How it Works

SSL/TLS, the encryption protocol commonly used for securing traffic between web browsers and servers, has a feature called a “heartbeat.” Every now and then, an exchange like this happens between the client and the server:

Client: You still there? If so, send back “ALIVE,” which is five characters.

Server: ALIVE

If the heartbeat succeeds, the connection stays open. This keeps happening, over and over, with a different value being passed each time.

Now here’s what happens if someone exploits the Heartbleed bug:

Client: You still there? If so, send back “KITTEN,” which is 300 characters.

Server: KITTEN, and here’s a block of random memory from RAM!

In this manner, an attacker can get a random 64KB chunk of data from memory every time a heartbeat is sent, thanks to a lack of validation of the length parameter. (So an attacker can just repeatedly make attempts.) Eventually, they’d get lucky and find something interesting. Such as the SSL certificate or users’ passwords and data.

Exploiting this bug is trivial. (There were people posting scripts to test for the vulnerability minutes after it was announced. Just imagine how quickly malicious types got to work implementing exploits for the bug!) It’s also possible that someone knew about it months or even a couple years ago, and has been exploiting it ever since. Bloomberg even suggests that the NSA has known about it for two years, and has been exploiting it rather than disclosing the problem.

Is it Fixed?

Yes! Your Linux distro should already have patched builds in their package manager, so it’s just a simple manner of running a couple of commands to update your openssl and libssl1.0.0 packages, then restarting any services that depend on SSL. (Or just do a full reboot if you’re paranoid.) In the case of Ubuntu, you’d just do something like this to update the packages:

sudo apt-get update
sudo apt-get dist-upgrade

You should now revoke any SSL certificates and issue new ones, in case they were leaked in an exploit of the bug.

What Should I Do, as a User?

Change your passwords! For anything important—email, banking, etc.—you should consider picking a new password.

SCOTTSDALE, Ariz. (Oct. 15, 2013) — GoDaddy, the Web’s largest platform for small businesses, has acquired (mt) Media Temple, a Los Angeles-based Web hosting and cloud services company focused on the creative class of digital designers, developers, entrepreneurs and innovators.

The two companies will continue to operate independently. The strategic acquisition provides GoDaddy with direct access to Media Temple’s hosting gurus, who will share knowledge and insight on how GoDaddy can better serve Web professionals and developers. GoDaddy provides scale and investment for (mt) to accelerate its growth and further expand internationally.

Media Temple is a popular option for Linux-challenged web designers seeking managed hosting with a friendly control panel, though they pay significantly more for the convenience. Though that may change as GoDaddy’s influence permeates their acquisition.

That’s the problem GoHub attempts to solve. It’s a tiny webserver (written in the Go language) that listens on a port for messages from GitHub’s WebHook API. Any time a commit is pushed to GitHub, they send a JSON notification to your GoHub listener, and it runs the shell script of your choice when the specified branch (usually “master”) changes.

The original GoHub script was created by adevan, but I made my own fork that includes some extra goodies. It includes a magical setup script that sets everything up for you, as well as an Upstart script. (Configurations and logs are also under /etc/gohub in the fork.) So if your Linux distro is still using SystemV instead of Upstart, you probably want to use the original instead of the fork. (At least until I get around to writing a SystemV script and amending the setup…) If you’re on Ubuntu, you’re good.

Assuming you already have Go installed, it’s a simple matter of cloning the repository and running the setup script.

git clone https://github.com/redwallhp/gohub.git
cd gohub
chmod +x ./setup
sudo ./setup

Then you need to add your watched repositories to /etc/gohub/config.json. Each object should specify the repository name (in the form of gohub not redwallhp/gohub), the branch (master in most cases) and the path to the shell script that should be run. The best place to keep them is in /etc/gohub/scripts, to keep everything together and save your sanity in the future.

What should one of those scripts look like? Here’s a super simple example that just takes the files checked out and copies them to the public directory the web server is looking in. This works well for PHP projects.

#!/bin/bash -l

GIT_REPO=https://github.com/me/awesomeapp.git
TMP_GIT_CLONE=~/tmp/git/awesomeapp
PUBLIC_WWW=/var/www/sites/awesomeapp

git clone $GIT_REPO $TMP_GIT_CLONE
cp $TMP_GIT_CLONE $PUBLIC_WWW
rm -rf $TMP_GIT_CLONE
exit

The README file has the script I use to build and deploy Jekyll sites.

Once you have everything set up to your liking, start the server by running service gohub start. This invokes the Upstart script and starts the server daemon.

Now all that’s left to do is add the WebHook on GitHub. Go into the settings for the repository, select Service Hooks, and then WebHook URLS. Paste in the appropriate URL, which follows this convention:

http://example.org:8392/reponame_branch

So if your repository URL is https://github.com/me/awesomeapp.git, and your domain is example.org, your WebHook URL would be http://example.org:8392/awesomeapp_master.

Save the settings on GitHub, and test out your new Git deployment system. If you make a change and push the commit, the changes should take effect momentarily.

History lesson aside, here’s what DigitalOcean has to offer: affordable VPS hosting with plenty of memory and fast solid-state drives. Their offerings are comparable to those of the venerable Linode, though cheaper. (The difference comes down to which is more important to you: CPU or price.)

Their cheapest plan gets you a VM with 512MB of RAM and 20GB of space for a mere five dollars per month (or $0.007/hour). That’s cheaper than a lot of shared hosting plans, for a speedy box with full root access. The plan I’m using is their $10/month option, which comes with one gigabyte of memory.

Backups and snapshots of VMs are priced reasonably, with backups costing 20% of the server’s price (e.g. $1 per month for a $5 per month server) and snapshots being $0.02 per gigabyte stored.

The service has been stable so far, and the one support ticket I opened was resolved in a timely manner. Performance-wise, there has been a definite improvement over my previous host. (It’s also nice having the server be in New York, which results in a much more favorable network latency from where I live.)

DigitalOcean has a freshly redesigned control panel, from which you can manage your servers, DNS, billing and other settings. It’s also the place where you can set up your API access if you want to manage things from a mobile app, command line utility, or even use a Vagrant provider.

I’ve been very happy with DigitalOcean since my big switch, and definitely recommend them if you’re in the market for a decent VPS provider. If you want to give them a try, here’s my affiliate link. If you enter the promo code SSDPOWER on the billing settings page, you’ll get $10 worth of free credit. You can spin up a VM, play around with it, and delete it when you’re done.

Need 960gs, Twitter Bootstrap, Backbone.js, TinyMCE or something else entirely? They probably have it. If they don’t, you can open a pull request on GitHub to add it!

And since it’s backed by CloudFlare, it should be reliable. They know what they’re doing.

CDNJS — The Missing CDN [CloudFlare]

Fast forwarding a bit to spare you the gritty details, I went looking for benchmarks to see how DigitalOcean stacks up against the major competitors. In doing so, I found a new Interesting Thing.

ServerBear provides “a no hassle all-in-one UnixBench, IO, IOPS & Network performance test for Linux Servers,” and compiles an index of benchmarks for the different price points offered by dozens of web hosts. You can look up a service, such as DigitalOcean in this case, and view benchmarks for each plan purveyed by the host.

They also rank the hosts with a “BearScore” that represents the performance and specs vs. the monetary cost. Of course, there’s more to choosing a host than just raw performance. Reliability, knowledgeable staff, and quality support when something goes wrong are also very important. Unfortunately, those things are harder to quantify statistically.

Looking at the statistics, this up-and-coming DigitalOcean seems pretty good. Their $10/month offering seems to outperform my two-node VM from VPS.net (which is currently priced at $38/month for new customers…) in most areas, except for network speed. DigitalOcean, according to other sources as well, seems to have slower internet connectivity than Linode and VPS.net. But at a fraction of the price, it’s a very attractive option.

ServerBear: Performance Benchmarking For Linux Servers [serverbear.com]

Given the very low price and the long retrieval delays, it is a logical assumption that Amazon is using magnetic tapes for the storage.

Amazon suggests that the service would be used for archiving and preserving records, media, scientific data, or anything that requires long-term storage. It would work well for off-site backups in general, even for your personal computer, since storage is absurdly cheap and you don’t need to retrieve backups too often.

There are countless alternatives for the services GoDaddy offers, but many newbies are not too aware of them. After all, they don’t pour money into TV ads during the Superbowl.

Since I’m frequently asked for suggestions, I figured it would make for a good post.

Domains

It is usually prudent to register domain names with a separate company from the one that actually hosts your web site. That way, if you have cause to switch for one reason or other, you can simply edit the DNS to point it to your new host, and you don’t have to worry about transferring the name from one service to another.

There are many domain registrars, but a few that are frequently recommended are:

• Name.com — Name.com recently went above and beyond to help recover a domain that was hijacked from a web development blog. Even though the thief had transferred it away from GoDaddy and only moved it to Name.com temporarily before being shuffled over to 1and1, Name.com was the only company involved to step up and coordinate the recovery of the stolen name.
• Hover — Hover charges a premium, but their goal is simplicity and no BS. They won’t push extra services on you when you buy a domain or clutter your admin panel up with ads.
• Namecheap — A popular option, though I know less about them. A lot of the people moving away from GoDaddy during the SOPA boycotts went with Namecheap.
• 1and1 — I’ve been using 1and1 for my many domains for several years. (Since 2005 or so, maybe.) I haven’t had an issue with them so far, though some people have reported issues with their customer service department. They get a bit of flak, whether it’s warranted or not, but I have been happy with their service for about seven years.
• Gandi — Gandi’s motto is “no bullshit™.” They handle a large selection of TLDs, so they’re a good bet if you’re looking for something exotic, like a .it, .io, .ly, .me, or .fm domain. Their prices do vary depending on the extension, though, since country-level domains vary depending on their home nation’s policies.
• Moniker — I currently have one domain registered with Moniker, as I had acquired it after the previous owner allowed it to expire, and I never moved it away from Moniker. I haven’t had issue with them so far, and they’re an established name in the industry.

Shared Hosting

There are three major types of web hosting services: shared, VPS and dedicated. Shared hosting is the cheapest option, and is the easiest for beginners to get started with. Basically, you share a server with many other users. Its resources are allocated equally, and everything usually works fine so long as none of the website get too much traffic. Things get a little more complicated then, and the host may suspend the offending web site and ask them to upgrade to a pricier service.

Some hosts advertise “unlimited” bandwidth, but you shouldn’t take that claim too seriously. While they may not meter your bandwidth, they will still cut you off if serving your site takes up too much CPU time. (More traffic means more requests served simultaneously, which means greater processor usage. Obviously they don’t want to impact the other sites on the server, so they suspend the site.)

• A Small Orange — ASO aims to provide affordable and fair web hosting without overselling, a tactic that some hosts use to maximize profits, selling more accounts on a server than the hardware can handle, under the assumption that the majority of users won’t be fully utilizing what they pay for. A Small Orange is upfront about the limitations of each plan they offer. You can get a shared hosting account starting at $35/year ($2.91/month) and move up to higher plans as needed. Their $10/month plan with 5 gigabytes of storage space and 100GB of transfer is a pretty good deal, and more than enough for even a moderately popular blog. They also offer reseller, VPS and dedicated plans if you outgrow shared hosting. [Affiliate Link]
• Nearly Free Speech — What if you didn’t pay a flat monthly fee for basic web hosting? What if you only paid for what you used, and not a penny more? That’s how Nearly Free Speech works. Pricing can get a little complicated, but it can be very cheap as a result. You make a deposit, as little as $0.25, and pay as you go. Serving up static HTML isn’t going to cost much, depending entirely on how popular your site is and how much you’re storing on their servers. Dynamic sites, like WordPress blogs, start with that same baseline, but there is and additional $0.01/day dynamic site fee, and additional usage fees for your MySQL database.
• WP Web Host — This one is well-known in the WordPress community. They specialize in hosting services for WordPress. They’re up front about their policies on the maximum system resources that you can consume under a shared plan, as well. (15% CPU, 512MB of RAM)
• Media Temple — Media Temple’s “Grid Service” offering, though pricier than most shared hosting services, is known for being more reliable. They use redundant server clusters that can “burst” extra resources to handle spikes in traffic. You get a 100GB storage pool and up to one terabyte of monthly network transfer. Media Temple offers a custom control panel, and one-click installs of popular software packages, such as WordPress.

Virtual Private Servers

While a shared host puts many users’ sites in the same server environment, a Virtual Private Server (VPS) is more like having a dedicated server, though it is significantly cheaper. Using a technology known as virtualization, a server is partitioned into several virtual servers. Far less customers are put on one machine, so you have a much greater share of the hardware’s resources, and you also have full control over the server environment. In most cases you’re given remote access to the command line, and you can install your choice of operating system (Linux or Unix distributions, in most cases) and configure things however you want.

There are two varieties of service you’ll find when you purchase a VPS: managed and unmanaged. With a managed server, you give up some control in order to have the provider take care of the technical details for you, and maybe offer a friendly control panel like cPanel. With an unmanaged server, you’re given free reign over your virtual machine and little support (unless you pay extra to be rescued). If you’re familiar with Linux and don’t mind getting your hands dirty in order to retool things for your needs, an unmanaged VPS is awesome.

• A Small Orange — (See the above entry under Shared Hosting.) A Small Orange also offers VPS plans, as well as dedicated servers. Their servers are fully managed, and include a cPanel license. So they’re a good bet if you don’t want to make the leap to managing a server and editing configuration files from the command line.
• VPS.net — My hosting provider of choice. They offer a few different services, their “cloud servers” offering being what I use. You get a scalable VPS (you can add or subtract “nodes” of resources and deploy them with a quick reboot) and unfettered access over SSH. It’s unmanaged unless you purchase optional “managed services” or one-time “do it for me” support tickets. It’s very reliable, and there are datacenters across several continents. A single-node VPS with 376MB of RAM, 10GB of disk space and 1TB of network transfer will run you $20/month. [Affiliate Link]
• Linode — Linode is a well-liked option along similar lines to VPS.net. Their offerings provide good bang for the buck (a 512MB system with 20GB of storage and 200GB of transfer will cost you $19.95/month) and they’re known for their support. They also have a nice collection of tutorials, which I have referred to in the past, even though I’m not a customer.
• Media Temple — MT also offers virtual servers, several variations of that theme in fact. They have their VE, GS and Nitro plans, which all have their different pluses and minuses. I don’t have any personal experience with Media Temple, though they have a good reputation and I had considered them at one point.
• Rackspace — Rackspace is a big player in the cloud server arena. They provide numerous services for varying needs. They host many web apps, like Amazon.
• Amazon Web Services — Few names are more well known in cloud services than Amazon. Their EC2 service powers a lot of big-name web apps and social networking sites, though it is just as viable for smaller sites. They also have S3, which is good for storing and serving static files, CloudFront, their CDN, and others.

Those are just a few suggestions. Whatever your needs are, there are many options out there. Be sure to shop around and look for reviews before comitting to a service.

A good resource for asking for advice is the Web Hosting Talk forum.

Blitz is a configurable service that will pound your site with page requests, allowing you to specify the concurrency, timeout, and duration of the onslaught. As it goes about this, it builds statistics and plots them along timelines. You can watch response times, errors and timeouts as it slowly ramps up the number of concurrent users until it reaches the maximum. At the end, it even projects how many hits per day your setup can handle at that rate.

The service has a generous free tier, though they offer paid upgrades for higher concurrency and duration. The free tier offers 250 concurrent users over a one minute rush. (Though if you sign up with this invite link, they will add additional concurrencies to your account.)

I found Blitz very useful when I was trying to squeeze faster response times out of my WordPress setup, tweaking my caching system options and adjusting Nginx and PHP configurations. Since they use the connections at their datacenter, you get more real-world results than if you simply ran Apache Bench locally on the server, or from your residential internet connection. Both tools have their uses, of course, and Blitz is a good one to have in your arsenal.

Your client-side JavaScript can query an API that doesn’t offer JSON-P support, by having it pass through your server first. You can even cache the results for awhile, so you don’t run into rate limit issues. And if JSON-P is a necessity, you can transform the API response from vanilla JSON to JSON-P by echoing some additional content into the request.

You can read how to do all this in an informative blog post by the founder of DuckDuckGo. It’s pretty much a matter of adding a location block that uses the proxy_pass function to pass the request along.

nginx JSON hacks [Gabriel Weinberg]