2,638 reputation
615
bio website blog.malayter.com
location United States
age
visits member for 4 years, 10 months
seen Nov 19 at 22:52

Aug
31
awarded  Necromancer
Aug
20
comment Does 1 Gbps ethernet standard mean 1 Gb in both directions simultaneously, or 500 Mb in each direction?
@Mark_Henderson even some very pricey enterprise gear is "over-subscribed", where the switching fabric cannot handle all ports at line rate. Sometimes the limitation is not bits per second, but packets per second. The venerable Cisco Catalyst 6500 series is notoriously over-subscribed, and even the latest Broadcom Trident 2 based switches from numerous vendors cannot fill all 10 GbE ports with small packets.
Aug
15
comment Can I force a Windows Server 2008 DNS Conditional Forwarder to use TCP Only?
If the partner is scared of UDP packets on port 53, I would be very wary of connecting my network to theirs! The only reason I can fathom us that they are running a creaky old DNS and trying to protect it instead of fixing it.
Aug
15
answered PHP Session Storage in Fault Tolerant Memcached Pool
Aug
15
comment How does anycast work with tcp?
They likely use stateless techniques such as ECMP from rack switches to distribute load. Stateless LB cannot scale up enough for CDN use. There are no F5s or anything like that in play.
Aug
15
comment How does anycast work with tcp?
There would not likely be a stateful load balancer anywhere in the path on a CDN like CloudFlare, MaxCDN, or CacheFly (all of which use anycast TCP extensively).
Jul
26
comment JBOSS Vulnerability [PCI Scan]
The question was definitely answered. It was a rant AND an answer. Three years later and I stand by it too... JBoss should never be exposed directly to the internet. The attack able surface is huge, and many defaults are still woefully insecure.
Jul
3
comment Why can't I use Services or alike as my subdomain name with SSL?
As andy says "services" with no domain qualifier is the problem, and that is what was in a SAN field of your cert. GoDaddy should never have even issued a cert like that in the first place, and are correcting the mistake. Your SAN field should be "services.myandy.com", which is a valid fully qualified domain name. goDaddy will issue a cert for a FQDN that is valid, even if it starts with "services". If they won't, they're doing it wrong.
Jun
18
awarded  Popular Question
May
31
comment Mimicking Google's Persistent Disks — Is this a logical FreeBSD disaster recovery strategy?
So you suffer downtime every night in order to shorten the time window for a presumably very rare DR scenario by at most a few minutes? That makes zero sense.
May
18
comment Nginx or Varnish caching with multiple versions of a site
This is on your devs, but your site should not be doing user-agent sniffing to detect mobile devices; there is a continuum of screen sizes in use these days. You should use CSS media queries to detect which version of a site to show. See smashingmagazine.com/2011/01/12/…
Apr
18
comment SonicWall “gotchas”?
@bob_i Looks like lots of features are disabled for IPv6 in 5.9.x... any experience with it personally? We're considering it, but of course we now have only one HA pair of firewalls at each location so no way to test reasonably. I don't think they offer a VM-based version for testing in the NSA series (although they have them for other Sonicwall appliances).
Mar
20
awarded  Revival
Feb
11
comment How can I password protect a directory with nginx, but not the files within the directory?
Move your PHP location block up above the two new rexex blocks ones you just added. Nginx matches regex locations in the order they appear in teh configuration file. So I assume your php files are under your /mcscreeens lcoation. nginx stops searching other regex locations after it hits the first match. Your configuration of "execute anything with a PHP extension" is a really bad idea from a security perspective BTW. Code and static files should be separated, so you only run PHP from very specific directories. This is especially true if you accept any sort of file upload anywhere on your site.
Feb
10
answered How can I password protect a directory with nginx, but not the files within the directory?
Jan
26
awarded  Yearling
Jan
14
revised SSL Handshake negotiation on Nginx terribly slow
added 583 characters in body
Jan
14
comment SSL Handshake negotiation on Nginx terribly slow
@noloader that Rc4 attack was announced years after my post; until very recently most cryptographers were recommending RC4 over AES because of the BEAST attack against TLS v1.0 and earlier. Now that most browsers protect against BEAST client-side, and there have been further attacks against RC4, the advice has changed. See this post for some good nginx settings for TLS v1.2: blog.cloudflare.com/staying-on-top-of-tls-attacks
Nov
20
answered Why is SPDY breaking 'Vary: Accept-Encoding' in Nginx 1.4.3?
Jul
11
comment Is it necessary to burn-in RAM for server-class hardware?
@ewwhite Yes, I would test. It only takes few hours or so to boot memtest86 and let it check 384 GB of RAM. We burn in all storage subsystems as well using IOmeter for the same reason. Had several RAID controllers or drives die on us during burn-in over the last several years, even though they initially worked fine during the OS install. Sometimes it was a bad firmware thing, sometimes faulty cache RAM on the RAID controller, sometimes it was "who knows - RMA it!"