The Comms Room

4:12 AM

Woah. An entire /27, that's not bad. job[-3] only had a /28.

and weren't using much of it either. Of course, it was a 2x bonded-T1. How much can you do with one of those nowadays.

Wesley

@Magellan /27s like that are why we can't have nice things.

Actually, I suspect the frothing IPv6 crowd is funding the basement dwelling hosts that give out /27s like that. =P

Falcon Momot

@Wesley clearly it's a conspiracy to waste addresses :P

(seriously? why the fuck are addresses a scarce resource...)

Wesley

@FalconMomot Because people are stupid and wasteful.

Falcon Momot

@Wesley Disagree. I think it's because the addresses are too short :P

Wesley

@FalconMomot If there was better management we'd still have plenty.

Falcon Momot

4:26 AM

@Wesley We've been out for a decade and have relied unnecessarily on hacks to "conserve" something that should be plentiful in the first place.

hacks like name-based virtual hosting, SNI, and NAT/PAT.

Wesley

@FalconMomot I never saw those as hacks, but rather solutions to multiple problems. For that matter, sockets are hacks. No ports, IP addresses for everything!

Maybe that would be cool too...

@FalconMomot What did you say? What did you say?!

I wasn't looking. =(

You confessed to stomping on a box of kittens!

Kitten stomper!

Falcon Momot

I pressed one of my "build project x" macro keys with a book.

guten abend

@MARKHENDERSON

Evening all

4:38 AM

WHERE R UUUUUU

@Magellan What up Rubymonger.

@DennisKaarsemaker What up... perlmongrel?

=P

Dennis Kaarsemaker

@Wesley not much kittykat

Wesley

@DennisKaarsemaker How are your RealKats?

Dennis Kaarsemaker

sitting in my hotel room playing whack-a-mole with some bugs

(software, not insect)

Wesley

@DennisKaarsemaker How's your US visit?

Magellan

@wesley Uh, pondering taking a job at a Python shop. >.<

Dennis Kaarsemaker

4:41 AM

@Wesley not bad so far. Getting some team spirit building done and enjoying a city with more hills than my entire home country :)

Wesley

@Magellan NOOOOO!!!

@DennisKaarsemaker All for Booking, right?

Dennis Kaarsemaker

also, there's a good pizza place 3 blocks from the hotel \o/

@Wesley of course

Magellan

Awesome company. Almost profitable using DevOps and HPC. Actually the University position is almost as cool, but the pay is a little lower.

Cooler, actually. Mrs. Obama used some golf their data and charts a week or so ago.

Stupid autocorrect

Falcon Momot

I am not getting what is RTFM? I just want to know correct way to add a new module in existing Nginx installation. — Hrishi 2 days ago

Magellan

5:04 AM

Oy vey

Mark Henderson

@Wesley Mowing the fucking lawn

At least, I was

Wesley

@MarkHenderson =(

Falcon Momot

Why do people suffer lawns?

Wesley

Just for you @Mark

Mark Henderson

@FalconMomot What would you prefer? A big lump of concrete?

Wesley

5:08 AM

@MarkHenderson I like Arizona's rock yards.

Falcon Momot

@MarkHenderson Trees and wood chips and bushes

Mark Henderson

Mowing the lawn is therapudic anyway. It's like mudering thousands of individual identities and making them all identical

Wesley

^ That's a lush front yard here.

Falcon Momot

@MarkHenderson it's anti-therapeutic if you're allergic to them like I am...

@Wesley Can you get sprinklers for your cacti?

Wesley

@FalconMomot Yeah, we have these drip sprinklers. In fact that yard above probably has a nice underground sprinkler system that has little drip feeds above ground right at the plants stem area.

Mark Henderson

5:10 AM

@Wesley Can't play in that

ANyway was there something you actually wanted @Wesley or can I go and paint the study now?

Falcon Momot

of course you can play in that

Wesley

@MarkHenderson Go paint. Motherfucker.

Falcon Momot

and you can play in a forested yard too

paint is a German conspiracy.

Wesley

@FalconMomot Shut up and eat the flakes falling off the house.

Falcon Momot

huh, people flag things in chat a lot less frequently than I expected.

Wesley

5:25 AM

@FalconMomot ???

You weren't in chat for the last few days.

Oh, were you be sarcastic?

My sarcasm meter is borked.

Falcon Momot

I've seen one flag this week

Dennis Kaarsemaker

@FalconMomot it varies. But yeah, apart from the comms room, serverfault chat seems relatively well-behaved

Wesley

@FalconMomot There was no lie about two dozen flags in one day

All from Mathematics.

Then a few from The Bridge

Falcon Momot

The one flag I saw was from money's main room

shrugs

I have no idea how it distributes them

yawn

Wesley

@FalconMomot How's the sickness?

Falcon Momot

5:39 AM

@Wesley It did go away eventually.

Wesley

@FalconMomot Wooo!

Now back to coffee! =)

Falcon Momot

indeed!

thank you for reminding me to make coffee!

Journeyman Geek

@DennisKaarsemaker: or we're all equally badly behaved.

Falcon Momot

we definitely tolerate a lot :P

I wonder if I can get to 10k this month?

Wesley

@FalconMomot You can. Go to it!

If a hoser like me can get to be number one on the site for rep for the week, month, and quarter, then you can certainly do it.

Falcon Momot

5:53 AM

It's a matter of finding stuff to answer

I just answered two really crappy questions

JohnMerlino

Anyone here use dovecot, an open source IMAP and POP3 server for Linux, instead of something like sendgrid? Would you recommend dovecot over sendgrid or google?

Journeyman Geek

@JohnMerlino: depends on your needs, really.

JohnMerlino

The needs is to send dozens of emails simultaneously and hundreds if not thousands a day, and they must arrive within seconds after being sent

Journeyman Geek

@JohnMerlino: eh, most mail servers probably can handle that

JohnMerlino

including dovecot?

I have dovecot running on my server and it sometimes takes over an hour for email to actually be sent, but it might not be dovecot that is the issue, and something wrong with the daemon code itself. Just curious though if dovecot is robust enough.

Journeyman Geek

5:57 AM

Your big issue would be making sure that many emails don't result in you being spamflagged ;)

hmm

that would need digging into

Falcon Momot

I've been using dovecot to handle incoming mail, and worked at a few places that have, for about a decade without any significant issue.

and often I find mail arrives in the blink of an eye.

now, also, realize that dovecot doesn't deal with the sending of mails - it only makes them accessible to the user's mail client after they are delivered by an MTA.

Iain

7:01 AM

@Wesley you rang ?

Wesley

7:51 AM

@Iain Had a friend who wanted a lead on a good VPN service. Figured I'd refer him to the place you do side work for. He jumped the gun and found one already though. =/

If you see a Skype IM from me, it's a latent one that I sent to you earlier but it didn't go through, of course, because we haven't been on at the same time for a little while.

Lucas Kauffman

10:00 AM

@joel You're bald!

partially

Falcon Momot

11:54 AM

0

Q: Read Intel DRBG parameters

Newer Intel processors include a DRBG, which generates random numbers which you can read with the RDRAND instruction. It involves a 256-bit seed S generated from a hardware entropy source dependant on noise in a metastable oscillator. The algorithm used to arrive at the numbers is effectively A...

if anyone can answer this I owe them whatever they want.

Michael Hampton

12:18 PM

0

Q: Exist in majors web servers some implementations of HTTP2 ready for end users tests or production deploy?

With majors HTTP servers I'm referring to Apache and Nginx. I search but can't found anything about, may be today my googlefu is broken ;) EDIT What I want is try to determined is from the point of view of a sysadmin, what are my options regards these two issues (SPDY and HTTP2) to to improve la...

apache2 nginx http http-headers

Opinions?

Falcon Momot

@MichaelHampton You did the right thing.

if anything is about to become obsolete it's a mechanism for adding support for a non-finalized draft standard to apache or nginx.

and there is no way that has anything to do with the administration of actual systems that people use, either.

Michael Hampton

12:35 PM

@FalconMomot Unless you also can get access to Intel's internal documentation and developers, I think you're screwed.

Falcon Momot

@MichaelHampton Yes, I think it will be extremely difficult to find that information. I could do it probably with a year of effort and an infinite supply of modern processors to brick.

also, if I actually find what I would expect to find intermittently, and it exists for the reason I suspect it exists, with such a program, I suspect that it has been made as difficult as possible (if not made impossible) to do it.

and, judging by the experiences of some people I know who have done certain things, active interference might be a distinct possibility, which ironically would indicate I'd found exactly what I was looking to find.

sigh

MDMarra

1:20 PM

0

Q: How to prevent service erosion on a linux server VM?

Given a virtual machine running Linux, which is actively upgraded to current stable Kernels and experiences frequent installs of experimental packages: what are recommended ways to prevent service erosion, such as in the worst case sshd, named, nsd...

linux virtual-machines administration services connectivity

wat

MDMarra

1:32 PM

> If there was a magic answer to "how do I stop services from going down unexpectedly" none of us would have jobs. Our entire discipline centers around ways and means on accomplishing this. It's not something that can be easily distilled into an answer here.

ewwhite

@MDMarra The answer is Monit

<-- big fan

MDMarra

No it's not!

monit can help but it should be part of a larger strategy

Falcon Momot

2:03 PM

hmm, I just learned a crapload about DNSSEC from answering a question.

complicated as hell, DNSSEC is.

ewwhite

@FalconMomot Should I know what DNSSEC is?

@MDMarra Nah, Monit is pretty good about keeping major daemons up.

Falcon Momot

@ewwhite You're joking, yes?

ewwhite

@FalconMomot (client just got a DDOS on their DNS servers... for the fourth week in a row.)

but no, I've not looked at DNSSEC.

Falcon Momot

yuck.

also, DNSSEC is neat, but excessively complicated.

dawud

there are some very interesting Q/As at the SEC.SE site, I've learned a lot reading them

Falcon Momot

2:09 PM

it gives me headaches every time I try to understand it

and there are so many variants and the way it works has been changed so many times that I can't really put together a coherent picture.

ewwhite

So in short, is it a "must learn", "nice to know" or a "doesn't apply to most people" technology?

dawud

it depends

5

A: If DNSSEC is so useful, why is its deployment non-existent for top domains?

It is actually unclear whether DNSSEC is "what we want". Right now, the certification of Web site, i.e. how a Web browser makes sure that it talks to the right site (when doing HTTPS) is done with digital certificates emitted from about a hundred of Root Certification Authorities. The root CA ar...

that is a very good one

5

Q: Why is RFC4255 (SSHFP) not used for https?

I had this idea a few hours ago, but of course it already exists and there is even an RFC... Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the answer is legit and we need to make sure the nameservers are in a secure environment, but besides ...

ssl ssh dns dnssec

Falcon Momot

it is being adopted

the root is signed

if you fuck it up, your DNS zone won't work for a bunch of people (see this question)

2

Q: nameservers do not agree on the SOA serial

I have two domains pointing at the same IP address with A records. Both domains use the same two nameservers, and still I am having big connection issues for many, but not all of the customers coming to the site. IntoDNS reports that the nameservers do not agree on a SOA serial, but this only hap...

dns google soa

ewwhite

I think security is an interesting field... maybe that's where things will evolve the most.

dawud

I've just been reading it :)

Falcon Momot

2:15 PM

@ewwhite security seems to be evolving faster than any other field

it gives me headaches every day, the things that are done

ewwhite

It's not something that comes up in the environments I work in.

Seeing client get DDOS'ed, I saw that we had no clue what to do...

dawud

did you guys read the cryptopocalypse presentation?

Falcon Momot

also the first answer @dawud posted is not right

DNSSEC has nothing at all to do with supplanting CAs, though in theory it could someday be used to validate domain ownership (but not the identity of the entity you're communicating with)

@dawud which one?

dawud

@FalconMomot maybe because "answered Oct 4 '12 at 16:53" ? things change fast these days

@FalconMomot /me tries to find a clickety link...

Falcon Momot

@dawud actually in both the things you posted they say this is what it's for. it's not.

the reason X.509 is useful is that it validates you're talking to the person you think you're talking to, which has been signed off on by a trusted third party. it validates other things too, like the time.

it's not just "this server we negotiated the session key with is actually bondage.com"

it can also be "the person who sent this email, according to verisign, is actually gen. Alexander using his NSA email account"

and "this website really is operated by Wells Fargo the bank"

dawud

2:21 PM

There's also an interesting point in those Q/As, which is the relationship between the current PKI infra and the DNSSEC one.

Falcon Momot

what DNSSEC is for is validating that the data in DNS was put there by the domain owner, who was duly authorized by the superior domain to use that domain, all the way up to the trusted root that signed .

dawud

I found it: isecpartners.com/media/105564/…

Falcon Momot

it makes no assertions about who the domain owner might be, or who owns the server the A record resolves to, or whether there is MitM after DNS resolution

...and one more big thing they miss in the "cash grab" BS: your DNSSEC key isn't a certificate, and you don't need to pay anyone to sign it. You just give your DS record to your DNS registrar like you currently do with your glue records.

dawud

WRT to that pdf, read also schneier.com/blog/archives/2013/08/the_cryptopocal.html to have a don't-panic contrast

Falcon Momot

yes, I never hear the end of these at work

oh, another obstacle for DNSSEC...

if you trust the root, and do validation in the standard way

you can never use crap like .local or whatever local bogon TLD you use

because it isn't delegated to you from the root

(there are indeed hacks to get around this, but they are difficult and bothersome and you should just use a subdomain of your real domain like internal.xyz.com)

ewwhite

2:49 PM

@MDMarra We need your .local expertise...

0

Q: vmware vcenter 5.1 installation with FQDN error

I'm trying to install vCenter 5.1 on a windows 2012 dedicated (with SQL express standalone) During the installation of the Single Sign On module i've a warning "the fully qualified domain name cannot be resolved with nslookup. if you continue the installation some features might not work correctl...

vmware-esx vmware-vcenter

Mathias R. Jessen

3:10 PM

Anyone has experience with choosing graphics cards for multiple monitors?

like for a NOC workstation

Chris S

Yep, what are you looking for?

If you just want a bunch-o-monitors with good 2D and some 3D capability I like the FirePro 2460.

And AMD's website is "down for maintenance". WTF???

Mathias R. Jessen

3:26 PM

@ChrisS I'm building a desktop pc for use as a lab hypervisor, and I want to have 3 1080p displays

FirePro 2460 seems like a viable option

Chopper3

6:36 PM

@MathiasR.Jessen yes, me, used to buy them for trading stations all the time - everyone used to buy Matrox but now there's only one game in town - NVidia NVS

Chopper3

6:56 PM

@MathiasR.Jessen In particular the NVS 510 is very well considered for NOC type environments

dawud

7:34 PM

@ChrisS lol

Mathias R. Jessen

7:58 PM

@Chopper3 Looks very nice, but maybe a bit overkill

Wesley

8:31 PM

@MathiasR.Jessen Don't NOC it 'till you try it!

Mathias R. Jessen

Kevin Soviero

9:37 PM

@MDMarra Hey! I like SuperMicro... grumble-grumble

pauska

@MDMarra Yep.. not going so well.. had to low level format all the disks to change the sector sizes, plus all this with no reliable way of finding out which disks are faulty or not

It seems like windows can't read the smart status properly either, so when disks fails I get flooded with "bad block" events, and everything goes down to a halt

ewwhite

10:36 PM

@KevinSoviero Supermicro is wack.

Wesley

@ewwhite Noisy and rattly, they be.

Cole

sup

ewwhite

11:47 PM

Gulp...

mdadm --zero-superblock /dev/fioa

Transcript for