Network & Interconnect

The first volumetric attack I ever fought, I fought with iptables and a text editor. This was before a CDN was something you could buy, when a hosting company’s border was its own problem: if something on the far side of the Internet decided to hate you, the mitigation plan was you, awake, blocking CIDRs by hand while the graphs climbed. I remember the particular despair of that loop. Block a range, watch the flood shift, block the next one, watch it shift again, and slowly understand that the rules were winning every argument and losing the war, because the box was executing my DROPs perfectly and going down anyway. ...

The rule that lets the application reach its database names an identity, not an address. No IP. No CIDR. No route. No security group. Written that way, the rule holds the same on one node or a thousand, on-prem or across three clouds, and it does not break when a pod moves, because nothing in it ever said where anything was. In part 1 the same application connected to MySQL with no password, on one host. If part 1 was “the credential is not a string,” this is part 2: “the perimeter is not a subnet.” Same demo, same images, same page, same SQL. This time the application and the database live in different Kubernetes namespaces, and one new idea carries the whole piece: the network itself reads the identity. ...

4/5 — Security as an Enabler (and “forward agency”) Series: Security Assurance — URE Case — 4/5 Start from the beginning: 1/5 — The Inception Next: 5/5 — Conclusion — Assurance Without Theater Security enables the business when it shows up with agency: not just identifying risk, but carrying enough context to propose solutions that preserve the mission. That requires a maturity shift. When security arrives late, it often speaks in “non-English.” It blocks because the system is already committed to choices no one can defend. ...

Right now, I’m working on an InfiniBand topology design for a GPU cluster. The math keeps pointing to the same conclusion: scale-out only makes sense when scale-in has topped out. It’s not about CUDA cores. It’s not about tensor throughput. It’s about tail latency. NVLink keeps GPU-to-GPU communication on-package or over short copper links — no NIC, no PCIe host traversal, no protocol stack. For small messages, that means sub-microsecond latency in the hundreds-of-nanoseconds range. InfiniBand NDR switches add sub-microsecond port-to-port latency, but once you include the full path — PCIe to the NIC, driver overhead, fabric hops, and back — real-world GPU-to-GPU latency across nodes often lands in the 3-10μs range depending on message size and topology. ...