Tag Info

Hot answers tagged

21

The question doesn't provide specific information about load, features needed etc, so as such any answer is at best a guess. Pound is a good choice for smaller / midsized sites. It offers HTTPS support and easy setup. HAproxy can scale to saturate 10G Ethernet pipes, and offers connection limiting, i.e. sending only the number of simultaneous requests to ...


17

Here are the basic steps. The specific details depend on what kind of router you have, but the concepts still apply: Install IIS on the machine you want to be a web server. It is okay to leave it on the standard port 80 in most cases (we'll remap the port later through the firewall since most ISPs disallow incoming traffic on port 80). Go to DynDns.org and ...


17

Commercial Products: Atlassian Jira (which ties in nicely with Confluence (the wiki)) - Surprisingly good for commercial software. Open Source: Edgewall Trac - (Wiki, Ticketing, and more) Drupal (+plugin) Best Practical RT - I've heard good things about this, but have never used it myself


14

That's like asking if there's a preferred type of car for driving across country. It's all about your preference (I like gentoo personally). Pick the one you know best. If you don't know any of them, I might go with Ubuntu for its large support base. I would add that you should read up on securing the server because with an entire VPS, you have a large ...


13

According to the episode 27 of the StackOverflow podcast, the Reddit guys really seem to like HAProxy. Here's a brief tutorial showing HAProxy being used with Amazon's EC2. You can find much more information at the HAProxy web site.


11

There's definitely a preferred flavor. It's the distro you know best, so that your maintenance costs will be as low as possible. Do not listen to people that will tell you "Distro X is the best". They just happen to know this distro best, therefor they are probably using a lot of the convenience tools that come with the distro to manage it. So use the ...


10

Most answers are going to say: Whatever you feel most comfortable with. But here's a few real answers: CentOS Ubuntu Server Why these distros? Active communities. Server focused. Free. Patches and stability need to come before features. Especially if your next meal is coming from the money you hope to be making from this application/server. Next you ...


8

I've used webmin which offers a comprehensive set of administration tools for everything from process management, apache, BIND DNS, bandwidth monitoring, command shell, DHCP server, various mail servers, RAID, IP tunnelling, MYSQL (etc etc!) to a java based file manager - plus a shed load of 3rd party modules. It's available in RPM, deb, TAR, and solaris ...


7

Have you looked at roundcube?


7

I would suggest Request Tracker (RT) with the AssetTracker plugin. RT: http://bestpractical.com/rt/ Plugin: http://wiki.bestpractical.com/view/AssetTracker


6

I work at a mid sized University, and we also have MyStorage folders for our 30k users. We're using WebDAV. We know it is a dying protocol. That said we haven't found anything else that replicates its functionality as easily or cheaply. It does require IIS and another download from Microsoft. Here is some documentation that might get you pointed in the ...


6

Have you considered Eucalyptus? It's free and is pretty simple to set up on a couple boxes you may have. From their site: EUCALYPTUS - Elastic Utility Computing Architecture for Linking Your Programs To Useful Systems - is an open-source software infrastructure for implementing "cloud computing" on clusters. The current interface to ...


6

If you don't use SSPI, you're hardcoding the username and password into the source files. If you're hardcoding the username and password into the source files, all your employees have access to it. This is relatively insecure. A disgruntled ex-employee could use the information maliciously. A visitor might see the code up on a screen somewhere. Or the ...


6

The other answers so far have been good, but I'll throw in another one: management. Sooner or later, you're probably going to end up with multiple SQL Servers. Managing the SQL authentication between your app and multiple SQL Servers gets to be a little painful, especially when you run into security problems. If you change a Windows authentication ...


6

I'd say there are only two valid reasons to use SQL auth: You are connecting from outside the domain, so integrated auth. You're running a TPC-C benchmark and every cycle counts. SQL auth is a tiny bit faster. For the scenario you're proposing (the the web server host is completely compromised) nothing can protect you. The hacker can do on the DB server ...


6

My advice for doing releases is to have Feature Releases and Maintenance Releases. Feature Releases would be the releases that get new features. These get added to your subversion trunk. When you think these are feature complete, you branch these into a release branch. Once your QA process is happy with this release, you tag the release and deploy the code ...


6

I've had good results from wapiti - it scans your web forms and attempts injections and XSS attacks against them. If you have the time, I'd suggest getting the backtrack distribution - it's a modified ubuntu liveCD that's been loaded up with nikto, wapiti, openVAS (a fork of nessus) and hundreds of other great security audit tools; I've used it in a few ...


6

I am not sure what most vendors provide, personally I think it would be a good idea for you to verify everything, even if they do some of the work for you. Here is a general answer that you maybe able to use as a checklist. It covers most of the major topics of what you'll find in almost every standard security reference. Also please remember that while ...


6

Never rely on whether your app will be internal or external. Always develop as though the audience of the app will be outside your control (because it is). Go with ENV.APPNAME.DOMAIN.TLD With www. as the alias for "production".


5

If your authentication is working there is no reason to hide the url. Id rather focus on that.


5

Puppet & Chef aren't really deployment tools. You could certainly juryrig something, but they're more config management. The popular tool these days for what you're doing is called "fabric". Although others like func or capistrano would work as well.


5

As long as session data is passed in the clear between server and client, you are vulnerable to some kind of hijacking on unsecured networks. The stateless nature of HTTP pretty much guarantees that anyone with your session data can pretend to be you to the server. So what to do? You need to securely pass session information from server to client, without ...


5

I would strongly recommend using Continuous Integration. We use a combination of TeamCity for CI, Rake and Albacore for automating the build. TeamCity will check the code out of your source code repository, then, using Rake, build the application, execute unit tests and even run your database scripts if you so desire. After a successful build you can ...


5

I hate to say this, but if you really believe that your freelancer tried to screw you over, then your first call should be to the police, and probably a specialist in computer law. Secondly, If you've already got network connectivity, and hosting space in a datacenter, I suggest that you keep it, and maintain your own network. I personally don't like the ...


5

You should be careful because in most cases, running a web server off of a residential internet connection is listed as a practice against the Terms of Service for many ISPs.


4

Sounds like what you really need is someone with expertise on both sides of the fence.


4

In my experience (with smaller-sized companies), the IT/sysadmin staff doesn't have the time, interest, or webapp-specific knowledge to properly maintain IIS setups. They'll take things as far as the operating system and hand off IIS to me, the developer. Obviously, I need to be "more than just a coder" to make this work properly; I have to be aware of ...


4

We use FogBugz for bug tracking, but it's expensive ($100 per developer) and depending on how you feel, the interface is so-so. We also use Trac for internal help desk ticketing; depending on how you feel, the interface is worse, but it's much cheaper. You have to run your own server with Python though. And you can also use 37Signals's HighRise, which I've ...



Only top voted, non community-wiki answers of a minimum length are eligible