Comment by lowercased | Hacker News Reader

Comment by lowercased | Hacker News Reader

Parent Full thread

I'm having to switch CentOS servers over to RHEL servers because... support(?)

Some state work got in trouble a few years back because they'd updated guidelines that no applications could be on the same machine as a database server. Enforced separation, for security. Having enough staff and management to distribute that message to people dealing with the apps and servers didn't seem to be a requirement, however. And... when I was given this mandate, I had to ask for another server, then told there weren't any available, and I'd have to wait for several weeks, and I probably should shut down the current service (which had run for 3 years this way, well before the guidelines were in place).

Navigating govt IT stuff is crazy. About half the people I've encountered are between competent and really talented, and the other half don't understand the basics.

FWIW, if the web server can't communicate 'directly' with a database... what process do you use to communicate between them? Some sort of proxy? Or something else?

There's an infamous story at my shop. Twenty-some years ago, we used a software tool that was an important part of our mission, and it only ran on Silicon Graphics boxes. We needed to buy a new SGI machine, and SGI had started shipping all of their machines with built in monitor cameras, the first company to do so.

Digital cameras were at that time strictly prohibited from even being on the premises.

So my friend goes ahead and buys the machine he needs, on the assumption that if he doesn't everybody is out of a job, and he can always disable the camera. The machine arrives, he sets it up, and calls security asking for whatever official process they use for disabling webcams. Epoxying over the lens or something, was what he figured.

At first they are very confused. It's like they can't parse the words he is telling them. It's as if he was trying to tell them there were six legged iguanas with Russian flag patches on their backs running around the server room.

So he finally gets them to acknowledge that he is, in fact, speaking English in sentences that adhere to the rules of grammar, at which point they have to take his question seriously.

So they ask: “did you procure these computers through <our base's> government procurement office.” To which he says, yes, of course, there's no other way to do it.

They think for a minute and reply: “by policy, you cannot purchase a digital camera through the procurement office. Therefore, your computers do not have digital cameras in them.”

> They think for a minute and reply: “by policy, you cannot purchase a digital camera through the procurement office. Therefore, your computers do not have digital cameras in them.”

They were being intentionally daft. The person who told him that almost certainly did so with a wink and a nod, and saved your protagonist a lot of pain.

And probably were shocked at getting the call for a very smart reason - this is a classic kitbag question.

The web server had to communicate through an application server. It wasn't a huge deal, until we got into the discussion about what a database meant to them. That was painful.

still having trouble parsing that (not trying to be dumb here, really!) in java, my java app might talk to a connection pool, which then talks the the database. that connection pool could, I'd guess, be in a separate 'application server', no?

my 'database and app server separation' thing - never quite got a straight answer on 'why', other than 'security'. except... adding more systems, with more logins, more access rules, more stuff to update/patch/test leads to... more potential for security failure (in my experience).

Reply on news.ycombinator.com