Post Syndicated from The History Guy: History Deserves to Be Remembered original https://www.youtube.com/watch?v=lJ8gMxADHL8
Comic for 2025.03.24 – Coffee
Post Syndicated from Explosm.net original https://explosm.net/comics/coffee
New Cyanide and Happiness Comic
SawStart
Post Syndicated from xkcd.com original https://xkcd.com/3067/

This is the Solidigm Liquid-Coolable NVMe SSD Design
Post Syndicated from Eric Smith original https://www.servethehome.com/this-is-the-solidigm-liquid-coolable-nvme-ssd-design-nvidia-gtc/
Solidigm showed off liquid coolable NVMe SSDs at NVIDIA GTC 2025. This will be important for future AI servers
The post This is the Solidigm Liquid-Coolable NVMe SSD Design appeared first on ServeTheHome.
За другите три кули при мол Парадайс и защо липсват
Post Syndicated from Боян Юруков original https://yurukov.net/blog/2025/drugite-tri-kuli/
Малко много станаха постовете конкретно за „оная“ карта, но покрай темите в последните дни ми се налага да ѝ обръщам повече внимание.
Когато я започнах средата на миналата година въвеждах сграда по сграда сравнявайки с това, което е построено или поне видимо на пространствените данни и това, което е отбелязано в портала на НАГ. До тук има над 24 хиляди полигона – говорих за това през януари. Описал съм подробно методологията и проблемите свързани с нея. В рамките на това въвеждане се допитвах редовно до различни групи и организации запознати с конкретни казуси и темата като цяло, особено когато имаше проблем с качеството на данните, на които разчитах.
Специално за пространството около Черни връх, което нашумя тези дни, първоначално дори не бях въвел въпросната 215 метрова кула и други три от по 180 метра, за които ще стане дума тук, защото реших, че е грешка в изписването на слой Застрояване. Нямаше да е за пръв път и в такива случаи търся да сравня с налични документи. За това място не открих. Тогава разпитах по описания горе начин и ми обясниха, че е наистина текуща тема, наистина това е ПУП-а и е приет с решение на СОС. Конкретно за 2025-метровата кула писах вчера с линкове към становища и фактология.

Днес, след като обявих нови функции към 3D картата за застрояването, Борис Бонев попита защо не съм отбелязал трите кули от по 180 метра на мола Парадайс. Виждат се на картата горе показваща прословутия слой застрояване и с какво всъщност работя, за да създам визуализацията. Спомням си, че бяхме обсъждали региона средата на миналата година заедно с доста хора и повечето смятаха тогава, че за разлика от нашумялата кула, тези трите по-скоро няма да видят бял свят. Затова не ги бях добавил, както и не бях отбелязал, че молът е разрешено да се строи до 50 метра, което е значително над сегашната височина.
На мястото на мола към този момент намирам над 50 различни документа, които може да разгледате на картата ми с документите. Повечето са разрешително за строеж, но за преустройство на магазини и складове. Някои са от времето на Диков, когато голяма част от тази и редица други каши са бетонирани та да се чудим как да ги разбиваме сега. Не се намира оригиналния ПУП, доклад или решения.

В духа на картата и как много подобни сгради всъщност са отбелязани – като онази огромната на бул. Цар Борис, например – следва наистина и тези кули да са също на картата. Затова ги добавих и вече може да ги намерите там. Отново напомням – няма известно движение по тях, няма решения, разрешения или каквото и да е поне в последните 10 години в посока тези кули. Не се съмнявам, че ще има опити да се спекулира с това – включително произвеждане на фалшиви новини, както и от хора, които знаят много добре всичко, което описвам. Тези се използват напоително не в интерес на града, а за политически цели, атаки срещу кметството и районните администрации, както и отклоняване на енергия и внимание от други теми, които са наистина важни. Добавям ги с ясното съзнание за този риск, защото все пак щом още по времето на Диков са влезли в ПУП, значи че както сега обсъжданите и много други, някой някога може да развее едни хартийки, да си напазарува експерти и анализи, да си плати или заплашва държавни служители и накрая когато събере заветната папка да върви при едни конкретни административни съдии да придвижва нещата.
Впрочем, промяната, която обявих по-рано днес, беше че вече може да натискате върху отбелязаните сгради на 3D картата и тя ще се опита да открие последните известни документи там, ако има въобще такива. Дава и линк към картата с документите, където с филтрите да търсите по-стари. Повечето документи вероятно няма да имат общо със самия строеж, а последвали промени като рекламни елементи, преустройство и прочие. Добра отправна точка е обаче и функцията с най-много запитвания.
The post За другите три кули при мол Парадайс и защо липсват first appeared on Блогът на Юруков.
2025-03-23 the “FOSDEM VideoBox” talk at FOSSASIA Summit 2025
Post Syndicated from Vasil Kolev original https://vasil.ludost.net/blog/?p=3499


This is a talk about the video-box that we used to run video on FOSDEM 2025, and that we’re testing, sorry, using, to do video at FOSSASIA 2025 🙂
(abstract)
Over the past years, the FOSDEM conference (a free and open-source developer event in Europe) has hacked together its own video recording and streaming setup. We stream 30 rooms with a video team that’s less than 30 people. The latest iteration of that was a lot of fun, and we’d like to share with everyone what it looks like, what it can do and how fun and hackable it is. We will explain our setup, and give a rundown of what’s in those weird boxes you might have seen.
The project is fully open source software and hardware, and everything is available in FOSDEM’s GitHub repos.

If you don’t want to listen to me, but want to see for yourself, everything – the hardware designs, assembly instructions, sources, ansible recipes – are in those two repos. Hack away 🙂
(there’s even a FOSSASIA branch for the things we had to change for this event)

The initial idea of this talk was to explain how useful this box is to any kind of event, for streaming, recording, etc, etc.. But there’s one more important point that I want to make, after talking to some people here.
THIS IS NOT HARD.
What you can see in this presentation and what we do is the product of a few slightly insane people. We didn’t know that some stuff was hard, and we didn’t care, we just tried to see what will happen. There were problems, there were wrong directions, but as you see, we have it working, and I do think that it’s possible for anyone here to do it.
This is one of the reasons we give the source for it – that people can learn from it, play with it, use it, etc.. It’s possible for people to create any such project – I have seen this again and again and again. I even have a favourite joke about it, I hope it translates well…
The mathematician Dantzig as a student was late for one lecture, came in the lecture room after everyone had left, and saw two mathematical problems written on the blackboard. He thought that those were homework, wrote them down, and went home. On the next day, he was a bit early, went to the professor and said:
“From the homework yesterday, I managed to solve the first one, but I’m having trouble with the second one”
“What homework?”
“The two problems that were written on the board”
“But… but… those were examples of unsolvable problems!”
So, seriously. When you look at the box, you shouldn’t think “wow, what great thing/product”. You should be thinking “I can make one better/I can make it better”.

And to show what we’ve been through (because people see only the end result) – here is an example of a setup for part of the development. It loks scary, feels like it can catch fire if you touch anything, and is so far from what you see in the box.

And this is a temporary version of the power board. I am not sure if you can see it very well, and I’m not sure you would want to see this horrible contraption. You should not be afraid to make things like this and experiment. Yes, it takes time, yes, it sometimes catches fire, but when that happens you just put out the fire and think of a new way forward. In the end it works!:)
Seriously. Experiment and do stupid things. This is how people learn.
(I’ve heard that there are some really smart people that learn from other people’s mistakes, but at least I need to make my own:) )

To explain where all this comes from, a few short words about FOSDEM – it’s the largest open-source event in Europe. It gathers some thousands of people in a cold, windy and rainy place with good beer to present and discuss all kinds of open-source projects. It’s a bit crazy, with 30 parallel tracks and more than a thousand talks.
And I’m really happy to be a part of it. It’s one of the things that I participate in that no other group does, and that’s mostly because nobody is crazy enough 🙂

So, large event, large venue (multiple buildings), only half a day for the setup. We have next to no manpower and no time 🙂 . We want to have working video, because there are a lot of lazy people around the world that don’t feel like traveling to FOSDEM, and rooms are often so full that people sit outside and watch the streams.
And, FOSDEM is a completely open and free event, we can’t just throw money at the problem and have a setup that would cost a few million dollars.

This is the overall architecture of the video at FOSDEM. We capture the camera and the presenter’s slides, they get sent to a video mixer, which mostly creates a picture-in-picture stream. That stream gets sent to the outside world to see, and gets recorded so it can be reviewed later.
A few things in this setup we didn’t finish for this year, like audio transport over the network (which would’ve saved us one long cable per room), but there’s always next year 🙂
This setup scales really well – we’ve done FOSDEM with between 20 and 30 rooms, and are pretty confident it would scale to a hundred or more. We manage to set the up in half day with 7-8 teams with 3 people each, and to tear it down after the event in three hours.
Not having too many people, we prioritize the ease of setup and operation. We’re also lazy 🙂
And such an event requires a tremendous amount of computing power to mix the video…

… just kidding. 10-year old laptops can deal with that without any issues 🙂 You can also see them here in the racks (Ikea wine racks). These machines run software called “voctomix”, developed in Python by c3voc and which does some magic with gstreamer.

Remember the slide with “this is not hard”?
To show how much code we’ve written to run all that infrastructure above, I ran the tool that counts lines of code, and when I removed one external javascript library, this is what’s left. With 1500 lines of code you can run the video of one of the largest conferences there is.
There’s a bit more code in the firmware for the hardware and few other external things, but the above is enough for almost everything.

For 7-8 years we used this, but it was getting old (and some of the wood a bit moldy). It was a combination of a Banana PI, sata SSD, small switch, one BMD recorder (device that captures HDMI and gives it over USB), and for half of the boxes, a scaler – something that you can plug any laptop in and it’ll be able to change the signal to something that we can use.
The last part is always a problem, because laptops do weird things. Not to mention Macbooks.

As the old boxes were breaking down, we made a stopgap measure – a laptop, and a capture card, in a transportable form-factor. This worked relatively well for 2024, but was larger than we liked, and the laptops we got for cheap had USB issues (which were fixed in a newer version of the laptop, but that did not have Ethernet ports).
You can see it on this picture in action – it’s the laptop with purple background and the box below it.
This worked pretty well, but was a bit unwieldy, and the box itself was almost empty. We couldn’t come up with a way to put the laptop in, so we started looking at options.

Then, Martijn Braam visited us during the 2024 event and metioned “you know, I’ve made a stand-alone open-source audio mixer, it’s a simple board and a chip”. We thought we can use it and get rid of the mixers we carry around, some cables, etc.

Here’s a picture of someone from our senior staff, responsible for the design of the power board and a lot of the low-level hardware and assembly. As you see, he has all the tools needed for the job. He was the other person really interested in designing hardware.

And if we have to say what were the driving words behind the project, it was this. We wanted something that doesn’t cost too much, that we can make in large amounts and that could do all the weird things we wanted.

The thing is, as soon as you start to make your own hardware, you start to get greedy and ask “what else can we do?”.There are so many interesting things you can add, to handle tasks that you were doing with extra hardware or software before.
So the first is trivial, we need to power things inside, so you design your own power board.
Then, we have microphone receivers. They are battery-powered, but can also be powered via USB. So now we have 4 charging ports (and we can turn them off and on from software).
And for crazy ideas, why not design a radio INSIDE the box, that can just receive wireless microphones? Turns out that is pretty much possible, we didn’t have the time for it and there were some snags… But even to me this sounds crazy.
And well, in the end, how hard would it be to design a network switch? Turns out, not that hard. We needed just one revision to make it work, and a few days ago, just becase we can, we added initial support for VLANs in the switch – so that can actually do interesting network topologies.

This is the part in movies where there’s montage with a music background. We worked on different pieces through the summer of 2024, a few months ago…

We started assembling it. This is a simple assembly flow chart 🙂 Might look daunting, but it actually took just two-three weekends and about 10 people to assemble, provision and test 70 boxes.

And because we were running late, this mostly happened in the weekend between Christmas and New Year. Not sure how to translate this to you, but let’s say we were the only people working in the country…

We got the boxes ready somewhere mid-January, and ran FOSDEM 2025 with them 2 weeks later.
And it worked. We still can’t believe it did. We even managed to do a talk there about the box itself 🙂
And yes, much like this very talk, we had the idea of actually having a talk, less than 24h before.

This is how the box looks on the inside. I’ve left a few of them open while running, so you can all see them.
There are two boards that we did not design: a Raxda X4 (an Intel-based single board computer) and a MS2131-based HDMI capture device with a loop out (but we’re working on that one).
The rest is:
An audio mixer with three inputs and two outputs. So you can have three microphones (enough for almost everything), one output to your camera and one to the room sound system. We needed a microcontroller with USB support, so we added an off-the-shelf Teensy on top of it.
An ethernet switch, so you can also connect other boxes and devices to the network (and build your own network). I’m actually afraid to show the topology we have right now in this venue 🙂
A power board powers the other boards, and provides the external charging ports. Plus it controls the fans, has a temperature sensor, controls the pass-through USB port to the radxa and more.
And a handful of breakout boards, to be able to cable things up neatly.

If you take a look in the training rooms, you’ll see an interesting modification of the setup. It uses an USB camera, has a single box, and can do all video and video mixing in that single box. So one box like this, one cheap camera, microphones, and you can record & stream a room pretty quicky.
This is still under development (I made a few fixes in the last few days, and there’ll be more). Its current interface is “SSH into it and run commands”, which is not easy for most people. But, this is also being worked on, so at some point there will be even an user-friendly box 🙂

Of course, we are not even remotely close to what we want. There are so many ideas than those just listed here, and even some of these were thought up while we were writing this presentation, and I can’t wait to show it to the rest of the team.
I really hope they don’t lynch me.

These are two things from our TODO, as an example. As an open-source project, we welcome patches 🙂

We have tried to make sure this is useful not just to us. The boxes, the software around them, the overal ideas can be useful to everyone who does events or video for events, and should be possible to do video streaming and recording in an easy, stable way with a good quality. You won’t get the very nice features (like a multi-camera setup, drones taking photos from above, etc.), but you will have the sound, the presentation, the lecturer visible and recordings which would be usable to everyone that has not being able to attend.
FOSDEM lends this stuff, and we’re happy to explain how to use it. You can also build your own and we can help with the specifics if needed (but everything should be in the repo anyway).
And we can always use more contributors 🙂

Remember this slide? Do not be afraid to hack. Do not think this is something extremely complex and impossible to do to. You just need to start.
Please do 🙂

Assessment of DOGE and Musk’s Actions for Government Efficiency
Post Syndicated from Bozho original https://techblog.bozho.net/assessment-of-doge-and-musks-actions-for-government-efficiency/
The Trump administration began with a commitment to optimizing the efficiency of the government, introducing the so-called DOGE (Department of Government Efficiency) under Elon Musk. On the first day, I wrote that I would follow DOGE’s actions in optimizing the administration with interest. This is a task that we also face in my country, with electronic governance (of which I was the first minister a few years ago) being a tool for achieving it. On the very day of the executive order establishing DOGE, I wrote to colleagues that “the risky part is that every structure will have to provide them with all non-classified documents” and that they would likely be looking for “skeletons in the closet.”
This risk, stemming from the executive order, quickly materialized due to the actions of DOGE employees (or USDS, which is the U.S. government’s structure for IT services and administrative modernization, serving as DOGE’s main tool). The employees, who are 20-25-year-old IT specialists, gained access to the systems and databases of several key government agencies, even connecting external hard drives. This understandably sparked serious dissatisfaction.
I do not dispute the right of specialized units to access data and documents across the entire government structure. Nor do I deny the right to close down agencies or terminate funding — these are political decisions (subject to judicial oversight) that any administration has the authority to make (and anyone has the right to disagree and challenge them in court). Moreover, fraud and inefficiencies in spending certainly exist, and an external review of the data and systems can identify and eliminate them.
However, for the implementation of these political decisions to be legitimate, it must follow established rules. It appears that Musk and his team operate under the assumption that they are above the rules — that they can take over the information systems of key government agencies through “top-down orders.” These actions should be carried out properly, especially considering information security and data protection, which are at risk from such ad-hoc measures.
I will give a few examples from my time as a minister and earlier as an advisor, fully aware that the scale is different, but there are still direct parallels.
The first example is the SEBRA system (the Ministry of Finance’s budget payment system). Musk is essentially doing the same thing — extracting and potentially publishing all state payments. However, we did it properly — together with the Minister of Finance, we submitted a proposal to the Council of Ministers, designating payment data as a priority data set for publishing in compliance with the Access to Public Information Act. This decision mandated the Ministry of Finance to provide the data to the Ministry of e-Government in a specific format so that it could be processed, anonymized, and published. The Ministry of Finance assigned its contractor to extract the data and securely transfer it to the Ministry of e-Government, where the processing and anonymization code was published in an open-source repository. At the same time, a working group revised a regulation so that the system would automatically publish such data. If we had done it Musk’s way, I would have simply sent one of my advisors and told them, “Plug in your laptop and get access to the database.” And that would have been wrong.
In 2016, we opened up data from the Commercial Register and the Public Procurement Register. At the time, I was an advisor, but the data disclosure process involved official correspondence, and I never had direct access to the database — experts from the respective institutions wrote queries to the database, and I received a test database without real data to work on queries for extracting information. We also published the code for the anonymization tool used for the Commercial Register. This was all done based on formal communication and a valid legal basis under the Access to Public Information Act.
As a minister (after all, officially elected by parliament, not an unknown staffer), I requested to review systems, but someone else always had to show them to me while I only directed what should be extracted (even though I could have found it myself much faster). In these cases, the approach was always, “Sit here and show me,” or “Based on [legal grounds], please provide me with the following data,” rather than “Give me access to the database and leave.”
Yes, there is a risk of refusal or sabotage of these efforts, but there are other measures for that—those who sabotage can be reassigned or even dismissed if they do not comply with a lawful order. However, Musk is doing the opposite—his people (who have not been properly vetted) are acting unlawfully and are being stopped by the courts. In some places, internal teams correctly identified these actions as an “insider threat.” In principle, every access to databases should leave a trace, and access for usual personnel must be controlled because data misuse is not only a risk from external actors but also from internal ones.
The issue of access to institutional data is extremely serious and cannot be resolved with a blanket statement in a presidential executive order. It is serious because a modern state largely depends on its registers and databases. Their security and integrity are fundamental to many policies and their success or failure. “Seizing control” of registers and databases is a key instrument of power with significant negative potential.
Beyond this specific case, if DOGE had acted “properly,” it would have taken a few more months, but its actions would have had more legitimacy. However, in line with other actions and statements by the U.S. government, it seems that they are more interested in breaking things and disregarding the rules.
Government efficiency is important, and reducing unnecessary expenses is a valid political priority. But while it can be a legitimate goal, it can also serve as a cover for less honorable intentions. And although I come from the startup world, I do not agree with the approach that a government and administration can be run like a startup. In startups, the goal is to move fast, even at the risk of breaking things. In the public sector, it is more important not to break things, because lives and livelihoods depend on it, which is why processes take longer. And when you act by breaking the rules under the justification of political expediency, you do not build trust — you destroy it.
The post Assessment of DOGE and Musk’s Actions for Government Efficiency appeared first on Bozho's tech blog.
Comic for 2025.03.23 – Future Granny 2025
Post Syndicated from Explosm.net original https://explosm.net/comics/future-granny-2025
New Cyanide and Happiness Comic
Spirit’s Journey Ends
Post Syndicated from The History Guy: History Deserves to Be Remembered original https://www.youtube.com/watch?v=0VRRNb--lak
Herp
Post Syndicated from Oglaf! -- Comics. Often dirty. original https://www.oglaf.com/herp/
Three Saturday stable kernels
Post Syndicated from jzb original https://lwn.net/Articles/1015183/
Greg Kroah-Hartman has announced the release of the 6.13.8, 6.12.20, and 6.6.84 stable kernels. Each contains a
number of important fixes throughout the kernel tree; users of those
series should upgrade.
Comic for 2025.03.22 – Greatest Weakness
Post Syndicated from Explosm.net original https://explosm.net/comics/greatest-weakness
New Cyanide and Happiness Comic
OMOTE – mighty open source universal remote – HW
Post Syndicated from BeardedTinker original https://www.youtube.com/watch?v=lom9cs3mI4A
Kioxia LC9 122.88TB PCIe Gen5 NVMe SSD at NVIDIA GTC 2025
Post Syndicated from Cliff Robinson original https://www.servethehome.com/kioxia-lc9-122-88tb-pcie-gen5-nvme-ssd-at-nvidia-gtc-2025/
At NVIDIA GTC 2025, we saw the Kioxia LC9, a new 122.88TB capacity PCIe Gen5 NVMe SSD with cool features like supporting HA arrays
The post Kioxia LC9 122.88TB PCIe Gen5 NVMe SSD at NVIDIA GTC 2025 appeared first on ServeTheHome.
Card Radios – Vintage Casio RD-10 et al
Post Syndicated from Techmoan original https://www.youtube.com/watch?v=AqMGMZjAKZw
Седмицата (17–22 март)
Post Syndicated from Светла Енчева original https://www.toest.bg/sedmitsata-17-22-mart/

Освен че пролетта дойде, толкова неща се случиха през седмицата, скъпи читатели на „Тоест“, че не знам откъде да започна. Чудя се обаче следното: ако българин, работещ в международна хуманитарна организация, загине във военен конфликт, това би следвало да е водеща новина, нали? Очевидно не, ако въпросният българин е убит в Газа от израелски снаряд. Информацията за смъртта на Марин Маринов се загуби в новинарския поток, в който дори не се споменава името му. Премиерът нарече убийството „неприятен инцидент“. Не, господин Желязков, неприятен инцидент е човек да го ужили оса. Когато танк стреля по сграда, в която пребивава персонал на ООН, това прилича повече на военно престъпление. И не, критикуването на политиката на една държава не означава омраза към народа ѝ.
Водещата новина в централните емисии беше трагедията в северномакедонския град Кочани, където по време на концерт в дискотека с незаконно разрешително избухна пожар и загинаха 59 души, основно деца и младежи, но и членове на групата, изнасяща концерта, а много са в критично състояние. У нас акцентът е върху помощта, която България оказва на пострадалите. А аз се питам: трябва ли съседите ни македонци да страдат, за да имаме човешко отношение към тях?
В България пък бяха арестувани млади мъж и жена – тя е участвала в клипове с измъчване и убиване на животни по поръчка, а той я е снимал. Повече от клиповете ме ужасява мисълта, че по света има много хора, които се възбуждат от такива неща и си плащат за тях.
Вече става все по-ясно, че не Украйна не иска мир, а Русия. Според Тръмп обаче преговорите с Путин вървят много добре. След като американският президент, изглежда, се отказа от идеята си да придобие редкоземните минерали на Украйна, той хвърли око на атомните ѝ електроцентрали. Зеленски обаче не е склонен да му ги даде. И аз не бих била на негово място – ами ако с Мъск решат, че някакви си реактори на другия край на света не са им на сметка, и просто им хлопнат кепенците, както направиха с USAID, с издирването на отвлечени украински деца и с американското Образователно министерство? Или ако ги продаде изгодно на Путин?
Тръмп впрочем издаде заповед и за закриване на медийната група, част от която е „Свободна Европа“. Тя обаче не се дава без бой и съди президентската администрация с аргумента, че заповедта е не само незаконна, а и противоконституционна.
Ердоган пък арестува основния си политически опонент – кмета на Истанбул Екрем Имамоглу. Нашите политици има от кого да черпят вдъхновение. Кеф ти Тръмп, кеф ти Путин, кеф ти Ердоган.
Но кой да ни помага да понасяме всичко случващо се по света и в България, ако не Елена Телбис с лечебната за душата рубрика „Т.Е. от Е.Т.“?
И след като Елена ни приземи на родна почва, логично преминаваме към тазседмичния политически анализ на Емилия Милчева „Пеевски 3.0. Поглъщането“. В него пише как Пеевски поглъща държавността като питон, а от нея остава само фасадата. Затова за конституционен съдия е избран не юрист с международна репутация като Йонко Грозев, а Орлин Колев, завършил право, където и Пеевски – в ЮЗУ. Пак с подкрепата на Пеевски беше избран и управител на Здравната каса, а посред нощ парламентът прие абсурдистката му идея за държавни магазини в пощите. Но не се отчайвайте – питонът има още какво да лапа.
В тази ситуация не е учудващо защо България не извлича полза от едно от най-големите си природни богатства – минералните води, в които има бизнес, както ни убеждава Иво Анев от „Екипът на София“. Понастоящем ситуацията е абсурдна – минералната вода е до 71 пъти по-евтина от обикновената, доставяна по водопроводната мрежа. А наличието на минерални води носи и много косвени ползи – вижте Карлови Вари или Баден-Баден. Тук обаче е късмет, ако една минерална баня изобщо работи, а не е оставена да се саморазрушава. Или пък е превърната в музей.
И докато сме на българска вълна, съгласни ли сте децата да учат в училище, че заслужават страдание и смърт? Ако се приеме задължителното образование по религия, точно през такова задължително образование по самоомраза ще трябва да преминат представителите на една конкретна група деца – ЛГБТИ тийнейджърите. А на тях и без това не им е леко насред отхвърлящата ги среда в България. Затова някои едва издържат тежестта на живота. А има и такива, които не издържат. И после се тръшкаме – какво му беше, защо се самоуби.
Вторачили сме се в България, Украйна и САЩ, а междувременно войната в Сирия навърши 15 години. Искрен Иванов анализира сирийския въпрос в раздаването на картите между Великите сили в исторически контекст – от края на Втората световна война до наши дни. В настоящата ситуация единственият надежден съюзник на Сирия остава Турция, и то докато Ердоган все още управлява.
На фона на безрадостната реалност може да потърсим убежище в игрите. Миглена Николчина и Северина Станкева разговарят за съдбата, свободата и игровата механика в компютърната игра „Индика“, която според Николчина има редица аналогии с „Престъпление и наказание“ на Достоевски. Индика се бунтува срещу факта, че е създадена със свободна воля. Според Северина Станкева играта е притча. Изобщо, прелюбопитен диалог, който ще има и продължение.
От игрите прехождаме към книгите. В рубриката „На второ четене“ Антония Апостолова ни връща към „Голямо червено слънце, самотни електрически светлини“ от Пламен Антов. Антония е в раздвоена позиция – тя се усеща не просто рецензент, а автор на книгата, тъй като вижда в лицето на писателя своеобразен свой литературен близнак. Радостта автор да срещне и припознае себе си като друг е рядка, особена и плътна, признава тя. Така че не само разказите на Антов са „по пътя“ – и прочитът им извървява пътя между автора и читателката му, която хем е себе си, хем него.
Дойде време и за препоръката ми. През октомври бях споделила в бюлетина, че още събирам сили да гледам „Съседната стая“ на Педро Алмодовар. Е, събрах. И останах изненадана, защото, макар във филма да става въпрос за евтаназия, погледът към нея е по някакъв начин ведър. А цветовете, ах, цветовете – всеки носи символно значение и всеки кадър е картина.
Приятно четене и гледане! И ви благодаря, защото „Тоест“ съществува единствено поради вашата подкрепа.
Implementing network traffic inspection on AWS Outposts rack
Post Syndicated from Art Baudo original https://aws.amazon.com/blogs/compute/implementing-network-traffic-inspection-on-aws-outposts-rack-2/
This post is written by Arun Kumar N C, Technical Account Manager; Debapriyo Jogi, Technical Account Manager; and Ashish Nagaraj, Cloud Support Engineer 2
Organizations are increasingly adopting hybrid cloud architectures that combine the scalability of cloud computing with the control and compliance benefits of on-premises infrastructure. AWS Outposts extends AWS infrastructure, AWS services, APIs, and tools to on-premises locations for workloads that require low latency, local data processing, or data residency. Outposts comes in a variety of form factors, from 42U Outposts racks to 1U and 2U Outposts servers. This post will focus on implementing network traffic inspection on Outposts rack.
Comprehensive security is critical for organizations deploying production workloads on Outposts. Network traffic inspection serves as a crucial security control, protecting against threats while enabling secure communication between different network segments. This post provides guidance on how to implement effective network traffic inspection across your hybrid cloud infrastructure using Outposts rack.
Overview
In the coming sections we will cover strategies for network traffic inspection on Outposts rack, focusing on outbound internet access and communication with on-premises networks. We explore AWS native services and third-party tools, offering a comprehensive overview of your options. We will cover architectural patterns, implementation guides, and best practices to help build a strong security posture for your hybrid cloud environment.
Securing internet-facing applications
Securing internet-facing applications on Outposts requires a robust, multi-layered approach for high availability and comprehensive security. We will explore two key architectural patterns that ensure enterprise-grade security for your workloads below.
Amazon CloudFront with AWS WAF integration
This architecture uses multiple AWS services including AWS Shield and AWS WAF for multi-layered security, Amazon CloudFront for global content delivery, and an Application Load Balancer (ALB) on Outposts for on-premises traffic management. Applications are deployed on Outposts, with CloudFront as the content delivery network. AWS WAF rules on CloudFront protect against web exploits, while the ALB distributes requests to application instances within Outposts.
Figure 1 – Amazon CloudFront with AWS WAF integration
- User sends a request via web browser or mobile app to access the application.
- The request is received by the CloudFront in AWS Edge Location, performing content-based routing.
- CloudFront integrates with AWS WAF to filter web traffic and block common attack patterns.
- ALB routes it to the appropriate targets.
- The application on Outposts processes the request and generates a response.
This flow ensures secure and efficient handling of user requests using both cloud and on-premises resources.
ALB with AWS WAF
This architecture offers more control over traffic routing while using AWS WAF for security. Applications are deployed on Outposts, but the ALB is in the parent Region, as AWS WAF cannot be associated with Outposts ALBs. The regional ALB handles incoming traffic, with AWS WAF providing firewall capabilities. After passing through AWS WAF, traffic is routed to Outposts applications. This configuration allows advanced WAF features but may introduce latency, as traffic must first reach the regional ALB. This trade-off between security and latency should be considered based on application needs.
Note: A critical dependency exists on the service link connection, as application traffic routing relies on the regional ALB. Service link failures will disrupt workload operations, making connection resilience essential for this architecture.
Figure 2 – ALB with AWS WAF
- User sends a request via web browser or mobile app for a webpage, API call, or service.
- The ALB in the AWS Region receives the request and performs Layer 7 content-based routing.
- ALB integrates with AWS WAF for security inspection.
- If the request passes, ALB routes it to the appropriate target in Outposts, selecting a specific instance or service.
- The application on Outposts processes the request, generates a response, and returns it.
- The response travels back through Outposts ALB to the regional ALB, which forwards it to the user’s browser or app.
Inspection between the Outpost subnet and regional subnet
Network traffic inspection between the Outpost and regional subnets is vital for security in hybrid cloud deployments. It makes sure traffic between Outposts and the parent Region complies with security policies and requirements. Two main architectural approaches exist for implementing this inspection:
- Using a third-party firewall in the Outpost subnet.
- Using AWS Network Firewall in an AWS Region.
Both approaches support various connectivity (service link) options between Outposts and the Region, including AWS Direct Connect.
Using third-party firewall in the Outpost subnet
This architecture uses a third-party firewall in the Outposts subnet, routing all traffic between the Outposts and regio0nal subnets through it. This setup enables local traffic inspection, reducing latency while enforcing security policies before traffic leaves the Outposts.
Figure 3 – Third-party firewall in the Outpost subnet
Traffic can originate from either Outposts or AWS regional subnet.
a. Traffic is sent to the third-party firewall in the Outpost.
b. The firewall inspects the traffic and applies security policies.
c. If allowed, the firewall forwards traffic to the Region.
d. Traffic travels via service link connectivity (Direct Connect or public internet) to the regional subnet.
- Traffic originating from AWS Region to the Outpost:
a. Traffic originates in the regional subnet.
b. Traffic travels via service link connectivity (Direct Connect or public internet).
c. Upon reaching the Outpost, the traffic is sent to the third-party firewall.
d. The firewall inspects packets and applies security policies.
e. If allowed, the firewall forwards traffic to the Outpost subnet destination.
Using AWS Network Firewall in an AWS Region
In this architecture, a Network Firewall is deployed in the regional VPC, routing all traffic between the Outpost and regional subnets through it. This centralized approach ensures consistent policy enforcement with AWS native tools. The firewall inspects all traffic between Outposts and the AWS infrastructure in the Region.
Figure 4 – AWS Network Firewall in an AWS Region
Traffic can originate from either the Outposts subnet or AWS regional subnet.
All traffic is routed to the Network Firewall in the AWS Region.
- The firewall applies configured rules, including:
- Custom rules for specific security needs.
- Managed AWS rule groups for common threats.
- Third-party rule groups for specialized protection.
- If traffic passes all rules, it is forwarded to its destination (Outpost or Region).
- Return traffic follows the same path, all traffic is inspected by the Network Firewall.
Inspection between on-premises and Outposts through Local Gateway
Network traffic inspection between on-premises networks and Outposts via Local Gateway (LGW) is essential for securing hybrid environments. It helps you make sure safe communication is happening between Outposts workloads and on-premises infrastructure.
Two primary architectural approaches are available explained below. The choice depends on infrastructure, security needs, and operational preferences.
Using third-party firewall on Outposts
For more details on implementing network traffic inspection between on-premises networks and Outposts via LGW, refer to Implementing network traffic inspection on AWS Outposts rack.
This post expands on the preceding blog by offering detailed guidance on architectural options and traffic flows for inspecting network traffic between on-premises environments and Outposts via LGW.
Using your on-premises router/firewall
This approach uses the existing firewall capabilities of your on-premises router/firewall. The network is configured to route all traffic between the on-premises environment and Outposts through this router/firewall. The LGW on your Outpost connects directly to your router/firewall, which handles the firewall functions. This setup uses the on-premises security infrastructure and policies, ensuring continuity in security management while integrating Outposts into the broader network security strategy.
Traffic flow:
- Traffic originates from on-premises network
- Passes through your router with the firewall
- Router inspects the traffic
- If allowed, traffic is sent to Outposts through the LGW
- Outbound inspection to the internet from Outposts instances
Outbound inspection to the internet from Outposts instances
Outbound internet traffic inspection for Outposts instances is useful for security and controlling access to external resources. Three architectural approaches are available for implementing this inspection, which are discussed in the following sections.
Using Customer-Owned IP (CoIP) with on-premises firewall
In this architecture, Outposts instances are assigned Customer-Owned IP (CoIP) addresses, with all outbound internet traffic routed through the on-premises network and firewall. The LGW connects the Outposts environment to the on-premises network. This setup enables organizations to leverage existing on-premises security and internet connectivity while ensuring consistent IP addressing across their hybrid environment.
Figure 5 – Customer-Owned IP (CoIP) with on-premises firewall
- An Outposts instance with a CoIP address initiates outbound internet traffic.
- The traffic is routed to the LGW on the Outpost.
- The LGW forwards the traffic to the on-premises network.
- The traffic reaches the on-premises firewall and inspects the traffic, applying security policies and rules.
- If allowed, the firewall forwards the traffic to the internet through the on-premises connection.
- Return traffic follows the reverse path, being inspected by the firewall before reaching the Outposts instance.
Using CoIP with third-party firewalls on Outposts
Using this configuration, you would assign a CoIP addresses to your Outposts instances and deploy a third-party firewall appliance directly on the Outposts rack. Outbound internet traffic from these instances is routed through the local firewall running on EC2 before reaching the internet via the LGW. This approach ensures local traffic inspection while preserving the advantages of CoIP addressing, enabling seamless integration with existing IP management systems.
Figure 6 – CoIP with third-party firewalls on Outposts
- An Outposts instance with a CoIP address initiates outbound internet traffic.
- The traffic is routed to the third-party firewall deployed on the Outpost.
- The firewall performs deep packet inspection, applying security policies and rules.
- If allowed, the firewall forwards the traffic to the LGW.
- The LGW sends the traffic to the internet through the on-premises connection.
- Return traffic follows the reverse path, being inspected by the firewall before reaching the Outposts instance.
Using Internet Gateway (IGW) with Network Firewall in the Region
This architecture provides secure outbound internet access for Outposts workloads by using services in the parent Region. The VPC extends to include the Outposts rack, with internet-bound traffic routed via the service link to the AWS Region. In the Region, the Network Firewall inspects the traffic before forwarding it to the Internet Gateway (IGW) for internet access.
Traffic flow:
- Traffic is sent to the parent Region via the service link.
- In the Region, traffic is routed to the Network Firewall.
- The Network Firewall inspects the traffic and applies rules.
- If allowed, traffic is forwarded to the IGW via the NAT Gateway.
- The IGW sends the traffic to the internet.
- Return traffic follows the reverse path, inspected before reaching Outposts.
Conclusion
Implementing effective network traffic inspection for AWS Outposts requires a strategic approach balancing security, efficiency, and architectural complexity. We’ve explored multiple architectural patterns for implementing network traffic inspection with Outposts rack.
Reach out to your AWS account team or AWS support to learn more about inspection in Outpost.
Friday Live!
Post Syndicated from Crosstalk Solutions original https://www.youtube.com/watch?v=byb2C6IsXus
USS Kitty Hawk and K-314
Post Syndicated from The History Guy: History Deserves to Be Remembered original https://www.youtube.com/watch?v=7q5BEoZG4D4
[$] OSI election ends with unsatisfying results
Post Syndicated from jzb original https://lwn.net/Articles/1014603/
The Open Source Initiative
(OSI) has announced
the results of its recent board of directors election. Ruth Suehle and
McCoy Smith are new to the board, while Carlo Piana will serve another
term. The results, however, seem tainted in the eyes of some
participants and observers. The election has been plagued by missteps
from the beginning. It has culminated with the exclusion of three
candidates for failing to meet a requirement to sign the OSI board agreement, which was added after the election was over and before results were tallied or announced.







