Hacker News Reader

SaltwaterCon PHP 5.3.7 release has a major bug in MD5 crypt

#define irony 1

SaltwaterCon Then people wonder why Apple is suing companies for copying them

Did I pass through a portal into another reality where Apple has a "patent" for black keyboards onto a silver notebook? Let's take a break and remember that Uncle Steve used to quote Picasso: http://www.youtube.com/watch?v=CW0DUg63lqU

SaltwaterCon Secure Apache and PHP, hide version numbers

Most of the "security" is in fact obscurity: here's something I know, you don't, while in order to find out what I know is unfeasible for you to compute all the possible combinations. Same goes for the "randomness" theory.

SaltwaterCon The Plot to Kill PHP MySQL Extension

First of all, mysqlnd is not a proper extension itself, but a backend for the mysql / mysqli extensions. Anyone that bothers to build PHP 5.3.x knows that mysqlnd replaces the libmysql dependency if the --with-mysql(i)=mysqlnd flag is passed to the configure script. Which brings me to the point that the author understands little of the internals themselves.

Second of all, people should man up, step up from their lazy ass and move on. If the code is so really hard to refactor, maybe that code sucks really hard in the first place. I've seen incredible piles of garbage PHP code just to keep PHP 4 compatibility. It's 20-fu-11. 5 years since PHP 4 is officially dead. Maybe, just maybe, the internals team is not to blame for this stuff. I'm not even mentioning sentences containing the word "security" that seems to be some really scary stuff for some pumpkins still trying to figure out how SQLi works.

SaltwaterCon The fanless spinning heatsink: more efficient, and immune to dust and detritus

The real issue is the power consumption, not the actual heating at 4GHz. But even if we don't count the OC, 3.1GHz+ is still beyond 3GHz by any decent math.

SaltwaterCon The fanless spinning heatsink: more efficient, and immune to dust and detritus

"Moving beyond 3GHz". Really?

SaltwaterCon Nginx sucks at SSL, here's what to do instead

Most of the servers suck at SSL without some sort of caching. Also, properly configured nginx setups have a fair share of keep alives.

SaltwaterCon How To Safely Store A Password

Shameless plug for PHP devs: https://github.com/SaltwaterC/PasswordHash2 - you may like this as well.

SaltwaterCon How To Safely Store A Password

http://www.openwall.com/lists/announce/2011/06/21/1 - some bcrypt implementations out there are still broken if they used this code. You may give the SHA-based scheme a chance.

SaltwaterCon How to handle 1000s of concurrent users on a 360MB VPS

By the manual page you mentioned: http://linux.die.net/man/7/socket

> SO_SNDBUF: [...] The default value is set by the wmem_default sysctl and the maximum allowed value is set by the wmem_max sysctl.

You can't use sysctl under OpenVZ. QED.

SaltwaterCon How to handle 1000s of concurrent users on a 360MB VPS

First of all, there's no such thing as 18GHz. The GHz don't sum up. It's like saying that if a woman makes a child in 9 months, two women can make a child in 4.5 months. It doesn't work that way.

Moving forward to the actual issue. Something is really broken into your configuration. The first thing is the file AIO. But this is Linux's fault. The file AIO is broken by design. It bypasses the kernel file cache. Which is a pretty large performance hit per se. The second thing is the fact that I can easily get 55k req/s on a Q9400 with nginx, without even touching the sysctl parameters of a Ubuntu 10.04 x86_64. The only actual difference is nginx 1.0.x instead of the ancient 0.7.x you would actually find into the standard repos aka the production version I publish into my company's private repo.

SaltwaterCon How to handle 1000s of concurrent users on a 360MB VPS

Event MPM is still a large pile of fail. Unless you're unwilling to switch from Apache, the benefits over Worker are mostly theoretical from the performance point of view. Hopefully this will change with 2.4, but only for those who didn't kick Apache out of their production machines.

SaltwaterCon How to handle 1000s of concurrent users on a 360MB VPS

That would work, unless you're using a container-based VPS. OpenVZ is notorious for standing in the way of system tuning. Using nginx makes a lot of sense in this case, especially with the ey-balancer patch.

SaltwaterCon Ask HN: Why Would I Write Web Apps In Anything Besides PHP?

Putting aside Quercus, a PHP implementation on top on JVM, Zend at least provides a proper Java bridge into their Zend Server line of products, including the Community version: http://www.zend.com/en/products/platform/product-comparison/...

I tried to use Quercus, but besides templating, it pretty much blows at everything else PHP related. http://www.caucho.com/resin-3.0/quercus/

Therefore this isn't a sole feature of the J-something language implementation on top of JVM.

SaltwaterCon Ask HN: Why Would I Write Web Apps In Anything Besides PHP?

Rails 3 is a web framework. PHP isn't. I am always puzzled by the apple to oranges comparison: Rails vs PHP.

SaltwaterCon Clearly, Skype On Linux Has No Future

Silverlight runs on OS X. http://www.microsoft.com/getsilverlight/Get-Started/Install/... IIRC since day one. I used to be on Tiger when Silverlight showed up in public.

SaltwaterCon $400 bounty started for "simple" OSS node.js module

That might work for weekend hacking sessions. But for serious projects, most of the development process is financed by businesses. Take a peek at the Linux contributors: http://arstechnica.com/open-source/news/2010/12/linux-kernel...? but this isn't a sole case.

SaltwaterCon Show HN: boxify.me - I made a file-sharing app while AWS was down

Even more, one could rename the default 'example' page like this: http://boxify.me/box/input-script-alert-string-fromcharcode-... :)

Edit: removed the XSS, but here's the vector (if HN allows: input"><script>alert(String.fromCharCode(88,83,83))</script>)

SaltwaterCon Bandwidth Limit Exceeded (View The Source)

Google does that with Chrome as well. Now go figure why BigCos do that with their browsers.

PS: at least nginx takes care of this issue http://wiki.nginx.org/HttpCoreModule#msie_padding

SaltwaterCon Duke Nukem Forever Gets Delayed... again

Darn. I though I could play a GNU Hurd port of this title somewhere around this year. Tough luck ...

SaltwaterCon Firefox 4.0 (stable) available for download on Mozilla's FTP

I was talking about an older major release (3.0 and 3.0 RC2 were identical IIRC). Even 4.0 RC1 had Firefox/4.0 into the user agent string as well as into the About panel.

SaltwaterCon Firefox 4.0 (stable) available for download on Mozilla's FTP

These actually work:

OSX: http://www.mozilla.com/products/download.html?product=firefo...

Win: http://www.mozilla.com/products/download.html?product=firefo...

Linux: http://www.mozilla.com/products/download.html?product=firefo...

However, they're the same as RC2 (sha1sum confirms). Not uncommon though for Mozilla to release a RC as stable version without any modifications besides the version bump.

SaltwaterCon Favimon: web game in which you battle and collect website favicons

4chan.org was quite trivial. Got it with yahoo.com, powered up to max damage. I stole 'Too Much Information' from facebook.com in order to have level 2 attack on yahoo.com though.

4chan.org vs ycombinator.com - that was a long fight. 4chan.org ended up being on top :)

SaltwaterCon Toilet paper orientation

http://i41.tinypic.com/20uwsg3.jpg

However, this one has some points: http://www.blameitonthevoices.com/2009/03/great-debate.html

SaltwaterCon Simple kernel attack: Eat 100% CPU, works under guest, no way to protect

As for other virtualization products, I tried in inside an OpenVZ setup (Proxmox 1.6). A container almost took down the hardware node. It was very slow, although responsive. "vzctl stop" timed out. Just a reboot brought back that machine. Therefore, I am living under the impression that any container based virtualization technology is vulnerable due to the usage of the same kernel for all the available virtual machines.

Proxmox ran inside a VirtualBox instance. All the allocated memory to the virtual machine was taken by the exploit. Even more, after rebooting the VirtualBox machine, it leaked the whole memory used by the affected Proxmox. The only way I could get it back was to stop the VirtualBox machine.