2,588 reputation
515
bio website blog.malayter.com
location United States
age
visits member for 4 years, 5 months
seen 13 hours ago

Jul
3
comment Why can't I use Services or alike as my subdomain name with SSL?
As andy says "services" with no domain qualifier is the problem, and that is what was in a SAN field of your cert. GoDaddy should never have even issued a cert like that in the first place, and are correcting the mistake. Your SAN field should be "services.myandy.com", which is a valid fully qualified domain name. goDaddy will issue a cert for a FQDN that is valid, even if it starts with "services". If they won't, they're doing it wrong.
Jun
18
awarded  Popular Question
May
31
comment Mimicking Google's Persistent Disks — Is this a logical FreeBSD disaster recovery strategy?
So you suffer downtime every night in order to shorten the time window for a presumably very rare DR scenario by at most a few minutes? That makes zero sense.
May
18
comment Nginx or Varnish caching with multiple versions of a site
This is on your devs, but your site should not be doing user-agent sniffing to detect mobile devices; there is a continuum of screen sizes in use these days. You should use CSS media queries to detect which version of a site to show. See smashingmagazine.com/2011/01/12/…
Apr
18
comment SonicWall “gotchas”?
@bob_i Looks like lots of features are disabled for IPv6 in 5.9.x... any experience with it personally? We're considering it, but of course we now have only one HA pair of firewalls at each location so no way to test reasonably. I don't think they offer a VM-based version for testing in the NSA series (although they have them for other Sonicwall appliances).
Mar
20
awarded  Revival
Feb
11
comment How can I password protect a directory with nginx, but not the files within the directory?
Move your PHP location block up above the two new rexex blocks ones you just added. Nginx matches regex locations in the order they appear in teh configuration file. So I assume your php files are under your /mcscreeens lcoation. nginx stops searching other regex locations after it hits the first match. Your configuration of "execute anything with a PHP extension" is a really bad idea from a security perspective BTW. Code and static files should be separated, so you only run PHP from very specific directories. This is especially true if you accept any sort of file upload anywhere on your site.
Feb
10
answered How can I password protect a directory with nginx, but not the files within the directory?
Jan
26
awarded  Yearling
Jan
14
revised SSL Handshake negotiation on Nginx terribly slow
added 583 characters in body
Jan
14
comment SSL Handshake negotiation on Nginx terribly slow
@noloader that Rc4 attack was announced years after my post; until very recently most cryptographers were recommending RC4 over AES because of the BEAST attack against TLS v1.0 and earlier. Now that most browsers protect against BEAST client-side, and there have been further attacks against RC4, the advice has changed. See this post for some good nginx settings for TLS v1.2: blog.cloudflare.com/staying-on-top-of-tls-attacks
Nov
20
answered Why is SPDY breaking 'Vary: Accept-Encoding' in Nginx 1.4.3?
Jul
11
comment Is it necessary to burn-in RAM for server-class hardware?
@ewwhite Yes, I would test. It only takes few hours or so to boot memtest86 and let it check 384 GB of RAM. We burn in all storage subsystems as well using IOmeter for the same reason. Had several RAID controllers or drives die on us during burn-in over the last several years, even though they initially worked fine during the OS install. Sometimes it was a bad firmware thing, sometimes faulty cache RAM on the RAID controller, sometimes it was "who knows - RMA it!"
Jun
25
comment Is it necessary to burn-in RAM for server-class hardware?
The chip manufacturer, and maybe even the server vendor might test some chips. But mst components are only sample-tested these days to reduce cost. Even if your chips or whole DIMMs were once tested, that doesn't tell you if the contacts or PCB were somehow tweaked or messed up during assembly or shipping. We've had a MemTEst86 burn-in find problems with memory from two different servers, out-of-the-box from two different "tier 1" server vendors. If they had made it to production, ECC might have saved us, but silent database corruption could also have been the result.
Jun
25
awarded  Revival
Jun
14
comment Add expires header conditionally based on mime type in nginx
Why would you not set the expires header in the PHP script itself? That's the right layer to do it, especially if it can change based on the type of request and content. For example, some CSS might be give an 1 hour lifetime, but others might get only 10 minutes. Your application code knows this information at runtime, nginx cannot see inside your business logic.
Jun
10
comment Shared PHP Sessions in Load Balanced httpd environment
@TomDesp, it depends on requirements, but in general, you want to cap the amount of stored session state to some reasonable level. In that case, the LRU-style behavior of memcache is reasonable. "Live" sessions will not get evicted from the cache in unless you get a massive traffic flood. If you get a massive rtaffic flood, the LAST thing you want is sessions stored in a database. A potentially better method is to use stateless sessions: a cookie is set with a userid+expriation+HMAC. The HMAC uses a server-side secret. That way you can validate and/or recreate an in-memory session as needed.
Jan
26
awarded  Yearling
Jan
18
comment SonicWall “gotchas”?
FYI, nearly a full year later, and the ancient 5.5.6 "feature" release is still the only IPv6 support available from Sonicwall. I am signed up for the beta channel, and they still do not even have a beta release of newer firmware that includes IPv6 support. They are promising it for 5.9 however, "in the near future", which they've been saying for years.
Dec
5
comment I have a blocking transaction, but no statement is shown
We've seen the same recently... in our case the blocking statement is listed as "--" in the blocking transactions report as well as DBCC INPUTBUFFER (spid). Still trying to figure out how this is posisble. It's a third-part application, and I suspect a transaction nesting issue, but the app-layer code is closed to us and what we can see at the DB layer is a spaghetti mess.