digitalcircuit has quit [Ping timeout: 264 seconds]
digitalcircuit has joined #sandstorm
XgF has quit [Remote host closed the connection]
XgF has joined #sandstorm
Mitar has quit [Ping timeout: 272 seconds]
Mitar has joined #sandstorm
nicoo has quit [Ping timeout: 256 seconds]
nicoo has joined #sandstorm
pie_ has joined #sandstorm
larjona has quit [Ping timeout: 245 seconds]
larjona has joined #sandstorm
pie__ has joined #sandstorm
pie_ has quit [Ping timeout: 250 seconds]
larjona has quit [Ping timeout: 240 seconds]
larjona has joined #sandstorm
<TimMc>
My employer is probably a couple orders of magnitude below Facebook in scale (depending on how you measure that) and I know just the access logs from one service accumulate at 45 GB per day.
<TimMc>
We serve video, and the parts of our service that handle video directly get up into the petabyte range, easily.
<simpson>
Matador Cloud (my side business) throws away almost all logs. Mostly for customer privacy, but also because that's a lot of trash to pay to keep around.
<Zarutian>
simpson: you dont feed the logs first into an entropy pool before throwing them away?
<simpson>
Zarutian: What's the point? My cloud vendor can log all the interesting bits already, and they also have the storage for the logs.
<simpson>
The logs I have are recent snippets from various k8s Pods. I don't aggregate them, I just have them enabled for debugging purposes.
<Zarutian>
meant, instead of pointing them to be written to /dev/null or equiv, stuff them through whatever one of the input of /dev/urandom uses.
<Zarutian>
but only if you have something that eats entropy like it is paid for it running on these systems.
<simpson>
Oh ew. That's dangerous. Logs can contain attacker-controlled input.
<simpson>
They don't go to /dev/null either. Just plain stdout, which k8s collects. For debugging only, y'know? But debugging is really important.
<TimMc>
I'm pretty sure attacker-controlled input is fine to stuff into /dev/random as long as it isn't correlated with the PRNG's state.
<TimMc>
Although I'm not really sure it has much benefit in this case; it's not something you can *rely* on, so you need good entropy seeding anyway....
<TimMc>
In my home datacenter, new VMs are seeded with entropy from the controller and use /dev/urandom for their LUKS setup, which I figure is Good Enough.