TimWolla

Yes. You can find Hetzner's ( ;) ) explanation here: https://wiki.hetzner.de/index.php/Microsoft_Blacklist/en.

It's the first link in the delisting section: http://go.microsoft.com/fwlink/?LinkID=614866&clcid

I also recommend signing up for SNDS.

SEO is a black box, so there are no definite answers. It will affect load times (the 60ms) and that could have an effect on search engines.

1. Load time depends on the location of your visitors, see #2. Downtime is hard to evaluate, I expect the cloud to be fairly stable based on my experience with Hetzner.

2. For sure of you are using AWS in US: Traffic across the atlantic will incur at least ~65ms latency per roundtrip.

From my experience this is false. Hetzner reacts to abuse notices and I never received a server with blacklisted IP addresses.

The only organization that caused issues is Microsoft / Outlook.com, but they seem to block every IP address by default. I was able to unblock myself by filling out a form and waiting a few hours for all my servers so far.

More popular version on Hetzner.com: https://news.ycombinator.com/item?id=16212299

I am not sure how this comment applies? The choice for oauth2_proxy in my case was, because it is a solution that already existed. You certainly could put a stateful session service as the auth-request backend, my Lua script is agnostic to that. As an example: For one project I put a service that validated IP addresses against Tor's RBL behind nginx' auth_request module.

> Thanks not only for making this, but also describing your process in a blog.

You're welcome. I like giving back to Open Source.

> but it's currently too limiting for my usecases

My personal experience is the opposite: For one project I specifically slapped on an haproxy in front of the nginx after the fact, because I considered it's HTTP "rewriting" abilities way superior. What I could do with a single ACL + http-response set-header (setting a specific CSP for a single path only) would have resulted in great pain with nginx only.

Direct link to the repository, in case my server does not survive HN's hug of death: https://github.com/TimWolla/haproxy-auth-request

I was the person creating the patch. For now all it does is compiling in support for `Type=notify` (using sd_notify [1]) in the unit file: haproxy is able to notify systemd when it completed the `start` or the `reload`.

In the future this could be extended to support systemd's socket passing and status messages. The latter allowing you to show a short string in `systemctl status haproxy`. See this example for php-fpm:

    [root@example~]systemctl status php7.0-fpm.service 
    ● php7.0-fpm.service - The PHP 7.0 FastCGI Process Manager
       Loaded: loaded (/lib/systemd/system/php7.0-fpm.service; enabled)
       Active: active (running) since Sat 2017-11-25 13:28:22 CET; 1 day 8h ago
         Docs: man:php-fpm7.0(8)
     Main PID: 4624 (php-fpm7.0)
       Status: "Processes active: 3, idle: 29, Requests: 1203613, slow: 545, Traffic: 10.1req/sec"
    *snip*

See the mailing list thread for the full discussion of the feature: https://www.mail-archive.com/haproxy@formilux.org/msg27874.h...

[1] https://www.freedesktop.org/software/systemd/man/sd_notify.h...

Hetzner Online GmbH is a different entity than Hetzner (Pty) Ltd.

If you are talking about dedicated servers: Those are unmanaged, Hetzner does not monitor those.

Regarding grandparent: What kind of hardware failure? I had to change different types of hardware in the past. For HDD changes you send a full SMART result + possibly the logs showing that the RAID kicked the faulty disk and they replace the faulty disk in 30 minutes (and one time even apologized that it took 2 hours for a low-priority-support server). In all cases the actual downtime was < 5 minutes, because of RAID. For possibly broken fans I simply stated that according to my Munin logs show consistent temperatures near the upper limit and asked whether they could take a look. They added an additional fan within 30 minutes, again with actual downtime < 5 minutes.

Most of my replacements were during the night in Germany, that might have helped, because there are possibly less requests in parallel. And I always had hard logs proving my HDD failures.

They support that using AuthedMine [1].

[1] https://coinhive.com/blog/authedmine

Does anyone know whether there is a USB-C (plug) to USB-A (socket) adapter? I'd like to be able to use the USB-C Yubikeys on my regular ports of my computer.

systemd-resolved is a separate process (not PID 1) that just was written by the same authors as systemd-the-pid-1.

Facebook does this partly: Each “Application” has an associated API version which is the earliest API version that can be accessed (and IIRC the one used implicitly when no version is given inside the route).

Since git 2.9 there is another experimental, opt-in, improvement to git diff that results in more readable diffs: Heuristics that try to capture the logical changes better. By default git tries to delay the start of diffs as long as possible leading to bogus highlighting of e.g. doc comments (slash star star).

See https://github.com/blog/2188-git-2-9-has-been-released (section Beautiful diffs) for an example and http://blog.deveo.com/whats-new-in-git-2-11/#experimentalheu... for another similar option that I did not try yet.

Word-level diffs are very situational. In my experience they make the diff less readable more often than not, because they find the smallest common parts, which do not necessarily reflect the logical changes.

Netflix did in 2016 in the Gold Level ($25,000 to $49,999) and 2015 in the Platinum Level ($50,000 - $99,999): https://www.freebsdfoundation.org/donors/

(2013) I suspect from the comments on that site. I've seen it before.

Instead of using Yubikey through GPG to replace the SSH key one can also use the PKCS#11 module they provide: https://developers.yubico.com/PIV/Guides/SSH_user_certificat... This requires replacing GNOME keyring with SSH agents, though.

One can also use one of the 20 additional slots (82-95) the Yubikey 4 provides over the Yubikey NEO by replacing the '9c' with '82'.

> is no way to be running a public service with paying customers

Is it even possible to pay for the hosted GitLab.com instance?

The doc says that there is a LVM snapshot being 6 hours old. <strike>And there should be a regular logical backup with at most 24 hours age as well (they just can't find it for whatever reason).</strike> (Scratch that, my doc did not update, despite Google saying it should automatically update).

Regarding what's gone: The production PostgreSQL database. This suggests that the code itself is fine, but the mappings to the users are gone. But git is a distributed VCS after all, so all the code should be on the developer's machines as well.

I assume he color coded the prompt. You can use ANSI color escape codes in there to e.g. color your hostname.

Here's a generator for Bash: http://bashrcgenerator.com/, the prompt's format string is stored in the $PS1 variable.

In this case it looks like it has been a confusion between two different replicated Production databases. So this would not have helped.

Are 'YP' the initials of an employee or is this an acronym I don't know?

They already do this: On a known computer (logged in at least once) your Google+ photo and name is shown.

see: https://i.imgur.com/96uZRPC.png

This is “documented” as well. apt-get has got Super Cow Powers and aptitude has not.

    $ apt-get
    apt 1.0.9.8.4 for amd64 compiled on Dec 11 2016 09:48:19
    Usage: apt-get [options] command
           apt-get [options] install|remove pkg1 [pkg2 ...]
           apt-get [options] source pkg1 [pkg2 ...]
    …
                                            This APT has Super Cow Powers.

    $ aptitude --help
    aptitude 0.6.11
    Usage: aptitude [-S fname] [-u|-i]
           aptitude [options] <action> ...

    …

                      This aptitude does not have Super Cow Powers.

This is the reason I opt for alphanumeric passwords without special characters, unless a service requires otherwise. A single extra character in length more than makes up for the missing special characters and past a certain point a password simply is “strong enough”.

Thanks. I'll have a second look at the feature then.

> # reorder fixup commits, squash them together with the things they fix

The --autosquash option of git rebase can save you some work:

       --autosquash, --no-autosquash
           When the commit log message begins with "squash! ..." (or "fixup! ..."), and there is a commit whose title begins with the same ..., automatically modify the todo list of rebase -i so that the
           commit marked for squashing comes right after the commit to be modified, and change the action of the moved commit from pick to squash (or fixup). Ignores subsequent "fixup! " or "squash! " after
           the first, in case you referred to an earlier fixup/squash with git commit --fixup/--squash.

           This option is only valid when the --interactive option is used.

           If the --autosquash option is enabled by default using the configuration variable rebase.autoSquash, this option can be used to override and disable this setting.