Paul Querna

So on most real world applications, you shave perhaps a second or two off compilation and linking times. That's great, but... why does Go still have such an abysmal regexp package that is an order of magnitude slower than C and C++?[1] Why does encoding/json still rely on reflection, making it slow compared to other approaches?[2] In other words, I guess I feel like there are areas with more bang for the buck. The changes in 1.3 are great (100% precise garbage collection!), but I'm hoping improvements to regexp and encoding/json are somewhere on the roadmap as well. [1] http://benchmarksgame.alioth.debian.org/u64q/performance.php?test=rege… [2] https://journal.paul.querna.org/articles/2014/03/31/ffjson-faster-json…

While this is probably security related, disabling compression is actually a good practice for clients which make a large number of SSL requests (like a browser). OpenSSL allocates alot of memory per connection for compression/decompression. See http://journal.paul.querna.org/articles/2011/04/05/openssl-memory-use/ for a great discussion of why SSL_OP_NO_COMPRESSION might make sense for you. Even if you don't have direct access to the library code creating SSL objects, there are still some tricks with ctypes, ffi, dlopen that have the same effect.

Great to see this one: * Disable compression with OpenSSL. Improves memory perf. Guess/hope it means the issue described here is fixed automatically for everyone now: http://journal.paul.querna.org/articles/2011/04/05/openssl-memory-use/

Your chained cert might actually be the bottleneck if the total data exceeds 4K and the user has to do a second round trip to ACK the cert. http://journal.paul.querna.org/articles/2010/07/10/overclocking-mod_ss… Basically, unless you are certain you need it 4096 bit security, use a 2048 bit key (1024 is not secure anymore) and only include the minimum number of intermediate certs you can get away with. OSCP stapling doesn't seem worth it if it cause you to over flow the initial TCP window.

This is a really great step forward - thanks Mitchell! I've recently spent a couple of weeks doing a deep dive into Docker, so I'll share some insights from what I've learned. First, it's important to understand that Docker is an advanced optimization. Yes, it's extremely cool, but it is not a replacement for learning basic systems first. That might change someday, but currently, in order to use Docker in a production environment, you need to be a pro system administrator. A common misconception I see is this: "I can learn Docker and then I can run my own systems with out having to learn the other stuff!" Again, that may be the case sometime in the future, but it will be months or years until that's a reality. So what do you need to know before using Docker in production? Well, basic systems stuff. How to manage linux. How to manage networking, logs, monitoring, deployment, backups, security, etc. If you truly want to bypass learning the basics, then use Heroku or another similar service that handles much of that for you. Docker is not the answer. If you already have a good grasp on systems administration, then your current systems should have: - secured least-privilege access (key based logins, firewalls, fail2ban, etc) - restorable secure off-site database backups - automated system setup (using Ansible, Puppet, etc) - automated deploys - automated provisioning - monitoring of all critical services - and more (I'm writing this on the…

Is SNI plaintext? I understand that it's part of the TLS handshake[1]. DNSCrypt is just an additional layer of security. You can use a VPN or Proxy along with DNSCrypt & DNSSEC if the purpose is to avoid Gov monitoring. [1]: https://journal.paul.querna.org/articles/2005/04/24/tls-server-name-in…

When you use a remote blockstore like they are as your storage, you also generally are always booting via PXE, and so far have a provider controlled kernel. I used to work on Rackspace OnMetal: http://www.rackspace.com/cloud/servers/onmetal https://journal.paul.querna.org/articles/2014/07/02/putting-teeth-in-o… In OnMetal this not the case -- you get local storage, you have your local kernel that you can re-install or do whatever you want to -- and if we have a control plane outage, you can reboot -- there is no dependency once your server is created on a provider hosted PXE server. OnMetal isn't cheapo-ARM servers, but it is possible to build a "bare metal" cloud, which is truly bare metal, like you would normally get, and no remote block stores for your root FS.

There are libraries that generate specialized marshallers to fix precisely this issue: https://journal.paul.querna.org/articles/2014/03/31/ffjson-faster-json…

My time as a system administrator makes me rather fond of logging as text into files. They're simple, easy to scale, to rotate, to compress and to throw away. One variation on this theme that I read about recently is to produce log lines as JSON objects rather than more "traditional" printf-formatted text. This gives machine readability but also makes for really simple tools for extracting whatever "traditional" log lines you like. (see: https://github.com/trentm/json) You can also easily add new fields without breaking existing log parsing code. I believe I first read about logging in JSON here: http://journal.paul.querna.org/articles/2011/12/26/log-for-machines-in…

It is a nice idea. But I think writing Logs as JSON is still a lot more practical. The idea of writing Logs as JSON has been out for a while, and in my experience, JSON is far more practical. This is also a good article regarding Logs as JSON: http://journal.paul.querna.org/articles/2011/12/26/log-for-machines-in…

Bit of commentary from somebody who was there (but didn't see anything): http://journal.paul.querna.org/articles/2010/11/06/disappointed/

There are some server-side implementation notes here, focused on Apache: http://journal.paul.querna.org/articles/2010/07/10/overclocking-mod_ss… http://www.imperialviolet.org/2010/09/05/blacklisting.html is also interesting; it says Chrome will use a blacklist to avoid using False Start on some domains. Also, does anyone know which older clients require that the server cache the session information? The article doesn't say.

No idea and probably not. The Bloglines podserver/itemdb was built internally. You can get some idea of the setup by reading the slides from pquerna's GeekSession's talk: http://journal.paul.querna.org/wp-content/uploads/2007/10/bl-geeksessi…

this is our ssl optimisation list. it has some tradeoffs like using small keys (1024bit) which may not be appropriate in a lot of situations. 1. Don't use ephemeral diffie helman for key negotiation. This means if an attacker compromises your private key in the future he can decrypt all your past transactions he has recorded. But it does give a nice speed boost. Understand the security implications and if you are happy with the tradeoff do it. More information here: http://matt.io/technobabble/hivemind_devops_alert:_nginx_does_not_suck… 2. Use RC4_128 + SHA1. Force clients to use this use server cipher order. (google does this) http://journal.paul.querna.org/articles/2010/07/10/overclocking-mod_ss… 3. Use 1024 bit keys. (google does this) 2048bit is much much more expensive. 4. Use ssl session caching and make sure you have some kind of sticky session support or have some way of sharing sessions between your web nodes. haproxy can do it by ip or by ssl session id. 5. When you are dealing with a lot of traffic understand whether you can handle keep alives or not. If you can't handle keep alives turn them off. Keep-alives will improve ssl performance by quite a big deal if clients are doing multiple requests but if you don't have the resources to handle them then they kill your servers.