11–20 of 21 posts
> The web server is running on an EC2 t1.micro instance. Why do people do this?! t1.micros run beautifully at load for 30 seconds then essentially stop entirely for a while... not to mention having much slower internet than even a m1.small.
> Why do people do this?
Yes.. disabling DHE ciphers will speed things up. Please understand the security implications of what you're doing. The ephemeral Diffie-Hellman cipher suites are the only way to achieve that Perfect Forward Secrecy that's been all the rage lately (sure, there are plenty of ways to screw it up even then, but it's a prerequisite).
At least consider leaving tossing a few ECDHE ciphers at the start of the list. They're plenty fast, and are a good foundation for providing PFS for your users.
Good to see my conclusions from two years ago still hold: http://matt.io/technobabble/hivemind_devops_alert:_nginx_doe... (or its HN thread meritt kindly dug up: https://news.ycombinator.com/item?id=2759596 ) Sadly, these days we want PFS everywhere to stop the snooping apparati, but if you're not really important and just want to stop local network or MiTM snooping, removing PFS should be okay (at least for my borin…
> The web server is running on an EC2 t1.micro instance. Why do people do this?! t1.micros run beautifully at load for 30 seconds then essentially stop entirely for a while... not to mention having much slower internet than even a m1.small.
> Why do people do this? My guess is: so they can utilize the free tier for a year. After that, I agree it makes almost no sense.
> The web server is running on an EC2 t1.micro instance. Why do people do this?! t1.micros run beautifully at load for 30 seconds then essentially stop entirely for a while... not to mention having much slower internet than even a m1.small.
Earlier quoted context omitted.
> Why do people do this? My guess is: so they can utilize the free tier for a year. After that, I agree it makes almost no sense.
Oh, I'm happy to use it for side projects getting a few dozen hits a day. I'm continually baffled by folks running performance benchmarks against them, though.
Sacrificing security in exchange for a minor performance boost. How does your domain score with https://www.ssllabs.com/ssltest/ after disabling those various ciphers? Please read this discussion thread from 2 years ago for a discussion on the pros/cons of this approach: https://news.ycombinator.com/item?id=2759596
[deleted]
pm.max_children = (total RAM - RAM used by other process) / (average amount of RAM used by a PHP process)
One more thing I'd advise is adding this directive if you're running Nginx 1.3.7 or higher:
ssl_stapling on;
The tech behind this is explained here: http://blog.cloudflare.com/ocsp-stapling-how-cloudflare-just...
Lastly, if you can be bothered to build Nginx 1.4 (1.4.2 is the latest version at the time of writing), you can enable SPDY support as well.