Cloudflare 也要支援 AVIF

Cloudflare 針對 Image Resizing 增加了 AVIF 的支援:「Introducing support for the AVIF image format」。

We've added support for the new AVIF image format in Image Resizing.

照 comment 的地方看起來是 Business 功能,之後有機會下放到 Pro,但免費版應該不會出現:

Kornel Ian K Homan • 15 hours ago
This is part of the Image Resizing feature, which is currently available for Business plans. It's coming to Polish in the near future, which is a Pro plan feature.

這跟「Chrome 85 支援 AVIF」應該有些關係,加上其他瀏覽器也陸陸續續打算要支援,是個先做不虧的感覺...

美國汽車的兒童安全座椅法律,影響生育的意願

Hacker News Daily 上看到的,原文標題比較漂亮:「Car Seats as Contraception」,在 Hacker News 上也有討論:「Car seats as contraception (ssrn.com)」,重點是作者之一 (David H. Solomon) 也有跑上去回應。

Abstract 的部份把重點都講出來了,1977 年美國通過汽車的兒童安全座椅法律,但大多數的汽車無法放下第三張座椅,這反而使得生第三胎的成本大幅提高 (需要買空間更大的車),然後另外拉出資料分析因為法律而制止的車禍數量:

Since 1977, U.S. states have passed laws steadily raising the age for which a child must ride in a car safety seat. These laws significantly raise the cost of having a third child, as many regular-sized cars cannot fit three child seats in the back. Using census data and state-year variation in laws, we estimate that when women have two children of ages requiring mandated car seats, they have a lower annual probability of giving birth by 0.73 percentage points. Consistent with a causal channel, this effect is limited to third child births, is concentrated in households with access to a car, and is larger when a male is present (when both front seats are likely to be occupied). We estimate that these laws prevented only 57 car crash fatalities of children nationwide in 2017. Simultaneously, they led to a permanent reduction of approximately 8,000 births in the same year, and 145,000 fewer births since 1980, with 90% of this decline being since 2000.

濃濃的政治不正確感 XD

OpenSSH 8.4 預設停用 ssh-rsa

前幾天 OpenSSH 8.4 釋出了:「Announce: OpenSSH 8.4 released」。

比較重要的改變是 ssh-rsa 預設變成停用,因為是使用 SHA-1 演算法的關係:

It is now possible[1] to perform chosen-prefix attacks against the SHA-1 algorithm for less than USD$50K. For this reason, we will be disabling the "ssh-rsa" public key signature algorithm by default in a near-future release.

官方給了三個方案:

  • The RFC8332 RSA SHA-2 signature algorithms rsa-sha2-256/512. These algorithms have the advantage of using the same key type as "ssh-rsa" but use the safe SHA-2 hash algorithms. These have been supported since OpenSSH 7.2 and are already used by default if the client and server support them.
  • The ssh-ed25519 signature algorithm. It has been supported in OpenSSH since release 6.5.
  • The RFC5656 ECDSA algorithms: ecdsa-sha2-nistp256/384/521. These have been supported by OpenSSH since release 5.7.

掃了一下 ~/.ssh/known_hosts,看起來目前大多都是 ssh-ed25519 了,還有少數還是 ssh-rsa

翻了一下 Ubuntu 這邊的版本,16.04 是 7.2p2,看起來目前有支援的版本都可以用這三個。

官方有提到可以在 command 上強制關閉 ssh-rsa 測試的方法:

ssh -oHostKeyAlgorithms=-ssh-rsa user@host

現在看起來比較麻煩的是 Dropbear 的部份,我自己之前是有包 PPA 來用 (2019.78),但看起來還是不夠新支援 ssh-ed25519 (要今年六月的 2020.79 才支援),所以也許要找時間來把 PPA 更新到 2020.80...

另外一種方法是走 ecdsa-sha2-nistp{256,384,521} 這些演算法,不過從名字就可以知道裡面演算法的由來,卡個 NIST 在那邊看起來就不太舒服,但還是寫一下方法好了:

先用 dropbearkey 產生對應的 ecdsa host key:

sudo dropbearkey -t ecdsa -f /etc/dropbear/dropbear_ecdsa_host_key -s 256

再來在 /etc/default/dropbear 裡面把 DROPBEAR_EXTRA_ARGS 加上對應的 ecdsa host key 資訊,這邊直接用 -r 是因為他可以重複指定,不會影響到其他的 host key 設定:

# any additional arguments for Dropbear
DROPBEAR_EXTRA_ARGS="-r /etc/dropbear/dropbear_ecdsa_host_key"

然後重跑 dropbear 就可以了。

另外有興趣的人可以用 ssh -Q key 看 openssh client 支援的演算法。

Cloudflare 推出 Cron Triggers

Cloudflare 推出了 Cron Triggers,有兩篇說明:「Introducing Cron Triggers for Cloudflare Workers」、「Making Time for Cron Triggers: A Look Inside」。

底層架構上是用 Nomad 做的:

To consume the schedules and actually trigger the Worker, we built a new service in Rust and deployed to our edge using HashiCorp Nomad. Nomad ensures that the schedule runner remains running in the edge node and can move it between machines as necessary.

多了定時跑程式的能力後,整個 serverless 平台的拼圖又多了一塊,現在看起來應該是要發展 storage 與 database-like 系統...

Cloudflare 推出 Workers Durable Objects

這幾天 Cloudflare 丟出蠻多東西的,挑一些比較想寫下來的來寫,其中一個是他們的 serverless platform 又提供另外一種 database 了:「Workers Durable Objects Beta: A New Approach to Stateful Serverless」。

先前的產品是 eventually-consistent database (放掉 CAP theorem 裡面的 C),也就是 Workers KV,這次提供的是 strong consisteny 版本的 database,叫做 Workers Durable Objects。

目前還沒看到文件,網站上的 Products 裡只放了 Workers KV 的,目前只能就敘述上猜。

以 blog 文章的敘述看起來是保護了 C 的部份,但不知道是放掉 AP 裡面哪個,也許是 A 的部份,因為文章裡一直都沒提到 high availability。

看起來是個有趣的產品,之後等更多文件出來的時候再研究。

Network Time Security 正式成為 IETF 標準

在「NTS is now an RFC」這邊看到 Network Time Security 成為 IETF 的標準了:「Network Time Security for the Network Time Protocol」。

這個標準比較特別的是,因為 TLS 裡對 certificate 的驗證需要先有正確的時間,而導致 NTP 直接套用 TLS 會有「先有雞還是先有蛋」這樣的問題出現。這點在「8.5. Initial Verification of Server Certificates」這個章節裡面被討論到:

However, the expectation that the client does not yet have a correctly-set system clock at the time of certificate verification presents difficulties with verifying that the certificate is within its validity period, i.e., that the current time lies between the times specified in the certificate's notBefore and notAfter fields.

看起來還是頗複雜,但至少先給個方法出來了...

在一台電腦上多畫面與多鍵盤滑鼠操作遊戲:Universal Split Screen

Hacker News Daily 上看到這款工具,可以在 Windows 上把拆出多個畫面,並且提供給不同的鍵盤與滑鼠使用:「Universal Split Screen」,而且是 open source 專案 (使用 MIT License),程式碼在 UniversalSplitScreen/UniversalSplitScreen 這邊。

理論上只要不是太吃資源的遊戲,應該都適合這個方法搞 (從他列出來的遊戲列表看起來,似乎都不會太吃 CPU 與顯卡)。

另外在想是不是也可以拿給其他用途使用,像是 PuTTY 之類的程式?

Amazon CloudFront 增加墨西哥與紐西蘭的點

Amazon CloudFront 新增加了四個點,兩個在墨西哥,兩個在紐西蘭:「Amazon CloudFront launches in two new countries - Mexico and New Zealand」。

比較特別的是墨西哥的點仍然是被併入北美區的價錢,也就是 CloudFront 裡面最低的那組價錢:

In Mexico, our two new edge locations in Querétaro will provide viewers as much as a 30% reduction in p90 latency measures. These new edge locations are priced within CloudFront’s North America geographic region.

所以這代表在墨西哥當地的網路成本跟美國是一樣低?