devicenull

And example of what happens if you don't close all file descriptors: https://bugs.php.net/bug.php?id=38915

Why wouldn't you?

IPv6 is expensive from your DC? What's their reasoning there? Most places are pretty much giving IPv6 space away.

The issue is not the package manager, the issue is the repositories you're enabling. See https://iuscommunity.org/pages/TheSafeRepoInitiative.html for details.

Broken in Chrome 36:

GET http://mp3ornot.com/jPlayer/Jplayer.swf 404 (Not Found)

It's much more likely that they just don't want to deal with the endless stream of DMCA notices that tor exit servers tend to attract.

And without your usual comment of "the attack traffic is not from our network, so it's not our problem".

Why would you expect them to be talking about this?

So, would you consider a site where you can click a button and have a DDOS attack launched for you to be illegal? Because that's exactly what's being referred to here, "DDOS-as-a-service".

So, the question becomes who is going to enforce these rules? If you have these rules in your EULA, but you aren't enforcing them, you might as well not have them.

Are they going to start suing people? I can't see a whole lot of alternatives here.

> I'm more curious why we don't start large-scale investigations in response to each DDoS attack: each one gives you a list of machines likely participating in a botnet.

No, at this point the machines are most likely 'innocent' and are just running exploitable services (usually NTP, DNS, or chargen). Despite widespread knowledge of the vulnerabilities of these protocols ( http://openresolverproject.org/ http://openntpproject.org/ ) getting people to actually fix their systems is hard. Since the systems themselves aren't compromised, investigating each one is not really a good use of your time.

These attacks rely on the ability of the attacker to spoof IP addresses. Tracking down the sources of these spoofed packets would be more useful, but this requires the cooperation of the transit providers. It will also lead back to providers that make money by allowing spoofed traffic in the first place. Ecatel is the well known one right now, they are very popular in the 'booter' business.

Do not put your IPMI controller on a public IP without any sort of access controls in place. These controllers are pretty terrible security wise, and it's not a good move.

> OpenConnect means "You're welcome to spend a bunch of money upgrading your interconnection to our free network"

Or colo their equipment https://www.netflix.com/openconnect/hardware . If upgrading interconnects is such an expensive issue, surely these ISPs could find 4u somewhere to stick one of these boxes in?

At least you have Comcast, who is making an effort to implement v6 (even if you don't have it yet).

I have Optimum, who do not appear to be doing anything remotely related to IPv6.

Legacy systems. There's almost certainly some ancient backend system that deals with passwords, and can't handle long passwords or certain special characters. I would not assume that bank passwords are being hashed properly.

Consoles these days don't have a whole lot of left over power. By the time they're done running graphics and physics, there's not a lot of CPU left over to deal with running a server and sending out updates to everyone. That means if you get stuck being the host player, you're going to have a worse experience then everyone else.

You get a pound a day of junk mail? That's absurd.

noVNC is pretty wonderful. It's weird they reimplemented it in another language.

Is a source any more reputable just because it's not anonymous?

Released the same personal information that is widely available via WHOIS, it seems..

There's not really anything you can do about an individual spam complaint, aside from telling the end user and having them remove the email from their list (aside from things that are quite obviously spam).

The problem is the 'Report Spam' button is also the 'I no longer wish to receive this email' button to non-technical users. Just because you've received a spam complaint, doesn't mean that it wasn't an opt-in email.

Providers never attempt to verify your email list. If you generate too many spam complaints, you get terminated. It's not feasible for a third party to get a copy of your mailing list, then somehow evaluate how legitimate it is.

Yes, that's also normal. We send out a ton of abuse complaints daily, and we get responses directly from the end user in most cases. It's fairly rare that the provider acts as a middleman (and even then, it's generally just automated prodding of the user if they don't respond quickly).

I've never heard of any provider making someone turn over their mailing lists. Do you have any further information about when this has occurred?

Generally, when someone gets too many spam complaints, or doesn't handle them well, they get terminated from the hosting provider.

So, every time someone receives an abuse complaint, they should have to send checksums of every email on their list? What if it's a massive mailing list by a large company? What if it's a fraudulent abuse complaint, just designed to get the company to waste resources?

So, that process assumes that the end users are technically competent. Based on the way it was phrased (it sounds like this guy just CCd everyone), that does not seem to be the case.

That also assumes that a person looked at this email before it was forwarded on. With a hosting company the size of Godaddy, that's unlikely.

Forwarding a complaint onto the end user is standard practice these days. It seems that every few months there is a story like this where someone sends an abuse complaint then is surprised when the hosting company sends it to the end user. For any large enough company it's unlikely a person will even read your complaint before it gets forwarded on. Most complaints are designed to be sent to the end user so it's no surprise companies automate this process.

It's interesting, because these days there are people that define cloud as "high availability VMs". They expect that in the case of a host failure that everything can be transparently migrated to another host.

> All events on the node was stalled so I could not boot down or take an image to spin up a new instance.

This should not surprise you. This is a common failure method of VMs. So, let's say a host was down. Depending on their storage methods, this means that the all the images on the disk are inaccessible. This means that you can't interact with it, which is why you couldn't take snapshots.

> Had to hammer their support with a dozen ticket before someone didn't just give me a canned reply.

Abusing support is never the right answer, I'm not surprised you only got canned replies.

> I like DO but stuff like this just can't happen without anyone checking on it stat.

It's almost like every problem cannot be solved instantly.

Some people feel that cloud means high availability vm's. So that when a host fails the servers are transparently migrated away. IMO this is the exact opposite of what you want.

The people that want HA like this generally custom build every server and don't use configuration management.

Go scan a bunch of barcodes on your phone, in varying light levels and angles. The process is pretty terrible, phone cameras cannot beat dedicated barcode scanners at actually scanning barcodes.