edgan

The article says it was an internal issue, not DDoS or hacking.

I am surprised that Netflix uses UltraDNS when they use AWS and they could be using Route53.

The us-east-1 region gets treated differently than all other regions by AWS. Part of the reason it gets treated differently it is the default, and hence the most popular. It also doesn't help that it is on the east coast, and experiences more weather.

For the above reasons, and that I work in the SF bay area, I put everything in us-west-2. us-west-2 sometimes has it's own issues, but nothing quite at the level of us-east-1.

Omnibus packages are a horrible idea. They are security issues waiting to happen.

A great example is the Chef server rpm. It is a 500mb mini distribution in one package. It has copies of perl, python, Ruby, and Erlang in it. If any of these has a security vulnerability, I have to wait on the maintainer to release a new version, and hope it included the security fixes.

They also tend to include things like python header files for no reason. You wouldn't compile against an Omnibus package, but they are there anyway. Examples of this are Sumologic's and Datadog's agents.

Ext4 does support larger than 16tb filesystems.

df -h | grep md127 ; mount | grep md127

/dev/md127 26T 14T 12T 55% /home/data

/dev/md127 on /home/data type ext4 (rw,relatime,stripe=1792,data=ordered)

Ext3 was 32k, but ext4 is 65k subfolder limit. I have run into this one before. The real solution is to do directory hashing when you get this crazy with tons of subfolders.

Looks like Amazon's EC2 ELBs have a common 1024 DH. I don't see a way to fix it without moving away from ELBs, or getting Amazon to fix it.

I personally use ssls.com. It is slightly cheaper than namecheap.com for multiple year, and it is actually namecheap.com by another name.

On a side note, I would only buy one year certificates at this point, because Lets Encrypt is about to make them free.

My issue with them is their client ssl certificate is cumbersome, and at least their free service is regularly down for "maintenance"

My solution for npm is to use fpm to make rpms of node modules. But this is fucked by node modules pull in all their dependencies into their own tree, and because a module will want semvers > 3, but npm wants semvers < 2.2. Hence you can't make a sane package per node module, you have to have a module and all it's dependencies in one rpm. The best example I have seen was a module for imagemin that was 17mb, but if you took out the dependencies it was 5k.

For bower, I am not aware of a tool. My solution so far, since I have only have seen it get used when running a gulp compile is to have my co-workers run bower install in their repo, and put the results in the repo.

You are right. Lack of it will be the next wave of security problems

As a operations person, this is the wrong way to go. The VPN becomes a single point of failure. Attempts at HA fail in my experience.

Also solutions like stunnel create a separate process that has to be managed. If I have one for redis, and then one for something else it is harder to tell them apart, because both will be named stunnel.

I bet this will be used by the FBI in the short term. They secretly track cars. A camera in the car would make this even easier.