I love how fast your website loads! It feels much more responsive than other, compareably minimalistic sites. How did you do it?
MediaCrush – A website for serving media super fast
31–40 of 99 posts
Re: MediaCrush – A website for serving media super fast
#32Re: MediaCrush – A website for serving media super fast
#33I love how fast your website loads! It feels much more responsive than other, compareably minimalistic sites. How did you do it?
Nothing special, as far as I know. Our nginx config is public [1]. We serve static files directly through nginx and proxy to a gunicorn server for dynamic content. We're a single virtual private server on AWS (soon to be a single dedicated server on Voxility).
[1] https://github.com/MediaCrush/MediaCrush/blob/master/config/...
Re: MediaCrush – A website for serving media super fast
#34Earlier quoted context omitted.
Well, even if we had been served a warrant, I dunno what we'd give them. We don't store anything about our users. https://blog.mediacru.sh/2013/07/19/MediaCrush-for-nerds.htm...
[deleted]
How do I word it?
As of November 11th, 2013, neither MediaCrush nor its admins have ever received any sort of warrant, or any other kind of notice or request, from the government of any country.
Additionally, we do not store anything about a user who visits our site. Here's an example from the HTTP log:
[21/Nov/2013:06:59:36 +0000] "GET /static/favicon.ico HTTP/1.1" 200 16958 "-" 0.000
When you upload a file, your IP address is run though bcrypt (12 rounds) and saved with the file information in redis. Reversing bcrypt is infeasible with modern technology (and probably for many years to come). We store nothing else about you.
Re: MediaCrush – A website for serving media super fast
#35Earlier quoted context omitted.
[deleted]
How do I word it? As of November 11th, 2013, neither MediaCrush nor its admins have ever received any sort of warrant, or any other kind of notice or request, from the government of any country. Additionally, we do not store anything about a user who visits our site. Here's an example from the HTTP log: [21/Nov/2013:06:59:36 +0000] "GET /static/favicon.ico HTTP/1.1" 200 16958 "-" 0.000 When you upload a file, your IP…
Is there a reason a complete IP address rainbow-table wouldn't defeat this?
Re: MediaCrush – A website for serving media super fast
#36Earlier quoted context omitted.
How do I word it? As of November 11th, 2013, neither MediaCrush nor its admins have ever received any sort of warrant, or any other kind of notice or request, from the government of any country. Additionally, we do not store anything about a user who visits our site. Here's an example from the HTTP log: [21/Nov/2013:06:59:36 +0000] "GET /static/favicon.ico HTTP/1.1" 200 16958 "-" 0.000 When you upload a file, your IP…
Is there a reason a complete IP address rainbow-table wouldn't defeat this?
bcrypt is designed to thwart rainbow-table attacks. It salts the hashes and it takes a while (1/3 of a second on my machine) to compute a single hash.
Re: MediaCrush – A website for serving media super fast
#37MediaCrush is awesome. We use it all the time on the NHL subreddit for quick replays of things that happen in hockey games. Because of the media controller, you can pause or quickly toggle to a key point in a play.
Re: MediaCrush – A website for serving media super fast
#38Earlier quoted context omitted.
Is there a reason a complete IP address rainbow-table wouldn't defeat this?
bcrypt is designed to thwart rainbow-table attacks. It salts the hashes and it takes a while (1/3 of a second on my machine) to compute a single hash. https://en.wikipedia.org/wiki/Bcrypt
I don't know exactly what situation you are trying to avoid, but with the standard bcrypt, if somebody has the IP hash and a candidate's specific IP, they can positively match the two (something you specifically mention on your privacy page).
One possible tweak is to continue using bcrypt and a salt, but instead shorten the hash output to something like 24 bits. This way it still cannot be so easily reversed or rainbow-tabled, and collisions still shouldn't be an active problem. However, it wont be possible to positively match a given IP to a hash, since multiple IPs will likely hash to a given output. Granted, if you have a candidate IP and it matches the output hash, there is a very high probability that it was the source IP, but it wouldn't be 100%.
Re: MediaCrush – A website for serving media super fast
#39Anybody can delete my file by adding 'delete' to public URL of uploaded file, am I right? Please don't do this.
Re: MediaCrush – A website for serving media super fast
#40Anybody can delete my file by adding 'delete' to public URL of uploaded file, am I right? Please don't do this.
You are not correct. Only you can delete your uploaded file.
That reminds me of a cool thing [1] one of our users built on top of MediaCrush, though, where others can delete your files.