Tag Info

Hot answers tagged

27

I think I might be in the minority on this (based on my limited experience dealing with IT departments at school and work), but I think mandatory, time-based password change policies are worthless at best, and harmful at worst. People tend to be very bad at choosing good passwords and keeping them secret. Password expiration policies are designed to mitigate ...


14

My large organization (15000+ users) implemented "password changes" every 120 days in the Fall of 2009. It's a huge IT headache and waste of support resources. Every time that 120 day window rolls around we have thousands of users forced to change their password....which many of them either do incorrectly and lock their account....or forget the next day. ...


10

No. My personal opinion is that it's unnecessary and even counter-productive. I ranted on my blog, but you can hunt that down if you're interested. In short, it comes down to two reasons: 1. Forcing a user to constantly change their password leads to bad passwords. There will be no shortage of anecdotal evidence on this, but it makes sense that if I'm ...


10

That's a very, very involved question that lots of smart people spend lots of time thinking about. That said, there are a few tried and true mechanisms you can introduce that will help with scalability. Ultimately, though, it boils down to your application and how it should specifically be scaled. For example, you would scale Oracle differently than you ...


7

curl --user admin:admin http://localhost:8080/manager/text/reload?path=/myapp Doc here: Manager App HOW-TO, Reload An Existing Application The manager-script role is required for the user as the documentation says: It would be quite unsafe to ship Tomcat with default settings that allowed anyone on the Internet to execute the Manager application on ...


6

Presuming that a 'web application' runs on a server (like apache, nginx, etc) and is written in some dynamic scripting language (like PHP, Ruby, etc), you have a misunderstanding in who the 'user' is. The user is not the person who is logged into your application - that, and their role in the application (admin, etc) is completely irrelevant to the ...


5

This should be straight forward to do. The IP address your server has, do you know if it is a static IP address? If it is static, simply update your domain's DNS record on GoDaddy (assuming you can do that) to point to your server (or more importantly your firewall's) IP address. If godaddy don't allow DNS updates then transfer your domain to a service ...


5

Amazon EC2 instances don't have a "spin-up" time. The culprit is likely your code or your server setup, not EC2. Reserved instances aren't any different than any other type of instance other than the payment details.


4

The only issue I'd see with using Google's outbound SMTP service is that it's limited to 500 emails/day. I'm not sure what volume of email you anticipate sending, but that may be an issue. One thing to think about, though, is that it's really quite easy to set up your own sending-only MTA. The painful part of roll-your-own email hosting usually is managing ...


4

Scheduling, scheduling, scheduling. It's an absolute must that whatever system you analyze, it has the ability to schedule startup/shutdowns. This will allow you to turn off all PCs and a given time, say 6PM. Then turn half of them back on at 1AM (every Monday) to get WSUS updates and run defrags, then turn them off at 3AM. Then turn the other half of ...


4

NAGIOS, using its check_http plugin, will do exactly what you describe above. Edit: with one caveat: when you say log in, if you mean "provide htaccess/htpassword credentials", NAGIOS can do this. If you mean "perform a multi-step procedure involving authenticating, getting an auth cookie, and passing it back when asking for the resource to monitor", ...


4

You can use WebPagetest or Pingdom's Full Page Test to do one-off testing for free. Pingdom also lets you do continuous testing for a fee. Edit An ad for Watchmouse showed up in the sidebar. They have a free site test and paid monitoring plans similar to Pingdom.


4

If you have multiple EC2 instances inside the same AWS availability zone (for example, us-east-1a), then traffic between them is not chargeable. So you can send data freely between your EC2 instances without worrying about your bill. If they are in different regions, or even different availability zones within the same region, then you will be charged for ...


4

ZeroMQ has been designed as an asynchronous transport/message protocol. If one of your nodes goes down, it will re-stablish the ZMQ-Socket and continue sending its messages when the route to the target endpoint comes back up. Performance is good and according to its IRC channel it's well tested enough nowadays to use over WAN.


3

From an IT administration standpoint, your best option is to investigate the possibility of letting your application use the single-sign-on capabilities of the existing authentication scheme that your customers are using. Obviously Active Directory is a big player, but if your application works with the policy that onsite IT has already configured, you ...


2

Not that the decision is often up to me but but... At it's most basic I plot an hourly graph of usage for several weeks (or several months to ensure monthly cycles are considered) to find day of week and time with the least load, then I consider our clients and try to find a window where the least number and value of accounts is affected. (Yes. Some clients ...


2

What is the overall goal you're trying to actually accomplish here? Why do you want to rename it? Update: Currently there is no way to rename the web app inside SharePoint short of deleting it and recreating it.


2

Generally when you are starting out it is best to go with the a VPS or a cheap dedicated box. Cloud hosting is really targeted at people that are needing to scale their infrastructure quickly. It isn't cost effective for smaller operations.


2

Changing passwords often may lead to having user writing them down. Which is not such a bad idea according to Bruce Schneier (http://www.schneier.com/blog/archives/2005/06/write_down_your.html). I would even argue that having security getting in the way of usability can sometime be a good thing, just because it reminds user to act securely. For example, in ...


2

Take a look at Splunk which satisfies your web-based log viewer criteria. However, It is not a web app which can be deployed on Tomcat or any web server, but it runs as it's own web server at localhost:8000


2

Virtual servers or IaaS like Amazon EC2 make adding removing servers much more flexible. Yet one problem persists, that there are times where even the smallest instances are too powerful or too expensive. E.g. when you just started or when it's a business application and people don't work over the holidays. PaaS offerings like Heroku for Ruby, Google App ...


2

You might be best off renting capacity from the cloud (Amazon EC2 or similar) until you have a better idea of your future scaling requirements.


2

There is no best place to put it. It's a matter of preference. Putting it under /var/www is fairly common. I use /var/www/sites/<vhost>. Putting it under the others isn't common. I personally would never put it under /usr/share. Just make sure you put it in the same place consistently. If you end up managing dozens or hundreds of web servers ...


1

You could compute a partition cookie pt based on some characteristic of a user such as a guid. For example, you could convert a guid into integer and then compute mod N where N is the number of servers, then set that value to pt cookie. At the load balancer level, analyze the partition pt cookie and direct to the appropriate server. Many load balancers (such ...


1

I think there are applications out there that can be scripted to do things like: 1. log in 2. Go to $URL 3. select 3rd link in $LIST or $PATTERN 4. Check HTML from that link for $PATTERNS 5. Email report This is exactly the use case for real browser monitoring. You create test scripts that follow a certain click path through your website, submit forms ...


1

Examples include data with bad formatting, blank rows in tables (indicates missing non-critical data), patterns for identifiers ("TEST" means one of my devs left a testing feed on), etc. I think there are applications out there that can be scripted to do things like: 1. log in 2. Go to $URL 3. select 3rd link in $LIST or $PATTERN 4. Check HTML from ...


1

In this case, I would suggest building a simple test using Pyccuracy and letting it run from cron using a "headless" browser. You can call it from within a script and monitor whether your app passed all the tests cases you coded.



Only top voted, non community-wiki answers of a minimum length are eligible