幹壞事是進步最大的原動力
先前在「Let's Encrypt 在 Android 平台上遇到的問題」這邊提到了 IdenTrust 幫 Let's Encrypt 交叉簽名的有效日會在 2021 年的八月底左右到期，而這會導致比較舊的 Android 平台因為沒有內建 ISRG Root X1 這個憑證，造成 Let's Encrypt 簽出來的憑證在這些舊的 Android 裝置上都認不出來。
文章出來過了一個多月後，剛剛看到 Let's Encrypt 發佈消息，IdenTrust 願意再交叉簽名三年：「Extending Android Device Compatibility for Let's Encrypt Certificates」，當時猜測發文是要讓 IdenTrust 表態，看起來目的達成了...
話說中間跑出來的「ZeroSSL 也提供免費的 SSL Certificate (DV) 了」不知道後續會怎麼樣，之後可以看看 Certificate Transparency 的資料來看看到底有多少人用...
Amazon S3 的 cross-region replication 與 same-region replication 也提供 SLA 了：「S3 Replication Update: Replication SLA, Metrics, and Events」。
- Most of the objects will be replicated within seconds.
- 99% of the objects will be replicated within 5 minutes.
- 99.99% of the objects will be replicated within 15 minutes.
對應的賠償是：
When you enable this feature, you benefit from the associated Service Level Agreement. The SLA is expressed in terms of a percentage of objects that are expected to be replicated within 15 minutes, and provides for billing credits if the SLA is not met:
- 99.9% to 98.0% – 10% credit
- 98.0% to 95.0% – 25% credit
- 95% to 0% – 100% credit
不過只保證 99% 的物件在五分鐘內會被 replicate 有點低，應該跟底層的網路 latency 有關？
Let's Encrypt 宣佈了以後的憑證的簽發計畫：「Transitioning to ISRG's Root」。
主要的改變是 2019/07/08 之後提供的 intermediate CA 會改變，從現在的 cross-sign 變成只有自己的 Root CA：
On July 8, 2019, we will change the default intermediate certificate we provide via ACME. Most subscribers don’t need to do anything. Subscribers who support very old TLS/SSL clients may want to manually configure the older intermediate to increase backwards compatibility.
目前的簽發用的兩個中介憑證 (Let's Encrypt Authority X3 與 Let's Encrypt Authority X4) 是由 Let's Encrypt 自己的 ISRG Root X1 與 IdenTrust 的 DST Root CA X3 所 共同簽署的：
這是因為 IdenTrust 的 DST Root CA X3 憑證很久前就被各家瀏覽器信任 (像是 Mozilla 的「Request to add two additional IdenTrust root CA certificates」這篇，可以看到 2007 年就被放進去了)，而 Let's Encrypt 當時為了更快把可用的產品推出，所以跟 IdenTrust 合作，採用 cross sign 的方式讓 Let's Encrypt 簽出來的憑證被一般瀏覽器與函式庫所信任。
現在差不多過了三年半，Let's Encrypt 成為目前世界上最大的 SSL Certificate 發放單位，加上自己的 Root CA (ISRG Root X1) 也都差不多被整合進各家系統內了，所以打算要獨立自己簽了。
不過系統上可以設定，使用者如果有遇到相容性問題 (太舊的系統可能還是不包含 Let's Encrypt 自家的 ISRG Root X1)，還是可以設定使用有 cross-sign 的版本 (維持現狀)。與 IdenTrust 的 cross-sign 會維持到 2021 年九月，大約再兩年多一些：
Our current cross-signature from IdenTrust expires on March 17, 2021. The IdenTrust root that we are cross-signed from expires on September 30, 2021. Within the next year we will obtain a new cross-signature that is valid until September 29, 2021. This means that our subscribers will have the option to manually configure a certificate chain that uses IdenTrust until September 29, 2021.
對於自用來說應該沒什麼大影響，主要是企業用戶要注意相容性...
Submariner 是連接兩個不同的 Kubernetes 網路層的軟體：「Cross-Cluster Network Connectivity for Kubernetes」。
目前還在 alpha 階段 (看 GitHub 也可以看出來還很新)，在架構面上是使用 IPsec 保護流量：
Submariner is a tool built to connect overlay networks of different Kubernetes clusters. While most testing is performed against Kubernetes clusters that have enabled Flannel/Canal, Submariner should be compatible with any CNI-compatible cluster network provider, as it utilizes off-the-shelf components such as strongSwan/Charon to establish IPsec tunnels between each Kubernetes cluster.
這等於是試著實作 GCP 的跨區內網架構...
AWS 對 Aurora (MySQL) 推出 Amazon Aurora Global Database：「Announcing Amazon Aurora Global Database」。
看起來不是 multi-master (從 secondary region 這個字看)，所以寫入的部分還是得送回 primary region 處理：
Aurora Global Database uses storage-based replication with typical latency of less than 1 second, using dedicated infrastructure that leaves your database fully available to serve application workloads. In the unlikely event of a regional degradation or outage, one of the secondary regions can be promoted to full read/write capabilities in less than 1 minute.
應該是單一 endpoint 幫你處理這些雜事...
Mozilla 先前終止與 Yahoo! 的合作後 (在 Firefox 內預設使用 Yahoo! 的搜尋引擎)，Yahoo! 提告以及 Mozilla 還手的消息在最近被 Mozilla 揭露：「Mozilla Files Cross-Complaint Against Yahoo Holdings and Oath」。
Yahoo! 提告的檔案 (PDF) 在「2017-12-01-Yahoo-Redacted-Complaint.pdf」，Mozilla 還手的檔案 (PDF) 則是在「2017-12-05-Mozilla-Redacted-X-Complaint-with-Exhibits-and-POS.pdf」這邊。
在 Firefox 57 釋出時，Mozilla 就把預設的搜尋引擎改回 Google (參考「Mozilla terminates its deal with Yahoo and makes Google the default in Firefox again」)，不過當時 Firefox 57 更大的消息是推出了 Quantum，讓瀏覽器的速度拉到可以跟目前的霸主 Google Chrome 競爭的程度，所以就沒有太多人注意到這件事情...
過了幾個禮拜消息比較退燒後，被告以及反過來告的消息出來後，才注意到原來換了搜尋引擎... XD
旁邊搖旗吶喊沒什麼用，就拉板凳出來看吧...
Amazon DynamoDB 實做了全球性的 replication，以及備份功能：「Amazon DynamoDB Update – Global Tables and On-Demand Backup」。
跨區 replication 的功能讓每個 region 都可以存取當地機房的 DynamoDB：
Global Tables – You can now create tables that are automatically replicated across two or more AWS Regions, with full support for multi-master writes, with a couple of clicks. This gives you the ability to build fast, massively scaled applications for a global user base without having to manage the replication process.
這有點類似 Google 的 Cloud Spanner 在前陣子也推出全球性服務，但 DynamoDB 提供的比較偏向 NoSQL 而不是 RDBMS。
另外一個限制是跨區同步是 async，會有 replication lag 的問題：
Updates are propagated to other Regions asynchronously via DynamoDB Streams and are typically complete within one second (you can track this using the new ReplicationLatency and PendingReplicationCount metrics).
不過如果是這樣的機制，conflict 的問題不知道怎麼解決... 文章裡面沒看到。
然後目前支援的區域還是有限：
Global Tables are available in the US East (Ohio), US East (N. Virginia), US West (Oregon), EU (Ireland), and EU (Frankfurt) Regions today, with more Regions in the works for 2018.
另外一個是備份與還原機制，有這樣的功能對很多計畫方便不少：
On-Demand Backup – You can now create full backups of your DynamoDB tables with a single click, and with zero impact on performance or availability. Your application remains online and runs at full speed. Backups are suitable for long-term retention and archival, and can help you to comply with regulatory requirements.
而備份還原機制是陸陸續續開放的，區域也有限：
We are rolling this new feature out on an account-by-account basis as quickly as possible, with initial availability in the US East (Northern Virginia), US East (Ohio), US West (Oregon), and EU (Ireland) Regions.
以前要記錄行為會透過 AWS Lambda 轉丟到其他帳號下記錄，有一堆眉眉角角的東西要注意，現在則是直接支援了：「New – Cross-Account Delivery of CloudWatch Events」。
文章裡有提到兩種用途，其中一種就是做安全性的記錄：
Separation of Concerns – Customers would like to handle and respond to events in a separate account in order to implement advanced security schemes.
另外一種則是為了將記錄丟到同一個地方：
Rollup – Customers are using AWS Organizations and would like to track certain types of events across the entire organization, across a multitude of AWS accounts.
價錢看起來沒什麼問題，每一百萬次收 USD$1：
Events forwarded from one account to another are considered custom events. The sending account is charged $1 for every million events (see the CloudWatch Pricing page for more info).
SQL 的各種 JOIN 其實是個很好玩的主題，不是很難，但沒有仔細練習過一次通常只能答出常用的那幾種... 而且過一陣子又會忘記 XD
這幾天不知道哪邊看到的舊文章「Say NO to Venn Diagrams When Explaining JOINs」，這篇作者大聲疾呼不要用 Venn diagram 解釋 SQL 的 JOIN，把比較特別的 JOIN 拿出來舉例...
因為 Venn diagram 是講集合交聯集這類的操作，但 JOIN 不僅僅是如此... 舉例來說，CROSS JOIN 對應到 cartesian product 就沒辦法用 Venn diagram 簡單的表示出來，而必須畫的更「具體」：
如同之前 AWS 的規劃，宣佈啟用美東第二區了 (us-east-2，在俄亥俄州)：「Now Open – AWS US East (Ohio) Region」。看了一下 EC2 的價錢，與 us-east-1 是同一個級別的，其他的服務應該是都差不多...
另外因為跨州了 (而且跟 us-east-1 很近)，所以官方也推薦拿來做異地服務：
With just 12 ms of round-trip latency between US East (Ohio) and US East (Northern Virginia), you can make good use of unique AWS features such as S3 Cross-Region Replication, Cross-Region Read Replicas for Amazon Aurora, Cross-Region Read Replicas for MySQL, and Cross-Region Read Replicas for PostgreSQL.
其中有個特別的地方在於 us-east-{1,2} 之間傳輸的費用會以 Inter-AZ 計費，而非以跨 region 計費。大概是希望讓大家有動力多放些東西過去，畢竟 us-east-1 實在太大，穩定性超有名的關係 XDDD：
Data transfer between the two Regions is priced at the Inter-AZ price ($0.01 per GB), making your cross-region use cases even more economical.
