donavanm

69 ms·

751.
by donavanm 14y ago
You seem to be using CloudFlare and CloudFront interchangeably. From context I think your talking about the "free cdn startup", not the AWS service. Could you edit for clarity?
752.
by donavanm 14y ago
That's not how it works. EC2 can't log in to your virts. S3 can't (trivially) read your unencrypted bits, and they certainly can't get to your ec2 dom0. Everything is pretty well firewalled. There's no back door access. If service A uses se
753.
by donavanm 14y ago
Assuming its just data at rest? Use gpg. Encrypt your plaintext with all of the authorized users public keys. When someone joins few crypt with the new persons key. When they leave rotate creds and rencrypt minus their key. Keep the cipher
754.
by donavanm 14y ago
DCs have been constrained on power and cooling for the last decade or so. Existing colo sites are most likely to have 5kva (4kw) rack positions. That's only 90 watts/ru. Newer facilities will have 10kva racks. Minus a couple ru for cabling
755.
by donavanm 14y ago
Yeah, that's a bit confusing. Using Cloudfront with an S3 bucket is double billed, the first time. On a cache miss Cloudfront pulls the object from S3 and serves it to the client. S3 bills the regular data transfer out. Cloudfront then bill
756.
by donavanm 14y ago
Your average podcast source material may be 40mb. Clients will most assuredly not be fetching that all in single request. Your state transfer overhead is per request. The 50kb estimate is an educated guess at the average size of an http res
757.
by donavanm 14y ago
Server side state per client is insane. Pushing it client side would be what, a kb? Wih an average object size of 50kb that's 2%. I doubt CDN customers would be willing to take a 2% cost hit for this feature. Now, assume we solve all that.
758.
by donavanm 14y ago
"I moved everything off of CloudFront for my users to triage the cost." Can you explain more? Was there some cloudfront behavior exacerbating the issue? AFAIK this is just a client (mis)using range requests and CloudFront replying as reques
759.
by donavanm 14y ago
" I've never used multicasting in a real-world application but will be keeping my eyes open for an opportunity ". Don't. Seriously, just don't do it. I personally know of outages directly attributed to multicast that have cost more than you
760.
by donavanm 14y ago
This is interesting. How er the true cost of inter service discovery is in maintenance. Adding a new service is trivial. Deprecating a service, or an API major rev, is a PITA. Eventually you just end up with an unmaintainable morass of "dep
761.
by donavanm 14y ago
If you really want AXFR check out Route53d http://code.google.com/p/route53d/ . Acts as an AXFR to route53 API proxy. The route 53 sample code also has import/export to bind zone file format.
762.
by donavanm 14y ago
Except for this event. Where pretty much every DC in NY/NJ is compromised, yet no blips in us-east.
763.
by donavanm 14y ago
Please to be rereading my comment. It's addressed to anyone running a resolver/authoritative name server, not the attack target. I promise I'm well acquainted with spoofed DNS attacks.
764.
by donavanm 14y ago
Strongly disagree. Strict urpf is pretty much impossible to implement. The only plausible place to implement it is directly at the edge where a sinlge AS owns both sides of the link. Think DSLAM or other consumer agg device. Any connectio
765.
by donavanm 14y ago
A bit disappointed that the truncate bit wasn't mentioned. So, for the open resolver owners playing along at home: Instead of dropping suspect requests send the truncate bit back. There's no byte amplification in the response, which defeats
766.
by donavanm 14y ago
Get big fast. Amazon is still getting bigger, and accelerating the pace recently. The "low margin retailer" comments about AWS are funny too. AWS is effectively a billion dollar company, eligible for HUGE subsidies (from retail), under effe
767.
by donavanm 14y ago
Dude, as an internal team trying to get OSX Server support was a joke. The answer was never anything other than crickets or "next major rev, maybe."
768.
by donavanm 14y ago
I ask "How many customers asked you for a network block device" but I don't know what EBS or a "raw device" is? So yes, I'm well aware that "compatibility" is the general reasoning for building a block device interface. But how many unique
769.
by donavanm 14y ago
How many customers asked you for a network block device? I can't think of anyone who uses raw block devices these days. Qmail? Some db storage engines? I'd posit that what most consumers actually want is a persistent filesystem. Clear consi
770.
by donavanm 14y ago
I'd agree that packet loss is generally zero. But dirty fiber, bad ports, bad device, congestion, etc are pretty dang frequent in a large deployment. And those "edge cases" are the ones that are going to kill your poor network block iops.
771.
by donavanm 14y ago
Network and disk io vary in other characteristics. The most obvious being the block vs packet size. Lose a single packet and the block device has to ... Block.
772.
by donavanm 14y ago
Us-west-2 is about the same cost as us-east these days. And latency is only ~10ms more than us-west-1. I'm puzzled that people aren't flocking to us-west-2. I can't the last time there was an outage there either.
773.
by donavanm 14y ago
From what I've seen it's usually a rational business or policy decision. And your adversaries are in, or acting through, states with a weak rule of law. "Exposing" these actors is impossible/useless until you address that.
774.
by donavanm 14y ago
DDOSs are typically defeated through buying lots and lots of transit. That's an exercise in outspending your adversary. A small entity like github should be trivial to saturate.
775.
by donavanm 14y ago
Also razor from emc/puppet. IMO a large scale cobbler config takes a bunch of work to get right. the provisioning and host management space is just starting to catch on to APIs and SOA. You're going to spend lots of time rolling your own ap
776.
by donavanm 14y ago
Not more expensive, more difficult to source. IME - mid level sys admin/eng job code will get 10-20% less compensation than an SDE. A principle level SEs comp will also top out before an SDE. For junior or mid level SE I've seen about 10% o
777.
by donavanm 14y ago
Rough cost for transit from top providers: US $1-5 EU $5-20 AP $20-40 Africa/china/india/mid east/etc $$$$-go eff yourself Prices are from someone like L3, qwest, ntt, telephonica. Assuming youre buying 10s or 100s of gb. Don't forget to fa
778.
by donavanm 14y ago
Just the concept of using time for the logical clock is sketchy. It's not monotonically increasing, it drifts, it can go decrease, etc... Curious what their cross host/region ordering and consistency looks like.
779.
by donavanm 14y ago
After taxes, insurance, etc figure $65-70,000 net or "take home". Then you can invest up to $16,000 with deferred/sheltered taxes for 401k (private pension).
780.
by donavanm 14y ago
Hrm, maybe Im misrembering. Found akamai claiming 125Gb/s in '09, and some more arbor quotes of ~110Gb/s. I'll see if I still have the report Im thinking of tomorrow. http://wwwns.akamai.com/rsa_2011/RSA_NOCC_DDoS.pdf

More ›