wtarreau

12 ms·

61.
by wtarreau 4y ago
Actually that what I've been saying for years until users complained that processes had different vision of server states in fast changing environments, that it was not possible to perform dynamic updates at runtime because all of them
62.
by wtarreau 4y ago
Horrible locking. 95% CPU spent in spinlocks. We're still doing measurements that we'll report with all data shortly. Anyway many of them were already collected by the project; there are so many that they created a meta-issue to l
63.
by wtarreau 4y ago
Indeed, we've done 100Gbps about a year ago on a 8-core machine. Usually the only reason to use many cores is SSL, but since OpenSSL 3.0 that totally collapses under load, even then you're forced to significantly lower the number
64.
by wtarreau 4y ago
Or the cache :-) (also "return" directives but that doesn't count).
65.
by wtarreau 4y ago
I definitely agree. If you need the best load balancer, take haproxy. If you need the best web server, take nginx. The two combined work amazingly well together, that's why they're very often found together :-)
66.
by wtarreau 4y ago
Hehe read till the end with the comments, especially the collapsed graphs! There were big mistakes in this test, failing on a large number of settings, and even the NGINX tests were not as good as they ought to be in some aspects. This cond
67.
by wtarreau 5y ago
> you're talking about ~2600 independent businesses across the world. Assuming you are able to determine the actual source of the traffic and work with a vendor to patch it, you're still tasked with somehow getting 2600 busines
68.
by wtarreau 5y ago
In any case, definitely ;-)
69.
by wtarreau 5y ago
I tend to agree but only partially. I'm doing myself a lot of init functions for plenty of stuff, but I've faced plenty of issues due to the fact that these functions do not always initialize everything (and your patch above does
70.
by wtarreau 5y ago
Your 3 points above are true but this is a perfect example where that didn't apply. A perfectly regular bug found by someone affected by this bug who then started to wonder whether or not it could lead to more interesting effect. Also,
71.
by wtarreau 5y ago
Not really. As you say there's an extremely difficult balance with opensource and not exposing everyone at once. You can't get a fix deployed everywhere without it being public first or it ends up in a total unfixable mess. But if
72.
by wtarreau 5y ago
You never know if it was already being exploited, but once thing is sure, once the patch gets merged, it's a race and only a matter of time before an exploit is written. Two weeks is already long and may leave distro users exposed, whi
73.
by wtarreau 5y ago
> The people writing the commit already know it's a security issue. For this special case, yes. But for the vast majority of bugs it's the opposite and existing bugs get exploited later, thanks to some people who think that som
74.
by wtarreau 5y ago
Then please just consider that every single stable kernel contains 1 or 2 fixes for similar vulnerabilities that nobody took the effort to try to exploit. THIS is the reality.
75.
by wtarreau 5y ago
> Linux does this to prevent people from learning that the vulnerability exists No, not at all, just to leave time to users to deploy the fix before everyone jumps on exploits. This is important because every single backported patch is
76.
by wtarreau 5y ago
I don't know what you don't understand: EVERY single kernel fixes a few vulnerabilities. If you lazily refuse to update because none of those say "hint: there is a vulnerability here", then you are taking the deliberate
77.
by wtarreau 5y ago
In fact it will depend on the implementations. As you've found, the root cause of the problem is that H1 and H2 use different delimiting techniques for protocol elements. Some implementations need to transcode H2 into an internal repre
78.
by wtarreau 5y ago
Funny that you enumerated all the crap that I absolutely detest in slack. I think there are really two populations, those who should be considered definitely lost by having had their brain washed by UI vendors ruining user experience, and t
79.
by wtarreau 6y ago
False sharing has nothing to do with misaligned atomics. It's about having multiple CPUs actively use the same cache line. This is what happens when you try to make your data independent to remove locks, and you end up with extremely h
80.
by wtarreau 6y ago
This is actually what I often recommend and often encounter in field: haproxy for LB, varnish serving as a smart cache, and nginx for the applications+static file serving. All 3 components are free, combine extremely well because they'
81.
by wtarreau 7y ago
That's exatcly in order to blow in this fog that you want to install a layer7 load balancer designed with observability in mind. Seeing what's happening is critical when everything changes by itself under your feed. With a compone
82.
by wtarreau 7y ago
You can try Pascal. I switched from BASIC to Pascal 30 years ago then to C 5 years later. And even though C has been my everyday language for 2.5 decades for all my projects, Pascal was still the one that provided me the most natural mental
83.
by wtarreau 7y ago
It was already the default in 2.0 unless you explicitly disabled it, so 2.1 should not be a surprise :-)
84.
by wtarreau 7y ago
Yes it's exactly this. It's in fact a byproduct of the rings implemented for the trace subsystem making it trivial to log there, which turns out to be extremely convenient for embedded systems or inside containers even if logs are
85.
by wtarreau 7y ago
It's also how I used to code under DOS (except using int 20h to exit and save 3 bytes, plus not copying CS into DS since .com has both equal). But my point precisely is that in order to provide such small binaries, you have to 1) have
86.
by wtarreau 7y ago
segment registers were a cheap MMU before its age. It was the only way to run code without relocation tables at various addresses. Mind you that at this era the whole operating system fitted in 40kB of RAM! My old turbo-pascal 3.0 editor+co
87.
by wtarreau 7y ago
Thumb2 was good. The main issue with AArch64 is that they dropped the variable instruction length. As such all instructions are huge and this significantly slows down code, especially after a mispredicted branch. I'm observing on avera
88.
by wtarreau 7y ago
And to add to this, a few of us at haproxy are part of the UDPA-WG (universal data plane API working group) with Envoy people to help figure how to define a universal/portable data plane API which would work across multiple load balanc
89.
by wtarreau 7y ago
I don't know as I have no use for it. Just check the article, it presents some of the things done with the ingress controller, it should answer some of your questions I guess.
90.
by wtarreau 7y ago
Oh yes absolutely! For example last time I checked libmusl, you didn't need -lrt, -ldl, -lcrypt nor a few others which I forgot about. It just provides empty stubs for those so that you can use the same build options as you regularly u

More ›