Reputation
2,726
Top tag
Next privilege 3,000 Rep.
Cast close and reopen votes
Badges
7 16
Newest
 Yearling
Impact
~236k people reached

Mar
23
comment Core & Edge switch design: backplane as a point of failure?
Speaking from experience, ESPECIALLY with Cisco 3700-series switches, the stacking is a huge cause of network outages. Every firmware upgrade requires all switches to be rebooted simultaneously for example, and master-slave failover works.... sometimes.
Mar
17
comment Time problems in a Windows domain
The general recommendation for NTP is to use four upstreams, so you always have a quorum even if one fails. This is why the NTP pool project provides the hostnames [0123].pool.ntp.org. Two upstream time servers is actually worse than one or zero; that is the reason four servers are recommended (so that the two-server case becomes very unlikely).
Mar
7
comment Rapid failover from one data center to another when the first goes down?
A little mroe color: anycast is most often associated with stateless UDP protocols like DNS. But most of the "newer" CDNs utilize anycast not just for their DNS, but also for the actual TCP connections made by clients as well. See CloudFlare, MaxCDN, CacheFly, etc. Akamai, Limelight, and Amazon CloudFront still seem to utilize per-DC IP addressing for client (usually web browser) connections, which means they too are dependent on DNS timeouts for failover (or perhaps they have some fast-rerouting/tunneling tricks with their upstream providers to move IP blocks from failed DCs to a working one)
Feb
3
comment IPv6 and NAT, routing to multiple ISPs
3.5 years later and small-site multi-homing on IPv6 is still pretty much horribly broken. No commercial or open source routers/firewalls/whatever support the needed features suck as sub-prefix based configuration and RA deprecation. You still have to hack something together via scripts and monitoring to properly withdraw prefixes. See blog.ipspace.net/2015/01/… and all the related links.
Jan
26
awarded  Yearling
Jan
23
revised Move static files from EC2 to S3 (or cloudfront) without updating links
Code escaping
Jan
23
revised Move static files from EC2 to S3 (or cloudfront) without updating links
Code escaping
Jan
23
answered Move static files from EC2 to S3 (or cloudfront) without updating links
Dec
2
comment Google Analytics setting cookies on static content despite being on entirely separate domain
I know it's been a couple of years, but I see no cookies on e.cdn.dj domain when I load your main site... can you post a follow -up on how you resolved it? or was it a false positive of some sort?
Nov
24
awarded  Caucus
Aug
31
awarded  Necromancer
Aug
20
comment Does 1 Gbps ethernet standard mean 1 Gb in both directions simultaneously, or 500 Mb in each direction?
@Mark_Henderson even some very pricey enterprise gear is "over-subscribed", where the switching fabric cannot handle all ports at line rate. Sometimes the limitation is not bits per second, but packets per second. The venerable Cisco Catalyst 6500 series is notoriously over-subscribed, and even the latest Broadcom Trident 2 based switches from numerous vendors cannot fill all 10 GbE ports with small packets.
Aug
15
comment Can I force a Windows Server 2008 DNS Conditional Forwarder to use TCP Only?
If the partner is scared of UDP packets on port 53, I would be very wary of connecting my network to theirs! The only reason I can fathom us that they are running a creaky old DNS and trying to protect it instead of fixing it.
Aug
15
answered PHP Session Storage in Fault Tolerant Memcached Pool
Aug
15
comment How does anycast work with tcp?
They likely use stateless techniques such as ECMP from rack switches to distribute load. Stateless LB cannot scale up enough for CDN use. There are no F5s or anything like that in play.
Aug
15
comment How does anycast work with tcp?
There would not likely be a stateful load balancer anywhere in the path on a CDN like CloudFlare, MaxCDN, or CacheFly (all of which use anycast TCP extensively).
Jul
26
comment JBOSS Vulnerability [PCI Scan]
The question was definitely answered. It was a rant AND an answer. Three years later and I stand by it too... JBoss should never be exposed directly to the internet. The attack able surface is huge, and many defaults are still woefully insecure.
Jul
3
comment Why can't I use Services or alike as my subdomain name with SSL?
As andy says "services" with no domain qualifier is the problem, and that is what was in a SAN field of your cert. GoDaddy should never have even issued a cert like that in the first place, and are correcting the mistake. Your SAN field should be "services.myandy.com", which is a valid fully qualified domain name. goDaddy will issue a cert for a FQDN that is valid, even if it starts with "services". If they won't, they're doing it wrong.
Jun
18
awarded  Popular Question
May
31
comment Mimicking Google's Persistent Disks — Is this a logical FreeBSD disaster recovery strategy?
So you suffer downtime every night in order to shorten the time window for a presumably very rare DR scenario by at most a few minutes? That makes zero sense.