4 ms·

I used to be a contractor and worked on a web application distributed across multiple web servers. We needed a state server at the time to hold some cached inf

by kemiller2002 8y ago

I used to be a contractor and worked on a web application distributed across multiple web servers. We needed a state server at the time to hold some cached information and share it among the servers. Now there was a rule that said a web server was not directly allowed to communicate with the database. Okay I get it, that makes sense. The state server we were going to use to store some application metadata had the word "database" in the product name. For that reason alone we got flat out rejected. I said to them, "So it's OK to store all the stuff we need in memory and on the file system on the servers, just not stored in the state server." Their response was, "Yes, because it's not in a database." We finally switched to another product that did not have the word database in the name, and they were completely fine with it.

lowercased 8y ago
I'm having to switch CentOS servers over to RHEL servers because... support(?) Some state work got in trouble a few years back because they'd updated guidelines that no applications could be on the same machine as a database server. Enforced separation, for security. Having enough staff and management to distribute that message to people dealing with the apps and servers didn't seem to be a requirement, however. And... when I was given this mandate, I had to ask for another server, then told there weren't any available, and I'd have to wait for several weeks, and I probably should shut down the current service (which had run for 3 years this way, well before the guidelines were in place). Navigating govt IT stuff is crazy. About half the people I've encountered are between competent and really talented, and the other half don't understand the basics. FWIW, if the web server can't communicate 'directly' with a database... what process do you use to communicate between them? Some sort of proxy? Or something else?
- GlenTheMachine 8y ago
  There's an infamous story at my shop. Twenty-some years ago, we used a software tool that was an important part of our mission, and it only ran on Silicon Graphics boxes. We needed to buy a new SGI machine, and SGI had started shipping all of their machines with built in monitor cameras, the first company to do so. Digital cameras were at that time strictly prohibited from even being on the premises. So my friend goes ahead and buys the machine he needs, on the assumption that if he doesn't everybody is out of a job, and he can always disable the camera. The machine arrives, he sets it up, and calls security asking for whatever official process they use for disabling webcams. Epoxying over the lens or something, was what he figured. At first they are very confused. It's like they can't parse the words he is telling them. It's as if he was trying to tell them there were six legged iguanas with Russian flag patches on their backs running around the server room. So he finally gets them to acknowledge that he is, in fact, speaking English in sentences that adhere to the rules of grammar, at which point they have to take his question seriously. So they ask: “did you procure these computers through <our base's> government procurement office.” To which he says, yes, of course, there's no other way to do it. They think for a minute and reply: “by policy, you cannot purchase a digital camera through the procurement office. Therefore, your computers do not have digital cameras in them.”
  - throwawayjava 8y ago
    > They think for a minute and reply: “by policy, you cannot purchase a digital camera through the procurement office. Therefore, your computers do not have digital cameras in them.” They were being intentionally daft. The person who told him that almost certainly did so with a wink and a nod, and saved your protagonist a lot of pain.
    - azernik 8y ago
      And probably were shocked at getting the call for a very smart reason - this is a classic kitbag question.
- kemiller2002 8y ago
  The web server had to communicate through an application server. It wasn't a huge deal, until we got into the discussion about what a database meant to them. That was painful.
  - lowercased 8y ago
    still having trouble parsing that (not trying to be dumb here, really!) in java, my java app might talk to a connection pool, which then talks the the database. that connection pool could, I'd guess, be in a separate 'application server', no? my 'database and app server separation' thing - never quite got a straight answer on 'why', other than 'security'. except... adding more systems, with more logins, more access rules, more stuff to update/patch/test leads to... more potential for security failure (in my experience).

lowercased 8y ago

I'm having to switch CentOS servers over to RHEL servers because... support(?) Some state work got in trouble a few years back because they'd updated guidelines that no applications could be on the same machine as a database server. Enforced separation, for security. Having enough staff and management to distribute that message to people dealing with the apps and servers didn't seem to be a requirement, however. And... when I was given this mandate, I had to ask for another server, then told there weren't any available, and I'd have to wait for several weeks, and I probably should shut down the current service (which had run for 3 years this way, well before the guidelines were in place). Navigating govt IT stuff is crazy. About half the people I've encountered are between competent and really talented, and the other half don't understand the basics. FWIW, if the web server can't communicate 'directly' with a database... what process do you use to communicate between them? Some sort of proxy? Or something else?

GlenTheMachine 8y ago
There's an infamous story at my shop. Twenty-some years ago, we used a software tool that was an important part of our mission, and it only ran on Silicon Graphics boxes. We needed to buy a new SGI machine, and SGI had started shipping all of their machines with built in monitor cameras, the first company to do so. Digital cameras were at that time strictly prohibited from even being on the premises. So my friend goes ahead and buys the machine he needs, on the assumption that if he doesn't everybody is out of a job, and he can always disable the camera. The machine arrives, he sets it up, and calls security asking for whatever official process they use for disabling webcams. Epoxying over the lens or something, was what he figured. At first they are very confused. It's like they can't parse the words he is telling them. It's as if he was trying to tell them there were six legged iguanas with Russian flag patches on their backs running around the server room. So he finally gets them to acknowledge that he is, in fact, speaking English in sentences that adhere to the rules of grammar, at which point they have to take his question seriously. So they ask: “did you procure these computers through <our base's> government procurement office.” To which he says, yes, of course, there's no other way to do it. They think for a minute and reply: “by policy, you cannot purchase a digital camera through the procurement office. Therefore, your computers do not have digital cameras in them.”
- throwawayjava 8y ago
  > They think for a minute and reply: “by policy, you cannot purchase a digital camera through the procurement office. Therefore, your computers do not have digital cameras in them.” They were being intentionally daft. The person who told him that almost certainly did so with a wink and a nod, and saved your protagonist a lot of pain.
  - azernik 8y ago
    And probably were shocked at getting the call for a very smart reason - this is a classic kitbag question.
kemiller2002 8y ago
The web server had to communicate through an application server. It wasn't a huge deal, until we got into the discussion about what a database meant to them. That was painful.
- lowercased 8y ago
  still having trouble parsing that (not trying to be dumb here, really!) in java, my java app might talk to a connection pool, which then talks the the database. that connection pool could, I'd guess, be in a separate 'application server', no? my 'database and app server separation' thing - never quite got a straight answer on 'why', other than 'security'. except... adding more systems, with more logins, more access rules, more stuff to update/patch/test leads to... more potential for security failure (in my experience).