Website hosted on a 24 year old Linux server

Post by Gasp0de » Thu, Apr 06, 2023, 4:55 PM UTC

sillysaurusx wrote: post #5

I remember how magical and mysterious a view counter used to feel when I was a kid. How did the website know when someone visited it? Where was the count stored? And how on earth could a website update its own HTML to show the new count? Geocities days were magical. I wonder if kids today have similar thoughts about Twitter profiles and such. It’s probably much easier to pick up the knowledge — back then, it was balk…

Post by leke » Thu, Apr 06, 2023, 5:01 PM UTC

Post by loo » Thu, Apr 06, 2023, 5:04 PM UTC

seba_dos1 wrote: post #52

ElectricalUnion wrote: post #13

Earlier quoted context omitted.

> All you need to store this kind of data is a simple file. You mostly likely need a WAL Mode SQLite database. Most of the time, it's way simpler that handling state handling in concurrent situations yourself. (also, bindings are often available - if not outright bundled by default - under most common languages) The "easy" way is all fun and games until your file is accessed in a concurrent fashion, and then your opt…

For a guest book, you don't need anything like that. A simple solution could be to create a file for each entry. It's append-only anyway. For a view counter - yes, you can use a full blown database to concurrently increment a simple integer value; or, you could do it in a few lines of code by yourself too.

Post by hammyhavoc » Thu, Apr 06, 2023, 5:20 PM UTC

bombcar wrote: post #33

Aachen wrote: post #30

Earlier quoted context omitted.

You can also kill my server with a single client. Nobody has for the ~15 years that I've hosted on old laptops now. I've run game servers, a wiki mirror, file upload sites, a Tor exit node, torrent seeding, recently a VM image for a malware analysis course, all sorts of random tools and scripts, you name it; various different audiences but most with some technical know-how, yet nobody has felt the need. People have m…

The chance that someone wants to connect to your ancient server from an ancient client that can't pass Cloudflare's DDOS protection is probably way higher than someone wanting to DDOS it. (For example, most people may not realize that Cloudflare DDOS basically makes the website inaccessible via TOR for many people.) Preemptive protection against attacks that never come makes the internet worse for everyone.

Post by Aachen » Thu, Apr 06, 2023, 6:11 PM UTC

cpncrunch wrote: post #57

Aachen wrote: post #24

Earlier quoted context omitted.

Is there actually a bug that's remotely exploitable in the TCP stack, if you drop everything besides bound tcp ports in iptables? Any time I see a customer using an ssh or apache version from ten years ago (different from the kernel, but the kernel doesn't give you version disclosure), the list of bugs is all like "if they use RewriteRule and the second URI parameter is echoed unfiltered into a Location header by the…

I assumed myself there must be a lot of root privilege vulnerabilities in Apache, but it appears there isn't a single one: https://www.cvedetails.com/vulnerability-list.php?vendor_id=... All the above seem to be in other Apache products. I think the fact that Apache doesn't run as root helps to mitigate these risks. Having said that, I have had a server compromised (about 20 years ago), through apache, suexec and a v…