Hacker News Reader

Comment by nailer | Hacker News Reader

1/ The article doesn't claim to support one million concurrent users. Top level directives are Ubuntu/RHEL defaults, but if you have a preferred scalability config please file an issue!

2a/ buffering is well known to break SSE. As the article notes, if you're not using SSE you should disable that include.

2b/ I thought the config parser would have caught this but didn't. Filed https://github.com/certsimple/nginx-http2-load-balancing-con... and fixed.

3/ If you think your own DNS server is going to be better maintained than Google's, sure. But not everyone else would.

View on HN

2a/ ok, I misread what was the intention, maybe it's a good idea then

3/ it's not about "better maintained", it's about trusting the internet on sensitive data, which you should never do, because dns is easily spoofed and nginx resolver was not written to operate in a hostile environment. if you don't have a local caching resolver on your machine (which you should), even trusting your cloud provider dns is better than trusting goog one. nginx documentation even says " To prevent DNS spoofing, it is recommended configuring DNS servers in a properly secured trusted local network. " on http://nginx.org/r/resolver

You're right: checking this out further, the nginx resolver seems to have a bunch of issues [1] which is concerning.

I've modified the config accordingly.

[1] http://blog.zorinaq.com/nginx-resolver-vulns/

Yep - the warning clause in the documentation is there because of those issues.

thanks!

There is a problem with this change: https://github.com/certsimple/nginx-http2-load-balancing-con...

proxy_set_header in html5-sse.conf will discard all other proxy_set_header included in proxy.conf a level above: "These directives are inherited from the previous level if and only if there are no proxy_set_header directives defined on the current level", http://nginx.org/r/proxy_set_header

Cheers & fixed! https://github.com/certsimple/nginx-http2-load-balancing-con...

> 3/ If you think your own DNS server is going to be better maintained than Google's, sure. But not everyone else would.

Be careful here, Google will rate limit you very severely and waiting 10s for DNS responses inside Nginx is no fun. Most cloud providers will give you a good resolver via DHCP that is much more forgiving when you accidentally abuse it.

Have already modified the file accordingly after Thresh's suggestion, see below. Thanks though!

Reply on news.ycombinator.com