« first day (2547 days earlier)      last day (320 days later) » 

7:24 AM
@NH. I'm a bit of a snob the other way - I inherently distrust a shinĊ· website
 
7:35 AM
I generally agree with that with that sentiment, but I'd also raise Let's Encrypt as a counter-example
Arguably, they do provide one-click privacy on a shiny, responsive website
 
 
6 hours later…
1:39 PM
I do not know why but I feel protected here ;)
 
 
3 hours later…
4:15 PM
@MagicHat clearly you haven't been here long ;)
@Arminius have you used Let's Encrypt for any complex SSL needs? One-click, shiney and responsive are not my words of choice for them
though I did eventually get to a one click solution after building out fairly extensive custom tooling, including writing an auto-DNS verifier from scratch
and even then it times out half the time running my verification batches
with no ability to have them sign an existing private key from what I've been able to get working so far
I miss StartSSL. Makes me very sad that they got sold to Wosign
they just announced they are closing up shop and giving up on trying to get back in as a CA now
the prospect of having to rotate my keys every 3 months across multiple different services is... unattractive
but I'm not going to pay $6000 for my SSL certs
 
@AJHenderson I've used it for a very tricky Postfix SSL/TLS email setup twice. But I hate it.
i had to write a script to kick Postfix into restart with it. I got annoyed :P
I don't miss StartSSL if only because they gave me grief with 'new domains' that were spun up.
 
@ThomasWard really?
 
even though they're clearly listed as subsidiaries of the company I own and a parent domain.
yep, twice.
Finally got mad enough at them I just started using Namecheap for SSL, or Gandi where I register my domains (free single site SSL cert with a domain!)
 
you just setup the new SSL cert with the primary name as a different site or subdomain and it worked perfectly fine. It was pretty trivial for me to work around
 
@AJHenderson yeah well back when i uised them they had to hand-check the domain ages.
 
4:23 PM
I don't want to have to use SNI and I have some 18 domains with some 98 subdomains
 
the 'new domain' was replied to with "Wait two weeks before requesting, let the domain mature a little"
 
and do SSL everywhere
 
@AJHenderson I usually don't have to worry about that with my wildcard certs.
 
so my costs for a multi-site wildcard would be extremely prohibitively expensive
 
I use LE for simple things, but I'm fairly familiar with it I can kick the system around to make it all function :P
but it's nontrivial to get that all set up
90% of my sites are under a wildcard. because same parent domain.
 
4:25 PM
yeah, I now have a tool built off of Certify and the powershell scripts that is able to call in to make MSDNS records to respond to the DNS verifier and spitout a cert for a text file's worth of subdomains
 
the remaining 10% are Cloudflare'd so they do the SSL
 
but the tooling is like 50% custom built
 
@AJHenderson welcome to the world of the sysadmin: custom-building solutions to make crap work.
 
just to make it work and I still have to manually update the cert in IIS, RDP, e-mail server and irc server
where as StartSSL just worked and was good for two years
three if you timed it right
 
indeed.
StartSSL just made me mad after the first three subsidiary-company domains were denied for this one client of mine just because they were brand new domains.
 
4:26 PM
if they would allow you to submit the public key for signing with a real CSR, LetsEncrypt would be much better
 
but they needed to be up and running, so I said "Screw it" :P
@AJHenderson I know, right?
I actually wrote a hackish script that could decode a CSR and then pass the data to LE and my DNS servers in the public view to make it become the SSL master temporarily for verification, and then revert to what it was..
 
@ThomasWard that's odd, I never had a problem with brand new domains with them
I guess it's probably a registrar thing
based on when the whois is available
 
@AJHenderson well, when I got my Ubuntu membership and saw that I get nice discounts on single-site domains from Gandi, i just started using those.
and I found a cheaper Comodo wildcard reseller than NameCheap and Namecheap gave me a pricematch code so I save about $60 a year on my wildcards.
 
since they were big on whois based domain validation (which was it's own breed of pita)
@ThomasWard in a few years I'll probably break down and go the wild card route for single domains once non SNI compliant browsers are less common
or once IPV6 support is more broad
 
@AJHenderson well the Whois was available same-day and they still rejected then so I just got angry at them. I also haven't had an issue with SNI yet, namely because I'm a stickler for one-IP, one-service. With a handful of exceptions.
... like all the things running at my home network heh.
Most of my things run on systems in datacenters so I have a small set of IPs I use :p
yay for dedicated systems :P
 
4:38 PM
@ThomasWard I have a dedicated server, but it costs extra for additional IPV4 addtesses
I think it's like $1 a month per IP
which would significantly increase my server cost to get IPs for every domain
and some domains go to the same service
 
@AJHenderson by 'dedicated server' i mean my own hardware colocated in a datacenter, and that datacenter gave me a pretty darned good deal for IP addresses. I also don't run that many sites, and really only worry about mail servers :P
 
which further complicates things
though I could handle that with IP bindings still I suppose
 
or one mail gateway server which has its own rDNS and certs.
 
since I could bind multiple IPs to the same service
 
but I understand where you are coming from there.
 
4:39 PM
@ThomasWard I rent my server, but it's in a data center
and a dedicated rack unit
 
the package I have that i've been grandfathered into gave me a /28 of IPv4 so that's a good number of IPv4 there. Plus an entire /64 for v6 so that helped too.
 
1&1, while I hate their shared hosting, has really great deals on cheap dedicated boxes
 
true statement
I boycotted 1&1 when they fubar'd billing me and billed me erroneously for four services three months in a row.,
 
I pay $105 a month for a windows server 2016 box with a TB of redundant storage, 16gigs of ram, an unmetered 100mbps connection and quad core intel server processor (which my mind is blanking on the name of atm)
 
Xeon?
 
4:42 PM
yeah
that one
 
dual quad Xeons in my box, unmetered 100/100, and I put a huge 128GB RAM in that damned thing. It's an Ubuntu box, but it in turn runs multiple containers or KVM-based VMs. With all the chaotic IPv4 routing and all of it :P
 
NH.
100 upload? nice!
 
honestly, 100/100 is a bit limited for data center space. I wish 1&1 would offer a cheaper gigabit option, but they only have it on their higher end packages last time I upgraded my box
I hit the limit of my server's bandwidth more regularly than any other limit on it
 
@AJHenderson well my full time job starts in January with a much better paycheck so I'll be able to get the higher ocnnection speed in the 250 symmetric range. But i've kept it at 100/100 because $45 a month for the whole package is damned nice.
as i said before though I'm on an old plan, so it's a grandfathered plan.
 
@ThomasWard sounds like probably about what I'd be paying if I owned the hardware and was just collocating
 
NH.
4:45 PM
oh, just read further up... you are talking about rented servers... makes more sense now
 
@AJHenderson yep.
@NH. well, @AJHenderson is. I'm talking about my own hardware colo'd in a datacenter :P
 
@ThomasWard still talking data centers though
 
true.
 
NH.
ah.
 
I have two virtual dedicated servers also from RamNode - essentially VPSes, but with two dedicated CPU cores for each.
pretty decent, and for $1.50/month for extra v4 ($3/month for DDoS protected v4) it's not bad.
$800 a year for both.
plus IPs.
shrugs
... oops speaking of those VDS, I just exploded my routing to the containers for two fo the public IPs...
... where'd I put my backups of the NAT routing rules...
 
4:48 PM
but yeah, I have that thing fully decked out with replicated DNS with DNSSEC, full suite of anti-spam and secure mail server configurations, SSL supporting IRC connection, full IPV6 support with most services on independent ipv6 addresses, SSL everywhere except for a few services that require unencrypted connections, some voice chat servers with DNS service resolution
etc, etc
 
nice.
... urgh I guess I broke IT Rule #1 - "Always make sure your backups function properly."
 
but it makes for a semi-crowded box
@ThomasWard my DNS replication is on one of those through Azure
and I have another virtual server on azure for doing some service bridging
 
nice. I have a cluster of 5 VPSes (one in each datacenter they serve from) from RamNode that do all my DNS
 
and then use Azure for my backup
I get a $100 a month credit for Azure with my MAPS subscription
so it costs me nothing for all my azure usage
 
... ugh now I have to do this NAT stuff again >.<
 
4:50 PM
automated nightly backup with differentials for the week and weekly backups for the month
and monthlys going back until start of backups
I think I might have set it for 3 years or something like that
but I started them like a year and a half ago so haven't reached it yet
 
nice.
 
I started that because of a fun situation I ran in to with a dual drive failure of my raid 1 array though
I was able to piece stuff back together by splittly the array and seperating the good from the bad
but it was dicey
 
and this is why RAID5 with many additional drives in teh array is better :P
shot
 
@ThomasWard yeah, that's what I use personally, but isn't an option on my rented
 
mmm
guess I'm lucky that this is my hardware then :p
 
4:55 PM
well other than my cache drive, my cache drive is raid 0'd ssds
sure it crashes at the first speedbump it hits, but boy does it move data around
4k raw video editing in real time
it's only 240MB/sec per clip I'm working with
 
nice
 
@AJHenderson hehe... i gona be pro here...
see you
 
5:20 PM
@AJHenderson what do you do for system security with that being a Windows box
heavy duty firewalling? A firewall appliance in front of the box? Just curious
because I have a pfSense in front of my equipment at the colo
 
@ThomasWard since it's just my personal stuff, I just end up using the built in firewall systems. It seems to have worked ok so far. It isn't ideal, but I don't have particularly extensive routing control
it's the one downside
but not enough of one to make me pay $450 a month instead
 
mmm, understandable.
was merely curious :P
 
it still blocks access to ports that aren't in use though
 
true.
 
because it's smart enough to only open ports when services are running
it's much better now than it was in the bad old days. Still not as good as a dedicated hardware firewall, but works well enough for my needs
 

« first day (2547 days earlier)      last day (320 days later) »