Recent content on Tech Notes by Natan Yellin
In some sense, LLMs have long-term and short-term memory. Long-term memory is the model itself and short-term memory is the current input. When using chat.openai.com, the model only remembers the last 4K tokens. To bypass this limitation, I prompted ChatGPT to identify important information throughout our conversation and propogate it forward using a self-modifying prompt. My original goal was to…
Everyone on HN is talking about Magic Leap again. I don’t understand screen technology but have been saying for years that something is wrong at Magic Leap. Why? Because at a time when their glasses didn’t work, they acquired a cyber security company with 20 people. It made no sense. At the time, I asked some relevant people why an AR company needed so much cyber. They told me that…
I’ve been involved in open source software for over a decade: Robusta - Open source Kubernetes troubleshooting and automation platform Show Me A Graph - Easily create graphs from cli commands and view them in the terminal. Like the watch command but with a graph of the output. Reconstant - Reconstant lets you share constant and enum definitions between programming languages. Various GNOME…
Here is a common error you might encounter on Linux: you download a Python script from the internet and try to run it. You receive an error like the following because Python supposedly doesn’t exist: $ ./script.py -bash: /path/to/script.py: /usr/local/bin/python^M: bad interpreter: No such file or directory You try to run python ./script.py and it works. You run which python and verify that…
This post contains a rough sketch of the life and death of a process on Linux. It is a first-order approximation only. A later post will refine this further and provide a more precise description, adding details about pid namespaces, obscure syscalls, and little known flags. Birth Every time a process is created, really another process split itself using the fork or clone syscall. After forking,…
I recently wrote that the audit API is the best way to track process lifecycle on Linux for security purposes. It turns out there are several difficulties I underestimated: Containers: the audit framework doesn’t (yet) track containers. If you could easily track process hierarchies this wouldn’t be a big deal because you could keep track of which processes are in which containers…
This post is the latest in a series of posts about tracking processes on Linux which looks at the fine details of various APIs. Here is some sample output from the Netlink Process Connector API on Linux. It contains an odd looking fork1: EventType=FORK ParentPid=100 ParentTgid=99 ChildPid=200 ChildTgid=199 Take a moment to think about what is going on here and who gave birth to who. At first…
If you want to track which processes are running on a Linux machine, the Netlink Process Connectors API is a convenient solution, despite certain limitations. The API provides an easy way to receive notifications whenever processes are created (forked/cloned) and whenever they undergo lifecycle events (exec, exit, etc). One possible use of the API is implementing a tool like htop1 There is only…
Hi, I’m Natan Yellin. I’m the CEO of Robusta - an open source Kubernetes monitoring solution. Unlike traditional monitoring, Robusta can identify root causes and apply fixes. We’re rethinking what it means to monitor your cloud. Before Robusta, I built firewalls and low-level security solutions. I did everything from development to devops to reverse engineering to product. If…
Introduction Everyone knows how to track which processes run on Linux, but almost no-one tracks them accurately. In fact, all of the methods listed in this post have some deficiency or another. Lets define requirements: All processes should be logged including short-lived processes We should know the full executable path of every process that runs Within reason, we shouldn’t need to modify…
Here is a bug that everyone who uses BPF to filter packets on Linux eventually encounters: you create a socket, use setsockopt to apply a BPF, and then read from the socket using recv. You read a packet that does not match the filter but was received from the socket anyway. The bug only happens when there is a lot of traffic and even then it only occurs when the application first starts.