They're going to freeze the whole data center? It's rack after rack of machines that the traffic could have passed through, right? And if they're not logging IPs to RAM then they only have a fraction of a second to get the right one before the register is overwritten with the next user's info.
You do need to know where to send the user's return traffic, so you'll need a table ultimately comprising mappings of network flows to end-user addresses. Of course, once the flows close you don't need to retain this information. In practice, you'll also need information about all currently-open VPN sessions.
If the feds have physical access and considering the high likelihood that these are VMs and not physical, it would be a whole lot easier to get the hypervisor to just snapshot the VM w/ its memory and perform forensics against that file(s).
I was pretty confused by the index performance when getting ~50% of the table.
I think what's happening is that since the tuples in the medium table are larger, less are stored on each page. Just looking at the sizes of the tables:
medium: 977 MB
Large: 25 MB
we can assume that the medium query had to access 39.08 ( 977 / 25 ) * more pages.
medium time: 3198.539
large time: 85.74
3198.539 / 85.74 = 37 which seems to track.
What was confusing me is that I thought that the io would take longer for the large text objects because there's more of it. I think that the reason why this isn't the case is because TOAST is probably optimised to make fewer calls to io, but they tend to be much larger. it's not necessarily the size of the data, but rather how many syscalls you have to make to request the data.
pretty unsure about this, but it seems to make sense now.
if LLM's improve your productivity, you'll be more likely to start your own startup. Why let your employer reap the benefits of your improved productivity?
Optimistically, no one would need to work as an SWE, since they could bootstrap companies at the speed of light.
