Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Website hosted on a 24 year old Linux server

raq.serialport.org

Post reply on HN
Print view View original

21–30 of 131 posts

Re: Website hosted on a 24 year old Linux server

#21

Post by Supermancho »

ElectricalUnion wrote: post #13
seba_dos1 wrote: post #10

Earlier quoted context omitted.

> Doing this in modern times would be so complicated. No, it wouldn't. All you need to store this kind of data is a simple file. Most people would probably use PHP for something like that due to its ubiquity, but it could even be a few lines of bash, or Python, or Go, or whatever...

> All you need to store this kind of data is a simple file. You mostly likely need a WAL Mode SQLite database. Most of the time, it's way simpler that handling state handling in concurrent situations yourself. (also, bindings are often available - if not outright bundled by default - under most common languages) The "easy" way is all fun and games until your file is accessed in a concurrent fashion, and then your opt…

> You mostly likely need a WAL Mode SQLite database

Or redis.

Re: Website hosted on a 24 year old Linux server

#22

Post by doublerabbit »

ElectricalUnion wrote: post #13
seba_dos1 wrote: post #10

Earlier quoted context omitted.

> Doing this in modern times would be so complicated. No, it wouldn't. All you need to store this kind of data is a simple file. Most people would probably use PHP for something like that due to its ubiquity, but it could even be a few lines of bash, or Python, or Go, or whatever...

> All you need to store this kind of data is a simple file. You mostly likely need a WAL Mode SQLite database. Most of the time, it's way simpler that handling state handling in concurrent situations yourself. (also, bindings are often available - if not outright bundled by default - under most common languages) The "easy" way is all fun and games until your file is accessed in a concurrent fashion, and then your opt…

> You mostly likely need a WAL Mode SQLite database.

Overkill, If you are writing to the text file only to increment a number of visitors, none of what you mentioned above is even required.

Create a "counter-hit" file for each visitor, count the number of files in the resources directory. Populate the master file with the file count and delete all the temporary files. Configure it on a crontab for say every three seconds.

Online now was even easier. IFrame refresh within the homepage. Upon refresh, populate the file with something like "online=true". Read the file every X, if the file modifcation hasn't been refreshed within 30 seconds, nerf the text file and mark that user as offline. psuedo-dynamic, but times were different then. I coded these in perl back in the day for my RTCW clan and how I miss it much.

Being a webmaster was art, an art that's now lost..

Re: Website hosted on a 24 year old Linux server

#24

Post by Aachen »

ashleyn wrote: post #2

Surely hope that isn't running a 24-year old Linux distribution...

Is there actually a bug that's remotely exploitable in the TCP stack, if you drop everything besides bound tcp ports in iptables?

Any time I see a customer using an ssh or apache version from ten years ago (different from the kernel, but the kernel doesn't give you version disclosure), the list of bugs is all like "if they use RewriteRule and the second URI parameter is echoed unfiltered into a Location header by the application code and it's on Windows then you can do something actually interesting. The standard services' standard feature set is annoyingly boring when outdated ... most of the time.

Predictable sequence numbers would be my first worry, but with TLS and SSH being the main protocols of relevance, it doesn't really matter if you can send off-path traffic into a TCP connection.

Re: Website hosted on a 24 year old Linux server

#25

Post by electroly »

bombcar wrote: post #17
ladberg wrote: post #11

Earlier quoted context omitted.

It's not, Cloudflare is just being used for rate limiting / ddos protection here.

How can you tell the difference between cloud flare caching and cloud flare ddos alone?

The "CF-Cache-Status: DYNAMIC" response header seems to indicate that the file was not cached.

https://developers.cloudflare.com/cache/about/default-cache-...

> Cloudflare does not consider the asset eligible to cache and your Cloudflare settings do not explicitly instruct Cloudflare to cache the asset. Instead, the asset was requested from the origin web server. Use Page Rules to implement custom caching options.

Re: Website hosted on a 24 year old Linux server

#26

Post by xwdv »

sillysaurusx wrote: post #5

I remember how magical and mysterious a view counter used to feel when I was a kid. How did the website know when someone visited it? Where was the count stored? And how on earth could a website update its own HTML to show the new count? Geocities days were magical. I wonder if kids today have similar thoughts about Twitter profiles and such. It’s probably much easier to pick up the knowledge — back then, it was balk…

Young kids today do not have any kind of thoughts about the workings of apps they use any more than they have thoughts about how their favorite shows or movies are made, or how their house was built, or how a car works.

Re: Website hosted on a 24 year old Linux server

#28

Post by ladberg »

Aachen wrote: post #15
ladberg wrote: post #11

Earlier quoted context omitted.

It's not, Cloudflare is just being used for rate limiting / ddos protection here.

Never needed that on my server that's now also a decade old laptop. At least, not for the kind of attention HN#1 gets you (perhaps r/all #1 would be different). I can also imagine it being useful if you run a site that attracts controversy, or if your livelihood depends on it but you're not big enough to have your own datacenter and people want to extort that. Neither is really the case for me, I guess people don't p…

I think it's a reasonably good precaution to take with a 24 year old server. I'd imagine on hardware that old you could easily get DOSed by a single mean client (or a web scraper bot with bad behavior), so a ddos isn't even needed.

Also this is available on Cloudflare's free plan so it's much safer to take the precaution in case you might need it down the line, rather than get taken down and have to fiddle with setting up Cloudflare on the spot.

Re: Website hosted on a 24 year old Linux server

#29

Post by minsight »

ashleyn wrote: post #2

Surely hope that isn't running a 24-year old Linux distribution...

I had one of these for my first dedicated server. I kept up with the vendor's updates but it still was compromised. So I hope it wasn't running a 24-year old Linux distribution 24 years ago.

Re: Website hosted on a 24 year old Linux server

#30

Post by Aachen »

ladberg wrote: post #28
Aachen wrote: post #15

Earlier quoted context omitted.

Never needed that on my server that's now also a decade old laptop. At least, not for the kind of attention HN#1 gets you (perhaps r/all #1 would be different). I can also imagine it being useful if you run a site that attracts controversy, or if your livelihood depends on it but you're not big enough to have your own datacenter and people want to extort that. Neither is really the case for me, I guess people don't p…

I think it's a reasonably good precaution to take with a 24 year old server. I'd imagine on hardware that old you could easily get DOSed by a single mean client (or a web scraper bot with bad behavior), so a ddos isn't even needed. Also this is available on Cloudflare's free plan so it's much safer to take the precaution in case you might need it down the line, rather than get taken down and have to fiddle with setti…

You can also kill my server with a single client. Nobody has for the ~15 years that I've hosted on old laptops now. I've run game servers, a wiki mirror, file upload sites, a Tor exit node, torrent seeding, recently a VM image for a malware analysis course, all sorts of random tools and scripts, you name it; various different audiences but most with some technical know-how, yet nobody has felt the need.

People have messed with things and found bugs (so far always reported more-or-less ethically), and lots of scanners go across the Internet daily, but I've never seen a deliberate take-down effort. (Kind of wondering whether I'm calling that upon myself now, but so be it. Let's see what happens.)

This fear of having to react to a DoS attack by knocking on big brother's door and thus preemptively knocking, it's so anti self hosting mentality, but is also pervasive throughout the self hosting community, I really don't understand it.

Post reply on HN