The Comms Room

Joel E Salas

9:00 PM

@ewwhite We segment off if it helps with PCI, but that's it

voretaq7

@ewwhite not "always" but "usually"

ewwhite

I have a new client... I don't know if their stuff is 192.168.1.x or not... but I have other considerations... VPN subnet overlapping, etc.

freiheit

@ewwhite Our ESX hosts have something like 8 or 9 NICs in use and over 20 different subnets... Whatever you do, don't end up doing it like we do. :)

ewwhite

3 hosts, management, ILO, PDUs...

Oh, these will be trunks with multiple uplinks

(from vmware)

but I think I'll have ~60 VMs across the hosts.

voretaq7

I'm seriously considering replacing the grub install script to solve this problem.
Fight crappy software with crappy hacks.

Does that make me a bad person? Or just a Linux developer?

ewwhite

9:03 PM

picking IP addressing schemes makes me nervous

Joel E Salas

@ewwhite Don't fuck up

voretaq7

@ewwhite ILO and PDUs should definitely be segmented off

ewwhite

@voretaq7 bad person... not quite Jeffrey Dahmer bad... but still bad.

Michael Hampton

@voretaq7 Fixing the script would have been my first choice... but then again I already was halfway expecting something to break in GRUB 2 from GRUB 1.

voretaq7

@ewwhite so I'm still a long way from being Mark Shuttleworth bad?

'cuz I could live with that.

@MichaelHampton well my first choice would be for this shit to Just Fucking Work with proper backwards compatibility

Adrian

9:04 PM

@voretaq7 I'm pretty sure it makes you an Ubuntu Developer. Which is just this side of Leprosy.

ewwhite

@voretaq7 so what if client's existing flat network is 192.168.1.x?

voretaq7

but since that's CLEARLY not going to happen I'm just going to start adding bad hacks on top of bad hacks.

freiheit

@voretaq7 Would you like a baby unicorn to go with that?

ewwhite

so I re-IP?

Michael Hampton

@voretaq7 All your scripts must be in csh, ksh or ORIGINAL BOURNE SHELL. None of this newfangled bash crap!

voretaq7

9:05 PM

@ewwhite I use 172.16/12 for PDUs and stuff

'cuz nobody ever uses that network :-)

ewwhite

(I do!)

Adrian

@MichaelHampton Ubuntu doesn't use Bash for scripting anymore. It uses Dash.

voretaq7

@MichaelHampton . . . all of my scripts ARE in ORIGINAL BOURNE SHELL

@ewwhite ((fucking freak))

Michael Hampton

@Adrian Oh dear god. Won't someone please put ubuntu out of our misery?

I use 172.16.0.0/12 myself . It's usually my first choice for IPv4 private networks.

voretaq7

@MichaelHampton If someone will buy me the plane ticket I'll cockpunch Mark Shuttleworth on behalf of the universe.

Adrian

9:06 PM

@MichaelHampton They had moved to that at least as early as 2009 or so.

voretaq7

@MichaelHampton My first choice is 10/8

freiheit

@MichaelHampton A month or two ago, I installed RHELWS on my desktop at work, because I was tired of Ubuntu getting worse with every release

Michael Hampton

@Adrian I haven't done any significant work in Ubuntu in a very long time.

Adrian

@voretaq7 SWEET! I've been asking this room for volunteers for that for YEARS!

Michael Hampton

@freiheit And I use Fedora on my desktop :)

voretaq7

9:06 PM

because then I can use 10.[location].[purpose].[host] conveniently

ewwhite

@MichaelHampton Remember, I have multiple sites to keep track of. Is it selfish of me to force client to re-IP because I don't want overlapping subnets?

voretaq7

@freiheit our heavily customized version is actually usable

@ewwhite maybe, it depends how extensive their networks are

Michael Hampton

@ewwhite No, but... where's your IPv6?

voretaq7

@MichaelHampton We're still deploying IPv1....

ewwhite

@voretaq7 3 hosts, management devices, an ASA firewall... and 60 virtual machines.

Olipro

9:08 PM

LolASA

voretaq7

@ewwhite but not a heavily segmented environment? Not terrible.

Olipro

I actually hate ASAs, cheap-ass shit

voretaq7

@Olipro You would prefer maybe a Sonicwall?

ewwhite

@voretaq7 not much to segment.

@Olipro they work well.

Olipro

I'd prefer a cheap rack server with Intel I/OAT and a PCI-E gigabit NIC

WesleyDavid

9:09 PM

@voretaq7 IPvLOLCAT "I can haz route?!" "YOU NO CAN HAZ ROUTE!" "Okay. =("

voretaq7

@Olipro I don't hate ASAs but I certainly wouldn't deploy one.

Olipro

powered by Linux

ewwhite

@Olipro That's for suckas...

voretaq7

"ARP WHO-HAS CHEEZBURGER?"
"I HAS! YOU NO CAN HAS!"

Olipro

yeah... because an ASA totally isn't an Intel Celeron that runs Linux...

oh wait, Yes it is

voretaq7

9:10 PM

@Olipro p4.

Olipro

a P4 in yours? shit, I must have got lucky

WesleyDavid

@ewwhite Time for me to get on the phone and woo a potential new client. Guess what? It's an orchard! I'M IN UR TERRITORIES STEALIN' UR PRODUCES!!

ewwhite

Mainly because my people like using VPN... ASA does it at the right price. $500 for an appliance, low power, some PoE for an access point, good mindshare and SSL/IPsec and site-to-site VPN.

If I were use a Linux box for a firewall, it would certainly cost more than $500.

but I'm a hardware snob...

MIfe

@Olipro to be fair, I think ASA do TCAMs too so its not just entirely software driven.

Olipro

nope

they have a hardware encryption module to speed up VPN processing though

MIfe

9:13 PM

@Olipro thanks for pointing that out :).

So ASA is in effect a software firewall built on a linux IP stack? Have they even done anything with the tcp/ip stack at all? Is it actually all just based on netfilter for the firewalling?

Olipro

good question, make a GPL request and we can all find out :)

voretaq7

@ewwhite cough*pfsense*cough :-)

Olipro

but, given that the ASA arose from the result of an acquisition, I'd not be surprised in the slightest

voretaq7

@MIfe the Linux IP stack is pretty suck-free

ewwhite

@MIfe It's a Linux kernel... not the Linux networking stack.

voretaq7

9:15 PM

it would be hard to do better

@ewwhite it's an ancient Linux kernel isn't it?

freiheit

@WesleyDavid I found the perfect bike for you

MIfe

I think nexus is linux based too, but they do have tcams, that I am pretty sure of.

freiheit

ewwhite

I mean, lots of things are Linux under the hood... but that doesn't mean rolling-your-own is the pro thing to do.

MIfe

@ewwhite I do agree with this. SANs can fit this example somewhat.

ewwhite

9:17 PM

Client today: So I hear that the EMC VNX is just running Windows storage server? That's not that impressive

WesleyDavid

@freiheit -.-

ewwhite

My girl Sandra keeps it real!!!

7

Q: Why buy high end hardware firewalls?

There exist firewalls from Juniper and Cisco that cost more than a house. So I wonder: what does one get from a $10.000+ firewall compared to an 2U server with 4x 10Gbit network cards running e.g. OpenBSD/FreeBSD/Linux? The hardware firewalls probably have a web interface. But what else does o...

Joel E Salas

sandra.jpg

ewwhite

@JoelESalas She's real!! Just like Ke$ha!

Olipro

yep, all depends on how much traffic the device needs to scale to

ewwhite

9:24 PM

But for $500 for an ASA 5505, I don't see the value in doing anything else.

Olipro

Linux = cheaper, faster, less annoying

ewwhite

Again, I wouldn't be installing on a Linux server that costs less than $500.

Olipro

just because I'll run a Linux box as a general-purpose firewall/router to handle a few Gbit of traffic doesn't mean I'll also use it at my Edge

MIfe

Get it on the greymarket? My old employer used to get these things at a really low price. Like $75. No support though obviously.

Joel E Salas

Is there a savings-type account that is actually some kind of indexed fund? So that I can put money into it to save but it's growing at the market rate

MIfe

9:26 PM

I agree though that a 5505 is pretty pants in general when it comes to performance for cost.

Olipro

define "market rate"

ewwhite

My company does it... shitty SuperMicro-based Linux firewalls deployed in pairs... sometimes they fall over... but for stupid reasons.

Olipro

market rate for what? equities? bonds? corporate paper?

oh god, fucking Supermicro

Joel E Salas

@Olipro I specifically want this google.com/…

Olipro

get yourself a few Dell Poweredge 1950s

affordable, stable, and just generally not a complete piece of shit

ewwhite

9:27 PM

@Olipro Power. They consume far too much power in a co-location scenario.

Joel E Salas

@ewwhite worth every penny

Olipro

depends on how you have them configured

ewwhite

@JoelESalas And then, it's nearly impossible to find people who intimately understand iptables. I don't even try.

Olipro

/me does

shit, I'm getting excited for nftables :P

freiheit

@ewwhite Getting intimate with iptables always leaves me sticky and dissatisfied

2

Joel E Salas

9:29 PM

@freiheit A+ 10/10 would spit out cereal again

freiheit

@JoelESalas I knew that would get a star

Olipro

iptables is great, pf is terrible

"pass out on floor with vomit"

ewwhite

Who has the right answer here?

2

Q: Why does my ESXi report higher memory usage than I expect?

I have a pair of ESXi (5.1) hosts in a High Availability cluster. Each host has 48GB of RAM. I currently have 18 VMs running, with the following configured memory amounts: 1x 4GB, 1 vCPU 1x 4GB, 4 vCPU 5x 2GB, 1 vCPU 5x 1GB, 1 vCPU 4x 512MB, 1 vCPU 2x 512MB, 1 vCPU, with Fault Tolerance (so c...

vmware-esxi memory

(I don't like admission control in VMware. Any VCPs care to help?)

MDMarra

9:56 PM

FREAKS

Iain

@ewwhite The OP - he's spoke to VMWare support and is educated ... ?

@MDMarra how goes ?

Mark Henderson

I hate passwords! They are the single worst invention for people with bad memories ever

MDMarra

@Chopper3 congrats on beating your breast malady

@Iain well. down in rainy florida

Mark Henderson

My boss's wife reset his gmail password yesterday and now can't remember what she set it to

Iain

@MarkHenderson keepass

Mark Henderson

9:57 PM

And of course now it's my fucking job to reset it again

Chopper3

@MDMarra finger's crossed, I've only beaten it SO FAR - it's just the treatment is over, well, the primary stuff anyway

Iain

@MDMarra My neighboirs are in rainy Florida celebrating their 25th wedding anniversary atm

MDMarra

I rented a convertible. only had the top down once

:(

Iain

@Chopper3 when will you get some idea about long term success ?

Joel E Salas

@Chopper3 Show those tits who's boss!

Mark Henderson

9:59 PM

@MDMarra Bet you had your wifes top down more than that! BOOM TISH

Chopper3

@Iain in the long term :)

Adrian

Set it up with 2 factor so wife can't get in....

MDMarra

@MarkHenderson yup

Iain

@MDMarra my neighbours had a few days nice weather

Chopper3

@Iain dunno really, the longer I get by the better the long term signs - I'll always be looking over my shoulder (metaphorically of course) :)

MDMarra

10:05 PM

I'm impressed with this tmobile LTE hotspot

I get 12Mb down

That's like 2x the bandwidth of all of Australia

Iain

@Chopper3 Well fingers crossed for the long term

ewwhite

10:46 PM

@MDMarra Oh, you're online! You can fix some servers.

3

Adrian

@MDMarra Does it have a real IP for is it CNAT'd?

Mark Henderson

@MDMarra har har

voretaq7

@MarkHenderson it's funny 'cuz you're still waiting for that comment to download :-)

Adrian

The review audit thing is stupid and irritating

I was given a question that was CLEARLY open-ended with no way to select a "right" answer and it failed me.

voretaq7

11:02 PM

@Adrian Your complaint will be ignored in the order in which it was received. Thank you for calling :-)

(the /review audit complaints have been outsourced to the Canonical/Ubuntu support team)

Adrian

@voretaq7 This I know. If .SE was serious about fixing this kind of stuff, they'd have a functioning HTTPS service.

But no, my Google OpenID tokens have to be sent in the clear.....

voretaq7

@Adrian https is hard (CPU intensive and expensive)

Adrian

@voretaq7 Sony Games thought so too, until they took one in the rear with a rusty nail-encysted 2x4.

voretaq7

@Adrian Sony Games didn't have to buy a certificate for Stack Overflow, Super User, Server Fault, Unix & Linux, Mathematics, Physics, English, Programmers....

freiheit

@voretaq7 That used to be more true. CPUs got a lot faster and certs got a lot cheaper.

voretaq7

11:06 PM

@freiheit 100+ sites the cost of certs adds up quick (as does the CPU overhead of SSL engines, though that's definitely less of a concern than it was say 5 years ago)

Adrian

@voretaq7 Not going to accept that excuse. Certs aren't THAT expensive. The IT budget at $job[-2] was $30k/year for 550 staff and we damn well bought our certs.

Somehow I think .SE's non-salary budget is a little bigger than that.

Joel E Salas

@Adrian I don't know man, have you seen their broom closet?

voretaq7

@Adrian probably -- if it really bugs you post on mSO about it. I'd be happy to be able to browse (and chat) over HTTPS myself

freiheit

@voretaq7 It's possible to get a *.stackexchange.com type cert these days. Generally more expensive than a single regular cert, but cheaper than 100+...

voretaq7

but I'm pretty sure it's been brought up and rejected (for the above reasons)

Adrian

11:08 PM

@voretaq7 I have before. I've even talked with the .SE folks IN THIS ROOM about it. And it was shot down out of hand.

ewwhite

Uh oh...

/backup1/lost+found/#11010049/2013/04/19/19/

voretaq7

@Adrian the squeaky wheel gets ~~ignored by Canonical~~ ~~the oil~~ no, definitely ignored.

:-)

Adrian

Seriously, if they can afford square footage in Manhattan, they can afford a few certs.

voretaq7

@ewwhite YAAAAAAY! FILESYSTEM CORRUPTION FOR THE MOTHERFUCKING WHERE'S MY DATA?!?

ewwhite

Total disk usage: 42.4GiB Apparent size: 41.8GiB Items: 213346

--- /backup1/lost+found/#11010049/2013/04 ---
                        /..
    7.7GiB [##########] /19
    7.6GiB [######### ] /17
    5.7GiB [#######   ] /18
    4.6GiB [######    ] /10
    4.3GiB [#####     ] /11
    4.2GiB [#####     ] /16
    4.2GiB [#####     ] /09
    1.4GiB [#         ] /15
    1.0GiB [#         ] /12
  616.3MiB [          ] /08
  365.4MiB [          ] /05
  188.9MiB [          ] /04
  944.0kiB [          ] /01
   24.0kiB [          ] /14
   24.0kiB [          ] /07

voretaq7

11:10 PM

also I've beaten Ubuntu into submission via disgusting hacks. I'm now going to go home and drown my sorrows in scotch.

ewwhite

would you trust it?

freiheit

@voretaq7 I take it back. They HAVE a *.stackexchange.com cert already.

voretaq7

Dear Mark Shuttleworth:

I'd tell you to suck my dick, but you'd probably screw THAT up too.

No love,
Me.

Adrian

@freiheit This is true. They do. Their code is broken in odd ways though and the OpenID authentication process is clearly broken under HTTPS.

voretaq7

(I don't care that it's not technically his fault THIS time, he's a convenient scapegoat and the last 5 times it WAS Ubuntu)

@Adrian Code is HARD!

Adrian

11:12 PM

@voretaq7 If you can fix it with a scripting hack, it probably was Canonical's fault.

voretaq7

@Adrian no, it's definitely grub 2

so the solution was mv /usr/sbin/grub-install /usr/sbin/grub-install.real & create a dummy grub-install that tries to install on hda and sda.

Adrian

@voretaq7 Canonical's job to QA their shit too. Which they did not do. And they, in fact, never do except for single-user desktop use cases.

voretaq7

I'll undo that hack at some point when I'm confident all my users are upgraded.

@Adrian Canonical's upgrade process worked fine.

they accounted for the fact that the grub people made a compatibility-breaking change with no notice (just like I did - except my way is disgusting because Canonical doesn't support anything except for single-user-and-you're-the-admin desktops)

Adrian

@voretaq7 I haven't dinked with 13.04, but last time they did this with Grub and 10.04, it was Canonical's problem because Debian's own scripts worked just fine.

voretaq7

@Adrian Unless canonical is responsible for grub-install this one isn't their fault, much as I'd love to be able to add another sin to their time in purgatory

Adrian

11:15 PM

@voretaq7 Yes, for which every last mother-less son involved in that policy should be shoved out the cargo door of a C-7 over the Atlantic.

voretaq7

@Adrian I think you're going to need a bigger cargo plane - it's the entire damn Linux universe that needs to be thrown to the krakken.

freiheit

@voretaq7 mmmm.... giant giant calamari...

now I'm hungry

voretaq7

this culture of "whatever I want to do and damn the consequences" is community-wide, and it's why I refuse to take "linux admin" jobs

WesleyDavid

Seafood? mew

@voretaq7 Cathedral and bizarre.

voretaq7

too much work, no way they'll pay me enough.

Adrian

11:17 PM

@voretaq7 No, I've worked with kernel contributors at IBM and $job[-1], the problem is not THAT pervasive. The problem is that QA is expensive and seen to have very little ROI.

voretaq7

@Adrian The BSD projects manage to do it - with far fewer developers and substantially less money

WesleyDavid

@voretaq7 Between you, Andrew Fresh and Jason Dixon I swear I'm being tugged into the horny ball side.

voretaq7

the kernel contributors you were working with are probably from the real Unix world and not "Linux developers" who cut their teeth on penguin jerky

WesleyDavid

The horny ball keeps touching meeeeee!

voretaq7

@WesleyDavid well maybe you shouldn't dress like such a harlot.

WesleyDavid

11:19 PM

@voretaq7 Hey, my rack firewall is pfsense... do I get some gushie foods for that?

freiheit

Adrian

@freiheit Wat?

voretaq7

@freiheit kitty!

(someone should patch putty so it's called kiTTY, just for @WesleyDavid)

WesleyDavid

@voretaq7 There is one already.

voretaq7

now I'm really outta here, I'm sick of being in this office. It stinks of Linux in here (like a damn rotting penguin!)

WesleyDavid

11:20 PM

@voretaq7 kitty.9bis.net

@voretaq7 Huggles. Don't run over anyone out of anger.

Unless they deserve it and you know an underground body shop

Adrian

@voretaq7 And something to make you laugh while you've enjoying your scotch at home: destroyallsoftware.com/talks/wat

Woo! I might get to adopt a kitty tonight!

Joel E Salas

11:36 PM

"THIS BIKE IS WORTH 6 TO 700 BUCKS IT HAS SOME CARBON FIBER PARTS."

WesleyDavid

@Adrian Don't do it it's a trappppp!

@JoelESalas Don't do it it's a trappppp!

Joel E Salas

@WesleyDavid Ok fucker, put up or shut up. I want to spend $500 on a bike. What do I get.

WesleyDavid

@JoelESalas Hmm... I think... I think wheels are a must. And something about chains?

freiheit

@JoelESalas Get a basic sporty hybrid. Trek 7.x or something like it.

ewwhite

@JoelESalas I can help there.

Joel E Salas

11:43 PM

@freiheit I had a hybrid before, I don't think I'd get another one.

@ewwhite All ears

ewwhite

@JoelESalas how flexible are you?

Joel E Salas

@ewwhite I can touch my toes

ewwhite

How tall?

And weight?

Joel E Salas

@ewwhite 5'8", 160lbs

freiheit

2

ewwhite

11:45 PM

@JoelESalas budget?

Joel E Salas

@ewwhite I want to stick to under $500

ewwhite

@JoelESalas Where do you wanna ride?

Joel E Salas

@ewwhite 100% street, this is to commute to work

ewwhite

Okie...

@JoelESalas flat bars or dropped-bars?

BTW, $500 is a bad price point.

below and above are okay.. but there's not much right at that level

Joel E Salas

@ewwhite How high do you recommend I go?

ewwhite

11:50 PM

If I were @JoelESalas, I'd head to Santa Monica and hit up Performance Bike.

Joel E Salas

@ewwhite Do you have a contact there? Also I was planning on buying a used one on craigslist

ewwhite

Option #1

Option #2

Option #3

freiheit

Another Option

Joel E Salas

@ewwhite that one is lovely

freiheit

And yet another

ewwhite

11:54 PM

@freiheit Too low-end and slow!

Joel E Salas

@freiheit I don't want a trek

ewwhite

@JoelESalas If you weren't in LA, I'd recommend something singlespeed... but you guys have hills

Joel E Salas

@freiheit This one is quite appealing

ewwhite

Here in Chicago, low-end road bikes are faster than similarly-priced hybrids... Lots of people commute on road bikes here, even with flat pedals.

Joel E Salas

@ewwhite I'll be biking in West LA, Silverlake, DTLA, etc

ewwhite

11:56 PM

If you weren't in LA, Option #4 would work.

Joel E Salas

@ewwhite FFFFFFFFFFFFFFFFIXIE

never

ewwhite

I recommend these because you can walk into Performance Bicycle in Santa Monica and pick one up

it's a singlespeed, not fixie

size-wise, you're a 52cm to 54cm in road bike sizing

Joel E Salas

@ewwhite Understood, thank you

This is going to be an expensive weekend.

Car, bike, trip to SB

freiheit

@JoelESalas You should go with ewwhite's option #1. CX bikes are great commuters. It'll put up with potholes and that sort of thing better than option #3. :)

Joel E Salas

@freiheit I liked Option 2 best :(

Transcript for