First, I would like to preface that this is alpha and should not replace anything in prod at the moment.
What I like about how SIEMatic is built:
* Django (personal familiarity)
* Agent, Indexer, crawlers and web all share a codebase with separate settings
* Search language is built around django orm, built-in jinja2 and ast.literal_eval makes it very versatile, I will be writing some tutorials soon
* search commands designed to handle dataframes, Django Querysets and records (lists of dicts) with predictable conversion between them (you can filter early in you search pipeline)
* from local on sqlite (rundev command) to distributed on postgres with scaling/tuning tips
* comes out of the box ready to monitor your host and provide dashboards and savedsearches
* crawlers handle data retention, alerting, summary event generation and more
There's a bunch more, but again, this is alpha software.
IDK about OPs setup, but I run a pile of E5-2683v4 Xeon recycled servers for Ceph and self hosted business SaaS usage.
One node's ipmitool sensor report (and self-monitoring PSU, so grain of salt, but my UPS side monitoring tracks closely), reports 250-300w average power use. This though, mind you is for running 22 spinning disks, 2 SAS/SATA SSDs, and 4 NVME ssds, and 768GB of DDR4.
Mid-gen 2015ish Xeons were not great at power reduction, but if you are pegging the cores, they were never particularly slow, and they did have lots of PCIe lanes. This boils down to the CPU/mobo itself not being that big a cost floor, especially if you have high utilization rates.
As a comparison, my main desktop development machine, running a Threadripper 9970X, 128GB of DDR5, a RDNA4 GPU, and a small pile of NVME drives has a power floor of roughly 250W. Some CPU centric workloads you'll definitely lose out on on the older gens of machines, but they are by no means impractical.
Maybe for a desktop usecase they are absolutely suboptimal nowadays, but for a lot of realworld usecases I would say they're still relevant.
---
Like the author posts for the LLM usecase, I think optimizing the hardware choice to the application and not leaving levers unpulled is a big key, especially considering how wide a variety of bandwidth/power draw/peak frequency/corecount SKUs exist in the Xeon lines. Without knowing what you intend to run and fitting the correct processor to it, you will end up with a disappointingly poor environment fit.
Take the volume and mass of lobbying by all of data broker companies, data collection companies, and executive agencies.
Combine that with the character of practically every law written involving data privacy, use, IP, and associated regulation of activity around these since the 1990s. It becomes painfully clear that the interests of private citizens have not had a seat at the table, and the Constitution has been taken as an inconvenience to bypass, not a guiding document.
The core sticking point is, I think, is that Section 230 was envisioned as a 'common carrier' exception. Common carriers do not apply editorial control to the content they transmit.
In the modern landscape, where practically every mainstream (and most of the non mainstream even) platform has extensive policies and applies them in a manner that's equivalent to editorial control, they are no longer a common carrier, they are a publisher.
Should that exemption and safe harbor be expanded to all publishers? If no, do you really want the Government picking and choosing favorites? Either way you choose, I believe there will be many first and further order implications.
You can either get Congress to modify the definition, or you could try to get a case through the courts to clarify its interpretation. As one of those indirect implications, I am actually not sure which one would be more of a footgun.
> The core sticking point is, I think, is that Section 230 was envisioned as a 'common carrier' exception. Common carriers do not apply editorial control to the content they transmit.
No, the writers of Section 230 (Ron Wyden and Chris Cox) envisioned the opposite, that websites hosting user-generated content would not be common carriers, would be free to develop new ways to moderate and curate content as they wished, and could not be punished for applying their own viewpoints to their moderation.
From Wyden's and Cox's amicus brief in Gonzalez v. Google confirming that targeted recommendations are protected by Section 230 [1] (related summary at [2]):
> Section 230 does not permit the Court to treat YouTube’s recommendation of a video as a distinct piece of information that YouTube is “responsible” for “creat[ing],” 47 U.S.C. § 230(f)(3).
[...]
> Section 230 protects targeted recommendations to the same extent that it protects other forms of content curation and presentation. Any other interpretation would subvert Section 230’s purpose of encouraging innovation in content moderation and presentation.
From Wyden's and Cox's reply comments to an FCC rulemaking process regarding whether the FCC has authority to interpret Section 230 (it does not) [3]:
> The first is that Section 230 does not require political neutrality. Claiming to “interpret” Section 230 to require political neutrality, or to condition its Good Samaritan protections on political neutrality, would erase the law we wrote and substitute a completely different one, with opposite effect. The second is that any governmental attempt to enforce political neutrality on websites would be hopelessly subjective, complicated, burdensome, and unworkable. The third is that any such legislation or regulation intended to override a website’s moderation decisions would amount to compelling speech, in violation of the First Amendment (regarding which, see section VIII below).
[...]
> The reason that Section 230 does not require political neutrality, and was never intended to do so, is that it would enforce homogeneity: every website would have the same “neutral” point of view. This is the opposite of true diversity.
The above quoted statements denying a requirement of political neutrality apply equally if you replace "political neutrality" with the more general "viewpoint neutrality".
Well tinygo takes some go bindings they implemented for llvm, https://github.com/tinygo-org/go-llvm, uses the Go standard library for parsing, and wires it up to a LLVM IR generator, with a set of flexible backend/machine definition machinery.
You could likely improve gobee to use tinygo's packages directly, instead of transpiling to C and calling into clang, and the licenses of the two projects look compatible. You'll still need to deal with defining a subset to pass the verifier, of course.
---
From the README:
> Replace clang. clang's BPF backend gives us CO-RE, BTF, and verifier-friendly codegen for free. Reimplementing that costs years and gains nothing.
The primary gotcha you may hit if you try this is how much of the BPF features are implemented by clang, and how much is instead implemented in core LLVM. Even with a LLVM sitting next door you could pull out, the harnesses may not exist independent of clang, but I have not looked THAT deep.
The title says 'standard library'. Are you saying that, in the context of C, that it is an error to take that to mean an implementation of libc?
Yes, I know the author's writeup then goes on to say that it is not a libc with a pile of questionable justfication. This is a custom runtime, in a single header no less, which is admittedly impressive, especially considering it provides runtime and thread safety primitives. This does not rise to the level of claiming the idea of a 'standard libarary' though, IMO. In that, I think the author misses the point.
I became aware of RFC4259: https://www.rfc-editor.org/rfc/rfc4259, but is there literature about its use in the wild? Searching on [rfc4259, nanog] comes up snake eyes for me.
I suppose the main reason was compatibility with existing cable headend infrastructure, but I'm also curious to know if there were ever actual TV and DOCSIS data sharing a single physical transponder. Would be a nice way of leveraging spare bandwidth due to variable bit rate video encoding!
reply