11 ms·
Website hosted on a 24 year old Linux server
- ashleyn 4y agoSurely hope that isn't running a 24-year old Linux distribution...
- bombcar 4y agoIf it were, it could be any of these hot commodities: https://soft.lafibre.info/#year1999 https://soft.lafibre.info/#year1999
- jonas-w 4y agohttps://serialport.org/servers/cobalt/cobalt-raq-3/#specs https://serialport.org/servers/cobalt/cobalt-raq-3/#specs Originally it was 2.2
- Aachen 4y agoIs there actually a bug that's remotely exploitable in the TCP stack, if you drop everything besides bound tcp ports in iptables? Any time I see a customer using an ssh or apache version from ten years ago (different from the kernel, but the kernel doesn't give you version disclosure), the list of bugs is all like "if they use RewriteRule and the second URI parameter is echoed unfiltered into a Location header by the application code and it's on Windows then you can do something actually interesting. The standard services' standard feature set is annoyingly boring when outdated ... most of the time. Predictable sequence numbers would be my first worry, but with TLS and SSH being the main protocols of relevance, it doesn't really matter if you can send off-path traffic into a TCP connection.
- cpncrunch 4y agoI assumed myself there must be a lot of root privilege vulnerabilities in Apache, but it appears there isn't a single one: https://www.cvedetails.com/vulnerability-list.php?vendor_id=45&product_id=&version_id=&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=1&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=8&cvssscoremax=0&year=0&month=0&cweid=0&order=1&trc=4&sha=22e3045e0d29a1bc6cefc69a904bf508b1b3cb0b https://www.cvedetails.com/vulnerability-list.php?vendor_id=... All the above seem to be in other Apache products. I think the fact that Apache doesn't run as root helps to mitigate these risks. Having said that, I have had a server compromised (about 20 years ago), through apache, suexec and a vulnerable cgi script, so I think it's best to be paranoid about security. I don't even see suexec on my current ubuntu 20.04 server (I used to just delete it).
- Aachen 4y agoDon't get me wrong, I don't mean to recommend running ancient software and not caring about security! It was rather out of curiosity: for the past 20-something years, which is no guarantee for the future (especially with software getting more complex than ever), would there be a blanket issue if you follow best practices in general (like dropping ports in iptables if you don't need them), or is it only specific circumstances like if you use a found-to-be-vulnerable function like for filename sanitisation? I don't know of any blanket linux/apache compromises off the top of my head, but there very well might be some.
- cpncrunch 4y agoFrom my perspective, there seems to be a lot more vulnerabilities found today than 20 years ago, so I don't think it's wise to have an unpatched 24 year old kernel or web server.
- minsight 4y agoI had one of these for my first dedicated server. I kept up with the vendor's updates but it still was compromised. So I hope it wasn't running a 24-year old Linux distribution 24 years ago.
- seba_dos1 4y agoExcept it's not, not really - it's hosted by Cloudflare which even requires you to enable JavaScript to pass.
- bombcar 4y agoThe server may be 24 years old and serving pages, but it's only serving them to the Cloudflare cache, which is kinda meh.
- ladberg 4y agoIt's not, Cloudflare is just being used for rate limiting / ddos protection here.
- Aachen 4y agoNever needed that on my server that's now also a decade old laptop. At least, not for the kind of attention HN#1 gets you (perhaps r/all #1 would be different). I can also imagine it being useful if you run a site that attracts controversy, or if your livelihood depends on it but you're not big enough to have your own datacenter and people want to extort that. Neither is really the case for me, I guess people don't put enough crap on my unfiltered file upload service for me to need big brother protection
- ladberg 4y agoI think it's a reasonably good precaution to take with a 24 year old server. I'd imagine on hardware that old you could easily get DOSed by a single mean client (or a web scraper bot with bad behavior), so a ddos isn't even needed. Also this is available on Cloudflare's free plan so it's much safer to take the precaution in case you might need it down the line, rather than get taken down and have to fiddle with setting up Cloudflare on the spot.
- Aachen 4y agoYou can also kill my server with a single client. Nobody has for the ~15 years that I've hosted on old laptops now. I've run game servers, a wiki mirror, file upload sites, a Tor exit node, torrent seeding, recently a VM image for a malware analysis course, all sorts of random tools and scripts, you name it; various different audiences but most with some technical know-how, yet nobody has felt the need. People have messed with things and found bugs (so far always reported more-or-less ethically), and lots of scanners go across the Internet daily, but I've never seen a deliberate take-down effort. (Kind of wondering whether I'm calling that upon myself now, but so be it. Let's see what happens.) This fear of having to react to a DoS attack by knocking on big brother's door and thus preemptively knocking, it's so anti self hosting mentality, but is also pervasive throughout the self hosting community, I really don't understand it.
- ajsnigrutin 4y ago24 years is not actually THAT old... The cpu (AMD K6-2 300 MHz) is a lot faster than a raspberry pi 1 for many things, it has 512mb of ram, so for running a simple webpage, it should still work good enough. edit: especially with cloudflare infront of it...
- jaclaz 4y agoYes, around that time (circa 1999) there was the matchbox web server ar Stanford with much lower capabilities (as hardware): https://web.archive.org/web/19991128033948/http://wearables.stanford.edu:80/hardware.html https://web.archive.org/web/19991128033948/http://wearables.... >The Matchbox Webserver, which is serving this and the other web pages to you, is a single-board AMD 486-SX computer with a 66 MHz CPU, 16 MB RAM, and 16 MB flash ROM, big enough to hold a useful amount of RedHat 5.2 Linux including the HTTP daemon that runs the web server.
- squarefoot 4y agoThanks for posting this, I thought it was long gone and forgotten. That server at one time was kept live on the Internet, and I showed that back in the day during a talk to demonstrate Linux capabilities. The page however says it was created in 1999, while I seem to recall it was about one year before, but the server is that one without doubt: I could never forget that photo showing it side by side with the matchbox.
- jaclaz 4y agoYes, first version was 1998, and was upgraded in 1999: https://aruntechgeek.wordpress.com/2008/08/30/worlds-smallest-webserver-matchbox-size-server/ https://aruntechgeek.wordpress.com/2008/08/30/worlds-smalles... AFAICR it stayed online several years. It is to be noted how the project belonged to the "wearable" laboratory/section. The related paper (it is a postcript inside a .gz archive) is still available: http://boole.stanford.edu/iswc.ps.gz http://boole.stanford.edu/iswc.ps.gz here it is in .pdf format: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.18.4077&rep=rep1&type=pdf https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.18... In 2000 Sergei Brin used it in a talk as an example of what could be done with mobile devices: https://www.wired.com/2014/05/brin-mobile-2000/ https://www.wired.com/2014/05/brin-mobile-2000/
- sillysaurusx 4y agoI remember how magical and mysterious a view counter used to feel when I was a kid. How did the website know when someone visited it? Where was the count stored? And how on earth could a website update its own HTML to show the new count? Geocities days were magical. I wonder if kids today have similar thoughts about Twitter profiles and such. It’s probably much easier to pick up the knowledge — back then, it was balkanized across IRC and whatever we used before Google. I also started writing a FF7 walkthrough all on a single page, because I didn’t know how to link from one page to another. I made the different chapters different font colors, reasoning that it was good enough to change the color when you’re trying to figure out which section to get to. Good times… EDIT: Whoa. The view count is real time. You can see how quickly HN is hammering the page by refreshing it. The guestbook works too. I wonder what the tech stack looks like. Doing this in modern times would be so complicated. You’ll need a database, then software to talk to the database, and maybe webpack.
- zitterbewegung 4y agoGeocities got reincarnated as https://glitch.com/ https://glitch.com/ and it has many more features and you can clone others sites or starter packs.
- seba_dos1 4y ago> Doing this in modern times would be so complicated. No, it wouldn't. All you need to store this kind of data is a simple file. Most people would probably use PHP for something like that due to its ubiquity, but it could even be a few lines of bash, or Python, or Go, or whatever...
- tristor 4y agoOh man, this brought back memories. I used to work on Cobalt web servers, I had a stack of them at home after they eventually ended up decommissioned and these were the basis (along with some Sun pizza boxes) for most of my home lab projects for many years.
- deleted 4y ago[deleted]
- jrnichols 4y agosame here. I had a raq3 for a little while and a Cobalt Qube (2? I think? it was a MIPS unit) and they were a lot of fun. I was sad when Sun bought up Cobalt, though. the units were discontinued soon after.
- jamesgill 4y ago* Guestbook: check * Animated gif: check * View counter: check * Repeating background image: check * Mobile? What's that? : check Those were the days.
- alperars 4y agoYou've missed "some text chasing the mouse pointer". I wouldn't think a webpage without it.
- deleted 4y ago[deleted]
- phist_mcgee 4y ago* Asking to bookmark because search engines weren't great ("We recommend that you bookmark this site so that it is easy to access in the future.") check
- justsomehnguy 4y ago* Under construction animated GIF: CHECK
- amrb 4y agoThis is a great video covering the story on the company, who build this server and an early example of using Linux for web hosting! https://www.youtube.com/watch?v=PJ6AvtV3Ya4 https://www.youtube.com/watch?v=PJ6AvtV3Ya4
- serialport 4y agoThanks for mentioning, that is our video and this raq talked about here is one we restored :)
- LinuxBender 4y agoI remember the Cobalt Cube. It was used for one of the first public demonstrations of SELinux released by the NSA. They gave everyone on the internet root that was under a restrictive MLS policy. That little machine handled a large number of people ssh'ing into it none of whom believed they were really logged in as root. I regret never buying one of those little servers.
- tablespoon 4y ago> Website hosted on a 24 year old Linux server Isn't that kind of mundane? The web was well-established by 1999, and the hardware of that era was literally designed and built to serve websites like this.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- jarebear6expepj 4y agoWhen the '24 year old Linux server' is asking me to solve captchas for cloudflare...
- serialport 4y agoYeah its a shame and wasn't our intended way to get this out to the world.. unfortunately in modern times, botnets and script kiddies had other plans and this server was on the receiving end of a lot of crap after the last Youtube video where we announced it being online.
- bennyp101 4y agoAh man, I always wanted a Cobalt RaQ server - they looked so cool! I seem to remember people reselling access to them and they had web guis that looked like them as well, I think a friend had one
- contingencies 4y agoSo many comments and none about RaQ, really. The Cobalt RaQ was one in a series of Cobalt 'server appliances'. These appliances were and remain unique largely because of their design, including (1) Industrial design incorporating round moulded transparent blue plastic elements and an LCD/button basic network config and status system. (2) Hardware design which initially (for RaQ v1 + RaQ v2 + Qube v1 + Qube v2) was based upon MIPS processors, a rarity in commercial Linux products. This server is unfortunately a RaQ v3, so AMD K6 (intel) based rather than MIPS. (3) Software design, which incorporated a complex (IIRC perl v5 based) software module upload function which allowed for commercial sale of new software packages easily installed on the devices with web configuration. One of my first jobs circa 2000 was writing a VPN module for the Cobalt devices in perl v5 which was sold by an Australian company. I gave away my hardware years ago.
- serialport 4y agoHey, site admin here. The server got overloaded! we'll try to reboot it and bring it back bash# w sh: fork: Resource temporarily unavailable
- leke 4y agoYep, looks like we finally killed it.
- sroussey 4y agoI used to run servers for a decade or more. Biggest fears: 1) fan on motherboard going out, 2) rebooting, if it hadn’t for years as I didn’t trust the startup disk.
- johnklos 4y agoIcon for raq.serialport.orgraq.serialport.org Checking if the site connection is secure raq.serialport.org needs to review the security of your connection before proceeding. Why am I seeing this page? Cloudflare's bullshit strikes again! Here's a real server, hosting without a caching proxy, that's 30 years old: http://elsie.zia.io/ http://elsie.zia.io/
- cellularmitosis 4y ago> CPU: AMD K6-2 300 MHz Ah, I was hoping this was a MIPS model