druiid

32 ms·

271.
by druiid 14y ago
Well, I'm not sure if I'd suggest looking at mod_security in a 'straightforward' manner particularly. Doing so will likely get you frustrated with the interaction you are likely to have with any default rule-set. A good way to look at it is
272.
by druiid 14y ago
I would say that is incorrect. A well versed attacker is going to have absolutely no issue finding your 'new' SSH port. Why do you think this is a security measure? As for shared keys... they also have their drawbacks. Someone can forget th
273.
by druiid 14y ago
Careful with setting ro on shm. There are certain things (for instance LXC, which someone mentioned perhaps having a setup guide for), which require access to shm. Actually, thinking about it more (and others have commented on it already)..
274.
by druiid 14y ago
Interesting article. I'm wondering, so all apps route through a single collection of load balancers, or are they per-app? Seems to me like a possibility to cut down on config turnover requirements if you were still using a stock nginx confi
275.
by druiid 14y ago
Here or in an article? We use both in our infrastructure. Generally I would say that if you're proxying web connections and need caching or the ability to do lots of complicated rewriting on the proxy side, use nginx. If you're proxying dat
276.
by druiid 14y ago
In puppet it's pretty easy as well. The puppet module modification I made to puppet-nginx allows you to do resource collection for a group of upstream servers (and thus add to a group of upstream locations transparently).
277.
by druiid 14y ago
That is what puppet or a similar configuration management solution is for (or doing it by hand I suppose). There's not really a realistic scenario I can think of where you'd be wanting a built-in nginx function to service this requirement.
278.
by druiid 14y ago
Incorrect: https://github.com/blog/493-github-is-moving-to-rackspace
279.
by druiid 14y ago
CDN's are not magic, neither are proxy services. Cloudflare is a proxy service which is able to do the following things for you: Distribute load around the world, when if you're not a massively large site like Facebook you will only have on
280.
by druiid 14y ago
Interesting, didn't know that! How do the multi-core abilities of PF compare to how Linux handles iptables (interrupt handling, which multi-core depends on your kernel supporting it)?
281.
by druiid 14y ago
Well generally you're going to be putting multicast traffic on a default subnet of something like 224.0.0.0/4. It's pretty easy to filter that out using iptables as well. I know for keepalived, you're generally only sending out notification
282.
by druiid 14y ago
This is both load balancing and a redundant load balancer. Traffic goes to all the backend web-servers under this scenario, through a single load-balancer device/server. If that device goes down the secondary takes over. While if you have m
283.
by druiid 14y ago
Well pfsync is only for freebsd pf. If you use linux instead then you'll be using iptables + conntrackd. They're both powerful systems with a different way of thinking about the idea of packet filtering and mangling!
284.
by druiid 14y ago
Carp/ucarp are pretty fun. Additionally keepalived in linux implements vrrp and some additional nice features such as scripting what to do on failover of resources. An addendum to this guide might be to add in connection tracking across the
285.
by druiid 14y ago
Their engineer answered earlier in the thread. It was more along the lines of they had a small team and needed to scale up quickly (which I think is probably most of these EC2 stories you see, really). He also said that now their engineerin
286.
by druiid 14y ago
Indeed, but what I was mostly getting at is that you have another possible attack vector if your run your own DNS, while services that provide it for you are basically pennies on the dollar compared to potential losses.
287.
by druiid 14y ago
There's several existing MySQL management solutions for powerDNS, including: https://www.poweradmin.org/trac/ https://github.com/averna-syd/PowerdnsTango PowerDNS Tango is the prettiest looking one.
288.
by druiid 14y ago
For many many years we ran our own DNS servers using PowerDNS with MySQL backends. That's all fine and well and it's a very powerful architecture and relatively reliable and strong to even high amounts of traffic... that was until we starte
289.
by druiid 14y ago
I just realized actually one very likely reason you would see a significant increase like this. I imagine that the GoogleBot and Pagespeed servers are on the same network, or at least regionally close enough to make a big difference. Cloudf
290.
by druiid 14y ago
Hard for me to say what happens for 'free' accounts. We only use pro or higher (A good number higher than pro). I would say not counting the additional performance features you get at the pro level, if they're purposefully slowing things do
291.
by druiid 14y ago
Ah, interesting. Thanks for noting this. Something I'll keep in mind if we ever look at the PageSpeed service. I'm actually not certain if Cloudflare is doing something similar for pages with no headers set.
292.
by druiid 14y ago
Sorry, not about to reveal realistic traffic counts (also this is getting off-topic)... but I will say that we generally push somewhere around 120-160Mbit/s.
293.
by druiid 14y ago
I imagine that would be correct, yeah. If you don't specify to cache something, it shouldn't be cached. If a proxy out there still caches it, I'd consider it broken.
294.
by druiid 14y ago
Sure. There are at least a couple ways I've seen that it can be triggered (and if one of the Cloudflare guys on HN is around they might have more or correct me if I'm wrong). The first seems to be that if a page is experiencing slow loading
295.
by druiid 14y ago
A couple things here I'd say. The first is that you have to be careful with the 'live' page stuff on Cloudflare and blaming it directly on Cloudflare. I can't know the exact circumstances that lead you to see the error, but in our experienc
296.
by druiid 14y ago
No offense, as I know little about your website, but you're one site out of thousands/tens of thousands on Cloudflare at this point. Your results without substantial research and supporting evidence of this being a trending problem with oth
297.
by druiid 14y ago
Yeah, what's with this 'Cloudflare is terrible and will make your pages slower !!11!!' stuff around HN lately? I pass at least a few million req/day through their service and only every once in a good while are there hiccups.
298.
by druiid 14y ago
MySQL cluster is another option beyond MySQL Galera (and Cluster actually has a NoSQL layer on top of it.. FYI)... but I have to say if we want to talk about scaling issues for MongoDB, you might not be happy with some of the limitations of
299.
by druiid 14y ago
Thanks, all good points. I'm curious on the index sorting though, do you mean in terms of specifying what to sort on, or that you can't sort at all? As far as I understood the new indexing capabilities allow at the very least to sort on num
300.
by druiid 14y ago
I would say that (and I suppose this is a bit of a weasel words style answer) each is going to have their benefits and drawbacks and they would have to investigate each for their particular use-case to determine which would best work for th

More ›