5 ms·

I ran a website with 37 million users and 3.6Gbps peak bandwidth (JavaScript+thumbnails, no video) from my own two racks of Linux servers thay i have not system

by cft 4y ago

I ran a website with 37 million users and 3.6Gbps peak bandwidth (JavaScript+thumbnails, no video) from my own two racks of Linux servers thay i have not systematically updated for years. The OSes were beyond the lts support winows. I manually compiled my own updates, but very rarely and only those that i deemed critical. Granted, the site stack was completely custom so the standard automated hacks didn't work. In 15 years there were no accidents.

booi 4y ago
I dont think this should be standard. It sounds like you’re saying you ran a service with 37 million people’s information on a software stack that was so old that not even the vendor is supporting it anymore and could be riddled with security issues that you wouldn’t even know much less be able to detect? It may work but certainly not going to get any security certifications this way..
- cft 4y ago
  I hardly stored any PII. Also, this was a high profile site that you know: if it was hacked, they would probably try to deny access and extort: it would make a lot of monetary sense. We would also have lost our merchant accounts very quickly (although CC numbers were not stored, only MD5s, but i suppose they could have been captured from the application's memory after TLS decryption but before MD5 hashing, although this would have been a difficult task even on a rooted server). I am 99.999% confident by observing and recording loads, traffic, logs and other parameters of all servers that there were no intrusions. I understand that there's market size and appeal for bureaucracy and certifications, but i have my own data.
  - Fnoord 4y ago
    Do you save logs? If yes, there's your PII.
    - cft 4y ago
      Thankfully, the servers were not in Europe! I said "hardly". It's genuinely amusing how people downvote facts, simply because they don't fit the zeitgeist.
      - Fnoord 4y ago
        Nobody mentioned Europe, except you. If you are referring to GDPR this still applies if you host outside of Europe. We disagree webserver logs contain 'hardly any PII'. You may find it insignificant PII, but it does not constitute 'hardly'. IMO its a circumstantial goldmine.
        cft 4y ago
        In the US at least one court found that IPs were not PII https://www.huntonprivacyblog.com/2009/07/10/washington-court-rules-that-ip-addresses-are-not-personally-identifiable-information/ https://www.huntonprivacyblog.com/2009/07/10/washington-cour... I am curious who "we" are- a royal plural?
        Fnoord 4y ago
        And in EU, it is. We referred to you and me.
  - krallja 4y ago
    MD5(CC#) is trivially reversed, so I hope that’s not what you were doing.
    - booi 4y ago
      Omg. cft should not be allowed anywhere near credit card numbers.
- TurningCanadian 4y ago
  Not to mention that a successful compromise could be used to serve malware to the users.
Fnoord 4y ago
With unattended-upgrades you might get away with such behavior. Also, spme webservers have a great track record. Then its the question if your other services are secure, and your JS/CSS.
- cft 4y ago
  Nginx and apache (upgraded from 2.2 to 2.4 once)

by cft 4y ago

booi 4y ago

I dont think this should be standard. It sounds like you’re saying you ran a service with 37 million people’s information on a software stack that was so old that not even the vendor is supporting it anymore and could be riddled with security issues that you wouldn’t even know much less be able to detect? It may work but certainly not going to get any security certifications this way..

cft 4y ago
I hardly stored any PII. Also, this was a high profile site that you know: if it was hacked, they would probably try to deny access and extort: it would make a lot of monetary sense. We would also have lost our merchant accounts very quickly (although CC numbers were not stored, only MD5s, but i suppose they could have been captured from the application's memory after TLS decryption but before MD5 hashing, although this would have been a difficult task even on a rooted server). I am 99.999% confident by observing and recording loads, traffic, logs and other parameters of all servers that there were no intrusions. I understand that there's market size and appeal for bureaucracy and certifications, but i have my own data.
- Fnoord 4y ago
  Do you save logs? If yes, there's your PII.
  - cft 4y ago
    Thankfully, the servers were not in Europe! I said "hardly". It's genuinely amusing how people downvote facts, simply because they don't fit the zeitgeist.
    - Fnoord 4y ago
      Nobody mentioned Europe, except you. If you are referring to GDPR this still applies if you host outside of Europe. We disagree webserver logs contain 'hardly any PII'. You may find it insignificant PII, but it does not constitute 'hardly'. IMO its a circumstantial goldmine.
      - cft 4y ago
        In the US at least one court found that IPs were not PII https://www.huntonprivacyblog.com/2009/07/10/washington-court-rules-that-ip-addresses-are-not-personally-identifiable-information/ https://www.huntonprivacyblog.com/2009/07/10/washington-cour... I am curious who "we" are- a royal plural?
        Fnoord 4y ago
        And in EU, it is. We referred to you and me.
- krallja 4y ago
  MD5(CC#) is trivially reversed, so I hope that’s not what you were doing.
  - booi 4y ago
    Omg. cft should not be allowed anywhere near credit card numbers.
TurningCanadian 4y ago
Not to mention that a successful compromise could be used to serve malware to the users.

Fnoord 4y ago

With unattended-upgrades you might get away with such behavior. Also, spme webservers have a great track record. Then its the question if your other services are secure, and your JS/CSS.

cft 4y ago
Nginx and apache (upgraded from 2.2 to 2.4 once)