colmmacc

52 ms·

451.
by colmmacc 13y ago
There is significant variance in population per timezone, and even more significant variance in internet-usage per time zone. Much of this variance is just demographic, but most of it is actually geographic. An interesting and convenient t
452.
by colmmacc 13y ago
That's a very tough call to make. Making changes at off-peak times makes some sense, especially if you think there's a likelihood of disruption. But if you're planning for the unexpected, it can be best to make changes when p
453.
by colmmacc 13y ago
There's no reason to think that running your own copy of DNSSEC + Unbound would have helped here. Firstly, Google don't have DNSSEC signed DNS data, which renders the feature moot. But even if google did, DNSSEC would have trigger
454.
by colmmacc 13y ago
I'll pass this on to the CloudFront team. CloudFront distributions are free, so would it be possible to use a different distribution for each hostname? Or is this more of a wildcard set up?
455.
by colmmacc 13y ago
We've opened up a little lately, and some of our DDOS mitigation details are now available in my colleague Nate's talk from Re:Invent: www.youtube.com/watch?v=V7vTPlV8P3U . What I can repeat from that talk is that we've
456.
by colmmacc 13y ago
CNAMEs are name-level aliases. So if for example I make the following query; name=www.example.com type=A and get a response of the form; www.example.com 3600 IN CNAME www.example.org a resolver will then recurse and lookup na
457.
by colmmacc 13y ago
Amazon Route 53's ALIAS implementation takes a different approach. We only allow ALIASes to data that we know about authoritatively; so with Route 53 you can ALIAS to an S3 website Bucket (which also lets you do HTTP redirects), a Clou
458.
by colmmacc 13y ago
It took me about 2 years, starting at age 25, to acquire perfect pitch. I didn't try the Vai trick, instead I ran an exercise at last once every few days that challenged me to name the note associated with a tone (out of all 12 equal-t
459.
by colmmacc 13y ago
That is nice! I couldn't resist the curiosity about the other operators, so I extended your code to include them all on one page for easy comparison; http://play.golang.org/p/O0F1FiAl6C mod looks super interesting
460.
by colmmacc 13y ago
Disclaimer: I work on Amazon Route 53 and Elastic Load Balancer. From the article ... "Unfortunately there are a large number of (misbehaving) DNS servers out there that don’t properly obey TTLs on records and will still serve up stale
461.
by colmmacc 13y ago
This mechanism is half way to a suggested scheme for domains that are less vulnerable to single-actor take-downs, posted here on HN a few days ago; https://news.ycombinator.com/item?id=6964090 . In short; instead of merely
462.
by colmmacc 13y ago
Disclaimer: I've been involved in several DNS implementations, for a long time, and so probably have a bias. Namecoin and namecoin-derived systems are cool, but they tend to overlook a lot of real-world functionality provided by DNS. A
463.
by colmmacc 13y ago
I while ago I took Adam Langley's and DJB's crit-bit code and put a CDB-compatible API around it, it's at; https://github.com/colmmacc/nutrient still a work in progress, but it made it considerably easie
464.
by colmmacc 13y ago
For something so pervasive, DNS is just too hard at times. Even the author, who is clearly in the 99th percentile plus for DNS knowledge, slips up on the depth. There's two small nits, besides the modern browser caching/pre-fetchi
465.
by colmmacc 13y ago
Full-disclosure: I'm an engineer at Amazon Web Services. "Mr. Hamilton later said privately that Amazon had developed original statistical methods to limit damage from catastrophic failures." I don't think it's what
466.
by colmmacc 13y ago
There is another technical angle; RC4 is usually quite a lot less CPU intensive than the alternatives available. Not using RC4 can easily mean stuttering video playback, greatly diminished battery life, and even lock ups. Very few users are
467.
by colmmacc 13y ago
There is some precedent for the NSA backdoors in commercial VPNs ... http://www.schneier.com/blog/archives/2008/01/nsa_backdoors_... Backdoors were found in the devices/software sold to many governm
468.
by colmmacc 13y ago
Some name servers include partial rrsets in truncated responses, some decide it's best to omit the entire rrset, some decide it's best to omit that entire section. All of those behaviors are valid (RFC2181 section 9 is about as de
469.
by colmmacc 13y ago
It would be cool, and it may be ok for certain kinds of playing, but a subtle mordent, a tasteful triplet or a good arpeggio all depend on feedback from the keys. I think this is more than muscle memory and that "simulating" the s
470.
by colmmacc 13y ago
Another very forgivable error is a mis-understanding about how recursive queries work. The article says "dig randomly picked one of the root server responses, in this case f.root-servers.net., and asked it for the next part of the doma
471.
by colmmacc 13y ago
It is simple, but it has mixed results. There's about 10% of the internet that's using "parent centric" DNS resolvers. What that means is that when it comes to what name-servers to query for a zone; those resolvers pay m
472.
by colmmacc 13y ago
I haven't read the bind source in a long time, but my best guess is that it's in memory. http://docstore.mik.ua/orelly/networking_2ndEd/dns/ch02_06.h... Has some details, and I believe Bind and Powe
473.
by colmmacc 13y ago
(I work on Route 53). We've done a lot of experiments on this one and we've found that the most common resolvers make 3 tries to 3 different servers by default. At first those servers are picked at random, but over time the resolv
474.
by colmmacc 13y ago
To your point ; it's ok to do both. Route 53 supports DNS TTLs as low as 0 seconds. ELB and S3 endpoints both have 60 second TTLs. My experience with flipping names like www.amazon.com doesn't reflect the 15% figure. I've see
475.
by colmmacc 13y ago
Almost all of the time what you see in CloudWatch should be representative of what's being served. The internet stays consistent to at least four nines. Our CloudWatch metrics are actually made up of 16 independent metrics reporters (2
476.
by colmmacc 13y ago
(I work on Route 53). As __lucas has mentioned, this can be achieved with Route 53 Failover, which we'd recommend. Route 53 Failover is (hopefully) pretty easy to configure. Just mark your ELB as the primary and enable target healthche
477.
by colmmacc 13y ago
I'd say that the advice is outdated, but I'll try my best to explain and you can decide. "Bailiwick" is the term used for the namespace a nameserver is considered authoritative for. If example.com is delegated to ns1.exa
478.
by colmmacc 13y ago
There are some things you can do to protect yourself against these kinds of problem. About 92% of DNS resolvers honour the TTL setting for the NS records from the leaf-node child-zones (e.g. the NS records you control as the owner of a doma
479.
by colmmacc 13y ago
There are two important steps; 1. Adding NS records to the parent zone via your registrar. E.g. if you are using example.com, when you add nameservers with your registrar they add them to the ".com" zone. 2. Update the NS records in your ow
480.
by colmmacc 13y ago
Route 53 is in 28 cities, however we have several datacenters in some cities (for example we have 3 in New York). Today there are 35 independent (own network, power, etc) Route 53 anycast endpoints.

More ›