21,298 reputation
12348
bio website ripple.com
location Oakland, CA
age 44
visits member for 3 years
seen 5 hours ago

I am Chief Cryptographer at Ripple Labs and one of the architects of the Ripple payment system.


1d
comment Having public IP addresses for computers in private network
There is no "built-in security of NAT". NAT's job is to make things "just work". The security comes from firewalling, which is often included with NAT but doesn't need to be (permissive NAT does exist). The advantage of public IP addresses is that a lack of a stateful firewall is more likely to be noticed because it will break things rather than just compromising security.
1d
comment RAM usage keeps growing (Apache/Ubuntu VPS)
Also, there are only two things you can do with RAM -- use it or waste it. You can't save it for later. A system with 4GB can't use 3GB today so it can use 5GB tomorrow. So by saying "RAM usage keeps growing", you are equally saying "RAM waste keeps dropping", which is a good thing.
1d
comment How to convince my Administrator that Java ON A SERVER is not insecure per se?
@FalconMomot The kernel doesn't need to know the RAM is "free". The kernel always has control over the use of RAM unless the application locks pages. It just has to make the mapped pages discardable to get the RAM back. If the data is unmodified and unused for a period of time, and I/O bandwidth isn't saturated, it can opportunistically write it to swap, making the pages discardable, allowing it to reclaim the RAM as soon as it has a better use for it. (This space isn't large enough to explain how modern memory management works, but it seems like you have some very common misconceptions.)
1d
comment How to convince my Administrator that Java ON A SERVER is not insecure per se?
It's not complicated. The operating system simply steals the RAM from the process and uses it for some other purpose. That's basically the entire point of virtual memory. The process can think it owns as much RAM as address space it allocated, even if that's more physical memory than the system has. If the process actually has physical RAM, it's because the OS decided that was the best use of RAM.
1d
comment How to convince my Administrator that Java ON A SERVER is not insecure per se?
@FalconMomot Actually, that's not true. Swapping it out is not slow because the OS can swap it out before it's actually under memory pressure, when I/O bandwidth is not scarce. That makes the pages discardable by the time the system is under memory pressure. Modern operating systems do all these things right, they're written by very, very smart people and you can safely assume they don't do stupid things that produce poor performance for no reason.
1d
comment How to convince my Administrator that Java ON A SERVER is not insecure per se?
@FalconMomot Yes, the kernel can use it to cache files. The kernel can take memory away from the JVM if it has a better use for it. That's how pretty much every modern OS works. The alternative to using RAM is wasting RAM. The OS has a memory manager specifically to ensure RAM goes to the best purpose. Arguments like "Java applications eat up all my RAM" almost always indicate an admin who doesn't understand how modern operating systems use RAM.
1d
comment RAM usage keeps growing (Apache/Ubuntu VPS)
You also forgot to describe the problem. You ask us to help you with something but don't specify what you need help with. For example, is performance poor? If not, then what's the problem? If so, what performance are you seeing? What are you expecting? Is it always bad? Does it gradually get worse? You spend a lot of time giving us detailed information to help solve a problem you never described.
1d
comment Installing Wi-Fi in a bus and connecting the server form a college to the bus
Or you could use a VPN over an existing 3G/4G carrier. You won't get a useful answer without providing a lot more details -- budget? terrain? reliability requirements? bandwidth requirements? Etcetera.
1d
comment How to convince my Administrator that Java ON A SERVER is not insecure per se?
Okay, so reason doesn't work. What other tools are in your persuasion toolbox? Do you have any rusty pliers?
Aug
25
comment 3ware raid controller does not get a proper reset signal after a reboot
Do you have any actual issue, other than your assumption that the controller isn't properly restarted?
Aug
25
comment Single TCP-CLOSE_WAIT connection brings down application till restart
Sounds like the application is not closing its sockets.
Aug
25
comment ping works but ssh fails
Talk to the administrator of the router/switch.
Aug
21
comment Setup CNAME for multiple sub domains
A problem description that consists only of "nothing works" is really not helpful. How are you testing? What results are you getting?
Aug
20
comment GMail detecting mail as spam
109.98.21.30 is in UCEProtectL3. I doubt that matters.
Aug
20
comment Run sshd on multiple ports but different domains
@Tim That's impossible. How would the server know whether the domain was specified with or without the prefix? That's like trying to tell if someone calling you looked up your phone number in print or online when the listed number is the same in both cases. All you know is that your phone is ringing.
Aug
20
comment GMail detecting mail as spam
The Message-ID looks suspicious.
Aug
8
comment Can I have my DNS server and my web server on the same IP?
Short answer: yes.
Aug
4
comment Is my FTP account compromised?
@developer It certainly can be. But more likely the server just created a self-signed certificate by default.
Aug
4
comment ethernet switch makes network down
@MRamezani Confirm that none of the workstations have more than one Ethernet connection. Perhaps some fool has tried to put a computer on "both networks" and formed a loop in the process.
Aug
4
comment Is my FTP account compromised?
It's the server's certificate. The idea is that encryption with no authentication or MITM protection is better than nothing.