenAI crap (text/photo/video), what a time to be alive!


not sure why you're being downvoted. this is exactly what is going to happen.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: