1,010 reputation
614
bio website
location Paris, France
age
visits member for 4 years, 2 months
seen Jan 19 at 23:22

Jul
5
comment What amount of effort and money should one invest against DDoS threats?
@JamesRyan: ok I was simplifying things, as I said the goal is to get a rough idea of reasonable amounts to spend for protection. At the very least, it should guide you into investing more money into problem A rather than problem B, if pA*mA > pB*mB don't you think? If you're not going to weigh probability and damage somehow, what other strategy would you recommend? You would probably want to replace dollars by some kind of utility function because 100$ today may be a lot more useful to you for some reason than 200$ one year from now, if you need to invest the money on some project.
Jul
4
comment What amount of effort and money should one invest against DDoS threats?
Thanks a lot for your answer. It's 3 or 4 times less than @Jacob's answer, but it gives me the order of magnitude: we are talking about thousands of dollars. OMG... I'm losing faith in mankind. :-(
Jul
4
comment What amount of effort and money should one invest against DDoS threats?
@lain: I am a long time fan and user of SO and SF, I'm sorry you find this question is crappy, I can see why, but I honestly disagree. As I explained in my question, I believe that every good sysadmin should know the answer to this question, so it is a legitimate question to ask oneself. Please check my history, I really try not to ask crappy questions. And I did ask people not to give hackers any help by giving any link that could encourage people to DDoS.
Apr
23
comment Where should I setup a staging environment in Amazon VPC? And testing?
Hi, there are a few services that are currently common to prod, staging and testing : dns, git, chef server, ntp. If I setup different VPCs, then I will have to either duplicate them (for git and chef server, that would be a real pain), or set them up in one VPC and make them available to the other VPCs through Internet. Configuring everything in one VPC avoids this issue. I'm still hesitating. I guess there's no absolute answer. I wish Amazon would enable secure cross-VPC communications (or I could setup an OpenVPN connection between VPCs?).
Apr
21
comment Where should I setup a staging environment in Amazon VPC? And testing?
Ok, I get it: there used to be a limit of 1 VPC per region per AWS account, but that was during beta, and this limit was lifted. Here are the current VPC limits: docs.aws.amazon.com/general/latest/gr/…
Apr
21
comment Where should I setup a staging environment in Amazon VPC? And testing?
Oh you're right, I don't know where I got this wrong assumption. Thanks.
Mar
20
comment Communications between Amazon EC2 VMs in VPCs across different regions?
+1 I had not thought about ssh tunnels, I like the idea, it's pretty simple to setup. Thanks.
Mar
16
comment Ordering: 1. nginx 2. varnish 3. haproxy 4. webserver?
@John: [Client -> HAProxy -> Varnish -> Nginx -> Static Content] or [Client -> HAProxy -> Nginx (optional) -> Application Server (dynamic content)]
Mar
16
comment Ordering: 1. nginx 2. varnish 3. haproxy 4. webserver?
Varnish now has SSL support: see blog.exceliance.fr/2012/09/10/…
Mar
2
comment Is there a MySQL performance benchmark to measure the impact of utf8_unicode_ci versus utf8_general_ci?
Just what I was looking for, thank you!
Nov
16
comment What network file sharing protocol has the best performance and reliability?
We had the exact same experience with OCFS2: it's great... until it crashes.
Aug
19
comment controlling the bandwidth using tc
By using IFB for your ingress traffic, did you manage to use iptables to mark your trafic and apply egress rules on your ingress traffic? Do you mean that when using "mirred egress redirect", you must mark packets in iptables mangle-POSTROUTING? Could you please share your solution? Thanks a lot.
Nov
15
comment Rebooting access point via SSH with pexpect… hangs. Any ideas?
Thanks for your answer Steven. Note that when the client ssh process hangs, I do not login to the AP to kill processes, I just open another shell on my machine in order to kill the ssh client process (I agree that all server processes are killed upon reboot). I suspect that what happens is this: the AP closes its network ports before it kills the ssh server process, so the client is not informed that the server is stopped, and thus hangs. This is probably why my work-around works (see my answer): the client now runs into a timeout rather than the unlimited wait. Would you agree?
Nov
12
comment How can I set a short timeout with the ping command?
Works great, thanks, this is what I was looking for. This command does the job fine: fping -c1 -t500 10.0.0.1 10.0.0.2 10.0.0.3 ... The whole thing lasts half a second, and I get the results for all hosts at once. Excellent tool. :-))
Nov
11
comment How can I set a short timeout with the ping command?
I guess it would work, but I was looking for a simpler solution. Thanks anyway.
Nov
11
comment How can I set a short timeout with the ping command?
Hi, I just tried this, but I got the following error message: "--host-timeout is specified in milliseconds unless you qualify it by appending 's', 'm', 'h', or 'd'. The value must be greater than 1500 milliseconds".
Mar
9
comment Is there a debian lenny patch to allow apt-get to work with sftp?
Thanks for your answer. I am trying to protect private packages stored in the repository (this is why I do not use http), and also trying to protect my server from further intrusion, if a hacker gains access to the repository (this is why I would like a chroot'd environment). apt-transport-https sounds good, but I read that there is no way to configure it to check the server certificate, and from what I read authentication is a problem (you need the password in sources.list). I may be wrong on this, and if I am, then https is the way to go.
Mar
8
comment Is there a debian lenny patch to allow apt-get to work with sftp?
Oops, reading your answer, I realize that I probably wasn't clear enough in my question. I'll fix this in an edit.
Feb
22
comment Securely restrict access to a private Debian repository
My pleasure! :) Glad if it helps.
Feb
15
comment How can I activate ssh-agent confirmation in MacOSX Leopard?
Yes, if A is rooted, things are pretty bad. Perhaps you're right, and it's a bit overkill to try and configure agent forwarding confirmation on my MacBook. But if it's as simple as adding a line or two in some hidden configuration file, it probably won't hurt. I was just hoping someone knew how to make it work on MacOSX (knowing that it works fine in Debian Lenny). Anyway, thanks for the insight, and for the spelling hint. ;-)