
Read John Resig's blog post for more details:
Read John Resig's blog post for more details:
You could do exactly the same using very simple Knockout. It wouldn't be as funky, but it would be something you'd be happy to use in production.
This language conveys so much more competence than the standard 'seeking unix ninja rockstar' stuff that seems to be de rigeur these days.
Phrases like: "You must have experience designing and building large and complex (yet maintainable) systems" are so vague and ambiguous that if I honestly saw this post from some guy named "Bezos" in '94, I would have written off as a jokester.
At least in '94 they haven't started using the word "disruptive" as if it's something you can do to a whole industry overnight. Thank goodness.
It's grep, just better. It highlights the selected text, it shows which files, and in what line the text was found (and uses vivid colors so you can distinguish them easily), ignores .git and .hg directories (among others, that shouldn't be searched) by default, you can tell it to search, for example for only `--cpp` or `--objc` or `--ruby` or `--text` files (with a flag, not a filename pattern), and many many other neat features that I'm sure grep has, but you have to remember and memorize them. ack has sensible defaults.
Why ack?
manpage:
Oh, and ack is written in perl and doesn't require admin privileges to install.
brew install
Someone commented on the article that this might be caused by missing off the -F flag; I tried this, and -F makes both versions slightly faster again.
My only concern is what about search engine visibility? If I were to build an app like this with Meteor would Google see the page content?
I think there are lot's of improvements that could be made to sites like Reddit/HN. But thanks a lot for open sourcing it this will be very helpful to me in learning meteor!
edit: Just noticed you are planning on writing a book. Can't wait!
P.S. I'm a subscriber to your newsletter -- great stuff! Keep it up.
Congrats, I knew you'd make the front page, Sacha! And so good to know it's holding up, that changes my plans considerably, I'll plod on full steam on top of Telescope and Meteor.
For context, I forked this app for an MVP[1] showing Meteor's own roadmap, up for vote, in HN-clone format, which went live only a week ago[2].
[1]
[2]
This means it's just a "source available" app but normal copyright applies. I think this can be a bit misleading but nonetheless congratulations!
I've been skeptical of Meteor, but this speaks well for it.
Still concerned about the security/data leakage/authentication methodology though.
Thanks for posting this, awesome to see examples of polished Meteor projects!
Update with link to demo, looks very nice:
Aside from that, I don't see the utility of being able to see the stories change order, or comments come in. Especially once you have large numbers of comments and the stories reorder constantly.
I just don't see what is so interesting about Meteor - and I love node.js and JavaScript.
It is incredibly frustrating that in order to be able to find an email I received years ago I have to figure out exactly how someone might have written a certain term in that mail. And I cannot see any excuse for not offering that feature; limit me to a few substring searches a day if resources are an issue and I don't expect fully-indexed lightning-fast results, a simple "grep" so to speak is just fine...but please let me search my mails properly!
In related news nytimes.com used to have a similar feature where the definition of words would pop up when you selected them. It basically caused me to stop reading their site.
I guess RMS has a point.
I honestly think HN should be doing more about linkbait like this.
"I haven't heard of this feature" != "no one knows about this feature".
Here is the email feature I want. If I paste a URL that looks like a post/article into a new message, I want the slug automagically split, title cased and copied into the subject line.
For example:
The Greatest Google Mail Feature You
Similarly, BufferApp post with the selected text instead of the title.
This is indeed a good UX feature and people should use this where it make sense - select text and put it in context with the next action.
[1]
[2]
Off topic, but a similar feature exists in Pinboard (). You can select some text on the page before clicking bookmark, and that gets set as the description of the page in the bookmark. It's a pretty handy feature if the page title is not enough to describe what the page is about.
We're not talking about false positives, these are emails that stay in my inbox for days before being moved to the spam folder. Which basically means I need to check my spam folder every day. Trust forever lost.
The greatest feature about Gmail that not enough use is 2-factor auth (even though it is not limited to Gmail- other web-based mail services provide it); it is a pain in the arse, but after you get hacked once or twice, you'll be happy you did it. Popular Saas apps are prime targets for being hacked. It may mean they are safer, but they are also riskier to use. If you're not using 2-factor auth, you should probably not use Gmail, unless a hacker taking control of your account wouldn't bother you or your contacts.
But I'm looking at the on/off radio button in labs in another tab right now.
most of my email flows like a conversation, i don't need to bring back older parts if my recipient already has them in front of him.
Amazon attempts to ease the pain by offering "interface parity" with the Google Maps API, but there are significant functional differences.
We are going to see more and more examples of this where mobile platform vendors are going to try to get developers to use their firm's web services when running on their platform. Bummer for devs who are already struggling with trying to target multiple platforms.
[1]...
demo looks like a demo. basically it's because they're not part of the android group. do they have the google maps api libraries on the device? just curious i honestly don't know. I'd imagine there are licensing issues?
The advantage they have is a female plug, you can't physically break it like standard usb key (most of these keys are broken after a year).
But they're disappearing too, people tend to paint walls :)
Also, there is a sizable amount of dependencies for this library, all due to the use of flot. Since most of the code doesn't use any of the dependencies, I wonder if they would consider releasing any future versions as two parts, jstat.js (containing the number crunching methods) and jstat-flot.js (containing the plotting wrapper methods).
I almost thought they weren't on GitHub.
P.S. Functionn contains a whole lot more of awesome resources like jStat. There only a fraction of them I can post here at a time. Take a look if you're interested, and subscribe:
Sold. Given the amount of prototyping I do on my workstation requiring constant review of previous revisions for collaboration, this is something that lets me get a link sent and stays as far out of the way of my workflow as possible-and it supports an application my team already uses? Yep. Sold.
I might fork this so I can add the option to define which directory in /Public, since I'm OCD like that (having stray files kills me). Thanks for this!
That is why I use a hacked version of Gyazo (). I modified the script so that moves the file to dropbox instead of their monstrosity of a share page.
Gyazo is the best because you launch the app, are presented with a standard screenshot UI, and then the app closes and your URL is copied and opened in a browser.
Here is my modified gyazo script if you want to try it:
I gave it a whirl:
1. Snappy, which is nice, since PyCharm can be sluggish on my Mac
2. No VCS integration
3. By default very strict code checking is turned on, which turns my (functional) code into a sea of underlines, which is not so pretty
It looks to be an interesting start, but it will need VCS integration before it looks suitable as a PyCharm replacement.
I didn't look in detail at code completion/code assist, which PyCharm does very well.
(Seriously, check it out - KDevelop's Python plugin and Microsoft's PTVS are currently the two projects doing serious work on static analysis of Python for live editing purposes. Here's a nice subthread comparing the two:)
* Scrolling is way too slow. This isn't nitpicking, this is really very important to me
* I like PEP8 warnings and use them in other editors, but I don't like not being able to pick which style stuff I care about
* I don't like the PEP8 tooltips. They cover up my code and that's the worst possible place to put them. Even if I do plan to "fix" the issue, coming up over the code that I'm typing right now is never okay.
* It's really quite a lot of work through some confusing terminology to get a test run of the IDE going on an existing project. I don't want to move my code into your workspace. I don't want to import my existing project (that sounds scary)
* Some glaring bugs seem to indicate that this is more young than is indicated on the very flashy project site. For instance, if I try to import a project but cancel the "select a directory" popup, I inconsistently get it either removing my previous selection or crashing the whole IDE
Also, changing the margin line doesn't seem to take effect unless you quit and restart the IDE.
Thank you.
From a usability perspective, your download button could be better. It doesn't download right away (which is fine), but redirects to downloads/win for me. Might be nice to have it auto-scroll to the win downloads since it took me a while to figure out what was going on.
Here's a screenshot from Win7 32-bit:
That random pink line makes it unusable for me.
I hope we can find the time to take care of some of the stuff mentioned here as videos, screenshots, user guide, etc.
It's a lot of work, but we are proud of what we can achieve with a free software project.
Thx everyone!
All in all it looks very nice, thanks for sharing.
I've been looking forever for a text editor that does this and surprisingly few do.
Looks good though. I thought it was going to be YET ANOTHER ECLIPSE distribution, but apparently it's not. It seems to be pretty fast. Hope they fix the crashing issue on Lion soon.
Also, I think would be nice if there was a way to interact with the console after running a script. I realize this may be sort of an odd request, but it is very convenient when you're not quite sure on how you want to solve a problem, and you need to try out some solutions interactively. I greatly enjoy this in spyder, my current python ide of choice.
Go on
Yeah! Some jerk who runs my MTA set the size of acceptable attachments really low! I wonder who did that...
$ host -t mx mydomain.com
mydomain.com mail is handled by 0 aspmx.l.google.com.
Oh... I see.
Sending and sharing files are two of those things that are just now sluggishly rolling over to discover that it's a new millennium.
Dropbox and Drive are making great strides lately and I'm really thankful for it. Using Dropbox to have the same "folder" across three computers is the first time synced sharing ever felt intuitive enough for my (71 year old) father to regularly use, and now he can use this to reliably send larger files to people without any worry of fouling up permissions (that would otherwise be difficult for him to understand).
That's why i just run my own "cloud" on my own premises. If I want to give someone access to a file, I just throw it on my Synology DiskStation and the receiver can get at it via FTP or HTTP client.).
EDIT: I guess it's a moot point if you're already using Gmail.
I use Google's cloud-based services for as much as I can, but it's still not seamless and is annoying when I have to open a new window to access a service run by the same company providing the one in the page I'm on.
Next step: Please allow me to easily save PDF's and other documents directly to Drive from a URL. I shouldn't have to download a file to my device and then upload it to drive.
disclaimer: I work for a Google competitor
From it I was able to figure out what was wrong with the C++ program. Notice that the GPF lists the instructions at CS:EIP (the instruction pointer of the running program) and so it was possible by generating assembler output from the C++ program to identify the function/method being executed. From the registers it was possible to identify that one of the parameters was a null pointer (something like ECX being 00000000) and from that information work back up the code to figure out under what conditions that pointer could be null.
Just from that screenshot the bug was identified and fixed.
One of the suggestions was that the kernel could do more. Solaris-based systems (illumos, SmartOS, OmniOS, etc.) do detect both correctable and uncorrectable memory issues. Errors may still cause a process to crash, but they also raise faults to notify system administrators what's happened. You don't have to guess whether you experienced a DIMM failure. After such errors, the OS then removes faulty pages from service. Of course, none of this has any performance impact until an error occurs, and then the impact is pretty minimal.
There's a fuller explanation here:...
I haven't seen a server without ECC memory for years. I don't even consider running anything in production without ECC memory, let alone VM hypervisors. I find it pretty hard to believe that EC2 instances run on non-ECC memory hosts, risking serious data loss for their clients.
Memory errors can be catastrophic. Just imagine a single bit flip in some in-memory filesystem data structure: the OS just happily goes on corrupting your files, assuming everything's OK, until you notice it and half your data is already lost.
Been there (on a development box, but nevertheless).
Note the section on DRAM scrubbing, which I was reminded of from the original article's suggestion on having the kernel scan for memory errors. (I remember when Sun implemented scrubbing, I believe in response to a manufacturing issue that compromised the reliability of some DIMMs.)
It only does a few things, but it does them exceedingly well. Just like nginx, I know it will be fast and reliable, and it is this kind of crazed attention to detail that gets it there.
Although our production code is written in C, I'm not particularly worried about detecting wild writes, because we use pointer checking algorithms to detect/prevent them in the compiler. (Of course, that could be buggy too...)
What I'm trying to catch are wild writes from other devices that have access to RAM. Anyway, this is far from production code so far, but hashing has already been very successful at keeping data structures on disk consistent (a la ZFS, git), so applying the same approach to memory seems like the next step.
The speed hit is surprisingly low, 10-20%, and when you put it that way, it's like running your software on a 6 month old computer. So much of the safety stuff we refuse to do "for performance" would be like running on top-of-the-line hardware three years ago, but safely. That seems like a worthwhile trade to me...
P.s. Are people really not burning in their server hardware with memtest86? We run it for 7 days on all new hardware, and I figured that was pretty standard...
Now, this may not be such a huge problem in practice because the OS is unlikely to move pages around unless it's forced to swap. But that depends on details of the OS paging algorithm and your server load.
In my experience in more 'agile' firms - startups, web dev shops and so on - it would be very hard to make a scheme like this work well, because of all the grinding bureaucracy, fiddly spec-matching and endless manual testing required, as well as the importance of controlling - and deeply understanding - the whole stack. Nonetheless, for infrastructure projects like Redis, I can see value in having engineering effort put explicitly into making 'prettier crashes'.
Here is a variation which, unless I'm missing something, would be a little simpler still and require less full-memory loops:
1. Count #1's in memory (possibly mod N to avoid overflow).
2. Invert memory.
3. Count #0's in memory.
4 Invert memory.
I think this would catch the same errors (stuck-as-0 or stuck-as-1 bits).
One difficulty is that multiple errors could cancel each other out, at which point you can do things like add checkpoints in the aggregation, or track more signals such as number of 01's vs number of 10's. In the end, this is like an inversion-friendly CRC.
Here are my additional two cents: At least on X86 systems, to check small memory regions without effects on the CPU cache can be implemented using non-temporal writes that will directly force the CPU to write the memory back to memory. The instruction required for this is called movntdq and is generated by the SSE2 intrinsic _mm_stream_si128().
I think the title of the article could be more accurate, considering how much is devoted not to issues about software reliability per se, but to distinguishing between unreliable software and unreliable hardware. I think an implicit assumption in most discussions about software reliability is that the hardware has been verified.
I personally do not think that it is the responsibility of a database to perform diagnostics on its host system, although I can sympathize with the pragmatic requirement.
When I am determining the cause of a software failure or crash, the very first thing I always want to know is: is the problem reproducible? If not, the bug report is automatically classified as suspect. It's usually not feasible to investigate a failure that only happened once and cannot be reproduced. Ideally, the problem can be reproduced on two different machines.
What we're always looking for when investigating a bug are ways to increase our confidence that we know the situation (or class of situation) in which the bug arises. And one way to do this is to eliminate as many variables as possible. As a support specialists trying to solve a faulty computer or program, I followed the same course: isolate the cause by a process of elimination. When everything else has been eliminated, whatever you are left with is the cause.
I'm still all jonesed up for a good discussion about software reliability. antirez raised interesting questions about how to define software that is working properly or not. While I'm all for testing, there are ways to design and architect software that makes it more or less amenable to testing. Or more specifically, to make it easier or harder to provide full coverage.
I've always been intrigued by the idea that the most reliable software programs are usually compilers. I believe that is because computer languages are amongst the most carefully specified kind of program input. Whereas so many computer programs accept very poorly specified kinds of input, like user interface actions mixed with text and network traffic, which is at higher risk of having ambiguous elements. (For all their complexity, compilers have it easier in some regards: they have a very specific job to do, and they only run briefly in batch operations, producing a single output from a single input. Any data mutations originate from within the compiler itself, not from the inputs they are processing.)
In any case, I believe that the key to reliable programs depends upon the a complete and unambiguous definition of any and all data types used by those programs, as well as complete and unambiguous definitions of the legitimate mutations that can be made to those data types. If we can guarantee that only valid data is provided to an operation, and guarantee that each such operation produces only legitimate data, then we reduce the chances of corrupting our data. (Transactional memory is such an awesome thing. I only wish it was available in C family languages.)
One of my crazy ideas is that all programs should have a "pure" kernel with a single interface, either a text or binary language interface, and this kernel is the only part that can access user data. Any other tool has to be built on top of this. So this would include any application built with a database back-end.
I suppose that a lot of Hacker News readers, being web developers, already work on products featuring such partitioning. But for desktop software developers who work with their own in-memory data structures and their own disk file formats, it's not so common or self-evident. Then again, even programs that do rely on a dedicated external data store also keep a lot of other kinds of data around, which may not be true user data, but can still be corrupted and cause either crashes or program misbehaviour.
In any case, I suspect that this is going to be an inevitable side-effect of various security initiatives for desktop software, like Apple's XPC. The same techniques used to partition different parts of a program to restrict their access to different resources often lead to also partitioning operations on different kinds of data, including transient representations in the user interface.
Can a program like Redis be further decomposed into layers to handle tasks focussed on different kinds of data to achieve even better operational isolation, and thereby make it easier to find and fix bugs?
This post is fantastic.....
It appears Linode removed the 768 and 1536 plans, renamed the 1024/2048/4096 plans to 1GB/2GB/4GB, and added an 8GB plan. They also added a row in the table showing CPU priority. The 512 plan is unchanged, as are specs and prices for the other three remaining plans.
Linode's "priority" seems like ex-Slicehost's way of saying "hey bigger machines get a higher proportion"... nothing really useful for figuring out exactly what you're buying.
And you can't ever really figure out what you have: things could be severely over-committed, and you'll never know until you get starved. So you can't just benchmark your way out of it.
Unless that's changed, that would mean that all instances running on a given machine share the same CPU Priority, there will just be fewer instances demanding service from the CPU(s) the larger the plan you have.
...so wondering if that's what CPU Priority means, or if Linode is about to mix instance sizes on same hardware?
And maybe I'm just ignorant on the topic, but what exactly does CPU priority do here? I understand basic linux process priority (like the 'nice' command), but how exactly does CPU priority behave on linode. Searching through their docs, I couldn't find anything.
EDIT: to maybe answer my own question, maybe this is the Xen credit schedule?
For my needs, $30/mo was about as much as I'd spend on a server to host mine and a few friend's blogs, some photos, and some remote services. $40 is too much for me and the lower plan just doesn't have enough RAM to be interesting.
So now my options are 1) find somewhere else, or 2) backup my data and rebuild the box in place.
0 - I manage a few Linode 768s including my own. 768 was a great size for a few small blogs and a low traffic Rails site, or a larger traffic blog.
I'm assuming that meant access to part of a processor, but how does that work with 4 CPU and 16x priority? (I'm working on the assumption that 1x priority ~= 1 core.) Of course, my assumption is probably wrong - just curious how this affects the load on a given server and how the VPS interacts with other VPS's on that node.
So what is the appeal of Linode? That you can upgrade to a faster server quickly?
It's quite easy to get a decent micro HP server (even with SSD storage) within $1000, which would cost $150.00 - $300.00 a month for a equivalent plan on Linode. Suppose you upgrade your server every two years, the monthly cost of the server is less than $50. You get dedicated CPU time and I/O, permissions to managing everything.
Internet bandwidth might be a problem. But let's put ourselves in the 2 or 3 years future. What if you already have Gigabit Internet like Google Fiber for $70/mo?
And you get other benefits for owning a server in your house. Since it's connected to your home LAN, it can be used to help build a smart home, control smart sensors/cameras, or serve as a media server.
Am I missing something here?
(We setup a few vps's with rackspace and have been happy so far.)
EC2 is good but their spin-up time is crap.
Though same-kernel is obviously a security reduction, the speed is far better: I for one can't wait to see more LXC and other lightweight virt stuff being made available with real cgroup-level guarantees.
About CPU priority, Linode never kept it a secret.
For the small VPS (512MB RAM), you get a guaranteed 1/20 of a 4 core XEON processor and it scales linearly with each plan's RAM.
As explained on their FAQ, their machines have 8 cores each and house 40 512MB VPS.
For those that don't remember hackers managed to get root access to several VPS via some Linode vulnerability. Didn't bother to let customers know. Didn't bother to update their status/website. Didn't bother to tell anyone what they've done to fix it. Compare that with CloudFlare:...
Linode continues to be a recurring example of how not to behave as a vendor.
Knowing whether the stock is likely to go up or down is dangerous without having some model of how much it will go up or down. It could have a 90% chance of going up but with a negative expected return (because if it goes up it will only go up slightly but if it goes down it will crash).
I wonder if this guy understands this? His "up/down" language suggests that maybe he doesnt and his group is only making money by "picking up pennies in front of a steamroller".
Monty Hall and the Birthday problem? Are they still asking these old hackneyed interview questions!?
As a whole everything this guy said in the interview sounds a bit naive/old-hat. Are people really still blindly trading the correlation between MSFT and Oil?
The whole interview reads like what a junior statistics graduate thinks quant trading funds do rather than how they actually make money nowadays.
It's like he hasn't even read Fooled by Randomness....
-- zero value added, in other words.[1]
________________
[1] Front running is not the only use of statistics and quants in finance, however.
"Video content is protected with our BrainTrust™ DRM, and is unplayable except by a legitimate owner. All aspects of the platform feature a near-ridiculous level of security."
Near-ridiculous security seems about right.
I'm not saying this is right, necessarily, but I think companies know full well that their DRM scheme will be broken, so it's not really worth investing in an "uncrackable" and costly solution. Instead, the role that DRM play is purely legal -- when the company does decide to go after someone for piracy, the DRM scheme, no matter how simple, provides them with the ability to say that the accused person "broke a lock," rather than simply walking in through an unlocked door. "Entering" vs. "breaking and entering." It's nothing but legal leverage, and effective at that role even if it's not a very strong lock.
Of course, to have this argument hold, a company would never be able to admit that they purposefully implemented weak security -- this would be akin to admitting that their door was unlocked afterall, and would weaken their legal argument. Therefore, there remains a niche in the market for solutions that look secure even if they fundamentally aren't. It's all about lip service.
Of course this is only marginally better and should really have been caught, but there's a huge difference between saying that XORing 12 bytes with RANDOM_STRING is kick-ass DRM and actually having a kick-ass DRM infrastructure that then doesn't work right because of a bug.
If this was any really random looking string, I would be more inclined to assume that this was intentional. By the string being this token, I would guess it's a bug somewhere.
Remember. If RANDOM_STRING was truly random, unique per file and account and only transmitted from the server before playing, then this would be as good an encryption as any.
Given the evidence (complex integration with a non-standard set of open source libs, complex industry area in general), I'd say it's almost certainly an insult to imagine the developer could not have made your life harder if he'd chosen to.
Please, if anything commend the dear fellow, and shame on whoever considered a momentary glimpse of Google Plus limelight worth making this guy's Tuesday morning and ongoing professional reputation much harder earned than it otherwise might have been.
"No good deed goes unpunished"
Ahh..the good old days of SoftICE and w32disassm.
Oh man, the worst was the md5 of some salt + whatever you put in.
If you ever want to see some gems of misuse of cryptography for DRM management, let me know - email's in my profile.
Some examples: Using RSA 1024 bit keys, with exponent of 3...
Of course, if a copy protection system was "effective" it wouldn't need a law prohibiting its circumvention. Conversely, if a copy protection system is circumventable, it's not effective.
[1] Assuming a general computation device, not a dedicated hardware player.
Either way.. wow... XOR encryption with just such a short repeating string! I bet it wouldn't be too hard to decrypt it even without the original file, since the file signature alone would probably be longer than the string. DISCLAIMER: I'm just speculating, I don't know the .mov specs.
The problem is marketing folks getting carried away when describing these "technology solutions" to the content owner, because that's what they (as well as VCs) want to hear.
Disclaimer: cofounded a video CDN+DRM provider more than a decade ago, developed many content protection methods over the years.
Now that I read the article twice, I literally got a panic attack when I realized that it wasn't a random string that they were xor'ing their data with, but a string called "RANDOM_STRING". Although it sounds bad, one must realize that this is not security by obscurity since the key has been leaked, and nobody guarantees encryption against a leaked key.
Isn't VLC licensed under the GPL? Or at least was until very recently?...
Is/was Leaping Brain violating the license?
EDIT: the wrapper script is apparently released under the GPL too:
It might be a good idea to remove their names, to protect their reputation. ;-)
As far as I recall the Adobe PDF encryption was also just some XOR with a simple passphrase. Got him into serious trouble.
And WTH is 'virtually uncrackable'?
But did the NYTimes just point to California's current budget as a sign of our State's "economic stability"?
They quote that the "California Legislative Analyst's Office projecting . . . . [that] California might post a $1 billion surplus in 2014"
That is such an irresponsible thing to publish - a "surplus" makes it sound like the government is totally on top of the situation here and a model for success.
The reality is that CA would be going off the @!@W$! rails right now in 2012 if voters hadn't just passed Prop 30.
Prop 30 was an EMERGENCY, retroactive (from Jan 1 2012), and "short-term" (7 year) tax on high income earners + a moderate increase in sales tax which is going to raise $6B a YEAR to pull CA's ass out of the fire.
So while the gloom may be lifting, I remain pessimistic that our state gov't has any long-term solutions to their continued budgetary missteps.
I wonder what jgrahamc has to say about Cloudflare shielding sites used to ddos people.
Instead, go with what your distribution gives you. The people who put your favourite distribution together work on making the system safe and secure as a whole. People who don't think it is safe and secure file bugs and they get fixed. And you have one place to get all your updates in case fixes are needed.
If you start adding third party sources, you're on your own as to managing any implications of the way you've put it together. Just because each individual component is safe and secure doesn't mean that it is as a whole. For example, Ubuntu add hardening (AppArmor) for various server daemons which you won't get if you just download apache from the project website.
If you need a guide on putting a system together yourself, then you aren't someone who can manage these implications yourself, and you're trusting the guide author in not having made any mistakes. Are you really in a position to judge his competence?
Just use your distribution's standard web server and you'll get your safe and secure Web server in one command.
Virtualization was build for server providers to make easy money, not for server owners to gain performance advantages.
Vistualization is not for production. Production servers need less code, not more.
It is the same kind of mistake as JVM - we need less code, integrated with OS, not more "isolated" crapware which needs networking, AIO and really quick access to the code from shared libraries.
And, of course, a setup without middle-ware (python-wsgi, etc) and several storage back-ends (redis, postgres) is meaningless.
Update:
Well, production is not about having a big server which is almost always 100% idle, and can be partitioned (with KVM, not a third-party product) to make a few semi-independent virtual servers 99% idle. This is virtual, imaginary advantage.
On the other side, your network card and your storage system cannot be partitioned efficiently, despite all they say in commercials. And that VM migration is also nonsense. You are running, say, a MySQL instance. Can you migrate it without a shutdown and then taking a snapshot of an FS? No. So, what migration you're talking about? It is all about your data, not about having a copy of a disk-image.
It is OK to partition development, or 100% idle machines - like almost all those Linode instances, which have a couple of page request in a day - this is what it was made for, same as old plain Apache virtual-hosting. But as long as one needs performance and low latency, all the middle-men must go away.
I sense a little bit of bias.
As a multiplatform developer I can think of a number of reasons why someone might opt to go the Windows Server route. ASP.NET MVC 4 is a first class framework and many prefer it over other popular alternatives on other platforms such as Django, Rails, and Cake. In addition, Visual Studio is arguably the best IDE available and publishing to an IIS server is dead simple.
As for cost, full versions of Visual Studio and Windows Server can both be obtained for free through the DreamSpark program for college students and through the similar BizSpark program for startups and small businesses.
as well as doing chkrootkit.
Also a good idea to have your log files backed up somewhere else where your server does not have sufficient access to delete (or modify) them.
Also if you have multiple web apps running, chroot them if at all possible so that if something does break out it can't (so easily) wreak havok over your entire filesystem.
If you are using PHP also bare in mind that a common default is for all sessions to be written to /tmp which is world read and writeable. So if others have access to your server they can steal or destroy sessions easily.
I also didn't see mention of an update strategy for security updates. You can use apticron to email you with which updates are available and which are important for security.
You can set updates to go automatically (I recommend security only) but if you are more cautious
you might want to test on a VM first. But keep an eye on them! This is very important, especially if you are managing wordpress etc through apt.
And so many other things that I have probably forgotten.
Having some form of audit (that tripwire can provide) is vital in those "oh fuck" moments where something doesn't seem quite right and you start wondering if you have been pwned but have no real way of actually knowing.
If you have a small server, I'd really recommend checking out these scripts that assist with configuring and setting up a server very quickly:
I personally used a fork of lowendscript last year to set up some servers, but if I had to set up a new server today, I'd check out some of the other other options at that link, like Minstall:
But this Xeoncross lowendscript fork is still very active:
Why? Because it doesn't really mention a technical choice against MS.
Don't get me wrong i would never ever use Windows Server but when i'd write such an article i'd have to find at least a few technical pros and cons for the choices i preset.
"Uhhh, the internet is more like a unixy thing" doesn't cut it.
This goes on with the choice for Ubuntu Server. Why? Is it an article about "safe and secure web server" or about "how does my grandma set up a server"?
There are much more choices in terms of reliability and proven track record like FreeBSD, OpenBSD, Debian, RHEL/CentOS. The choice was made because it's easier to set up and apparently the author is too lazy to _really_ do his homework.
In the end, i'd say if the articles title would be "beginners guide how to setup a server" i wouldn't comlain.....
Has ECC RAM support. Takes 4 3.5" hard disks, and runs very quiet and cool.
I feel like doing this stuff by hand should be considered insecure and outdated.....
also, chrooted sftp-only accounts...
All the nginx setup and config things are REALLY useful, all the more regarding the poor quantity/quality of resources one can find out there. Really useful to me. I wish I had one guide like this when I setup my own webserver.
I made a tl;dr version but the main interesting parts stay all the nginx tricks for me.
can't believe that hasn't been on HN before, so added it: