WDTalk

It seems like I see a new web hosting review site daily - and most share a common theme – their top ten web hosting providers all look like affiliate links. By affiliate links, I mean the web hosting review site owners either make a commission every time a shopper clicks thru from one of their top ten sites, or purchases hosting from them.

Sadly, the majority of review sites actually have - NO verifiable reviews. Most of the reviews I read are either from shills or disgruntled clients, or are so old, they don’t pertain to a provider’s current operations.

From Wikipedia:

A shill or plant is a person who helps another person or organization to sell goods or services without disclosing that he or she has a close relationship with the seller. The shill pretends to have no association with the seller/group and gives onlookers the impression that he or she is an enthusiastic independent customer. The person or group that hires the shill is using crowd psychology, to encourage other onlookers or audience members (who are unaware of the set-up) to purchase the said goods or services.

For shoppers searching for the best web hosting provider - web hosting review sites may NOT be the best resource. A better option would be to visit any number of web hosting forums, like WebHostingTalk or HostingDiscussion. Reviews there are verified by moderators of their respective forums. One of the prerequisites is that you have to be hosted with a provider to post a review about them – verified by your URL. As well, members of these forums weigh in on the validity or merits of each review.

Google is still one of your best friends when it comes to doing research - on web hosting providers, combined with pre-sales chats with prospective hosts.

Didn’t your Mom tell you not to play with fire? Weak passwords put your personal identity or business data at risk of being compromised. How important is password security? A simple Google search for password security just now returned over 540 million results – that’s significant! I cannot overemphasize how important it is to use STRONG passwords.

Some guidelines

• Use at least eight characters, with mixed case letters (upper and lower case)
• Use a password that can be typed quickly (to prevent over the shoulder spying)
• Mix alpha numeric characters in a seemingly random manner.
• Change your password regularly.
• Do NOT use words that are included in any dictionary – even encrypted, these can be cracked in seconds!!
• Do NOT use dates
• Do NOT use information that can be easily obtained about you. This includes your nickname, your pet’s name, your hometown, etc.
• Do NOT use all numbers or all alphabet characters – mix them!
• Do NOT reveal your password to anyone!

There are any number of websites that help you understand - how vulnerable your passwords are – one of those is http://howsecureismypassword.net/ Simply enter your password and it will return how long it would take to crack it. Mine was six thousand years, but I could improve that by using a symbol instead of just letters and numbers.

Microsoft also has a password security strength checker - located at https://www.microsoft.com/security/pc-security/password-checker.aspx. Starting at a rating of STRONG, I had to add 10 symbols to raise that level of security to BEST. Going back to HowSecureIsMyPassword, when I typed in Microsoft’s BEST, here is the result I got - It would take a desktop PC about 523 sextillion years to crack your password. Works for me!

Burst versus swap discussions are normally – comparisons of OpenVZ versus Xen memory management. There are advantages and disadvantages to each, with burst associated with VZ and swap to Xen. Assuming everything else is equal, which would you consider is the better option – 1024MB guaranteed (SLM) or 768MB guaranteed (burstable to 2048MB)?

I just read of an experiment – pairing the two technologies under load conditions. The test involved an OpenVZ container (512MB dedicated RAM with 512MB burst) versus a XEN based VPS (768MB with swap). A basic Debian 5 64 bit OS was installed on each with LAMP, email and Jabber/XMPP. The total OpenVZ memory usage equaled 445MB versus XEN’s 296MB.

So what can we take away from this test? If you’re running Java or other applications that tend to allocate large amounts of virtual memory, OpenVZ containers (without burst) will have less guaranteed memory available. Enter burst .. OpenVZ needs an appropriate amount of burst (usually 1.5 to 2 times the guaranteed).

Beyond guaranteed to burst and swap – access latency on RAM (burst) is measured in nanoseconds whereas swap (HDD) is measured in milliseconds (much much slower). Swap is slow, so you want ample guaranteed (SLM) to handle your applications. Plus, your system cannot execute stuff out of swap. It has to be in active RAM to execute. With both burst and swap, you want just enough allocation to handle inactive data, keeping as much active data in guaranteed RAM as possible.

Overselling can be – an issue with OpenVZ, e.g., killing your application if it bursts beyond the guaranteed resource allocation, instead of simply slowing down as with a true dedicated server. The kernel of Virtuozzo cannot be modified as it’s based on an OS template. By contrast (using default settings), Xen doesn’t allow overselling, so a physical server with 16GB of RAM would be limited to 64 x 256MB virtual machines. Plus, XEN allows you to fully modify the kernel, so advanced users can compile and load their own modules, resulting in properly virtualized memory, IO and scheduler – that’s stable and predictable.

Bandwidth is defined as:

Measure of data flow rate in digital networks

From Wikipedia:

In website hosting, the term “bandwidth” is often incorrectly used to describe the amount of data transferred to or from the website or server within a prescribed period of time, for example, bandwidth consumption accumulated over a month measured in gigabytes per month. The more accurate phrase used for this meaning of a maximum amount of data transfer each month or given period is monthly data transfer.

On hosting packages - one of  the features always listed is monthly bandwidth allowed. There seems to be some confusion converting Mbps to GB or TB per month, so I’ve assembled a quick reference, based on a 30 day month.

There’s a lot of controversy in web hosting circles – on how to compete with bandwidth offers, with some providers offering unlimited bandwidth on their plans, although most restrict this to shared hosting only.

Unlike most, I suppose, when I see the term UNLIMITED - I always look for the fine print, very much the same way I view the term FREE. I’m like, I know there’s a catch, but now where to find out what it is.

And I’m not saying all Unlimited offers are bad – just that it normally pays huge dividends long term to know what to expect when your website gets popular, and starts pushing a ton of traffic. Some providers handle Unlimited very well, while others will boot you in heart beat for violating their Terms and Conditions (buried somewhere in there is a clause that explains how their Unlimited offer really isn’t Unlimited).

I ran across an advertisement this morning – for Unlimited bandwidth on a dedicated server, which is very rare. I won’t say who the provider is, but here is a quote from their website:

Naturally with unlimited traffic for more cost transparency

(note that there is no asterisk on traffic)

Under benefits, they show

Traffic                   Unlimited*

(now comes an asterisk – uh oh, have to read the fine print)

At the bottom of the page, in small print

*There are no charges for overage. We will permanently restrict the connection speed to 10 MBit/s if more than 10,000 GB/month are used (the basis for calculation is for outgoing traffic only. Incoming and internal traffic is not calculated). 100 MBit/s speed can be optionally restored by committing to pay 6,90 € (incl. VAT) per additional TB used. Please see here for information on how to proceed.

So what can we glean from this clause? First, that their servers are on a 100Mbps uplink port, which is an industry standard, but it also LIMITS your data transfer to that speed. And then there’s that opening sentence about no charges for overage – but wait, what overages? I thought this was unlimited.

On to 10,000GB/month or 10TB/month – that’s a lot of data transfer, but it isn’t “unlimited.” OK, so your site has pushed in excess of 10TB so far this month, and you got hit with a notice that your port speed is now “permanently” restricted to 10Mbps, or one tenth of what they could allow.

Option 1: If you expect a continuing excess of traffic limit, we offer for 6.90 € each additional GB of bandwidth to the permanent establishment to 100 Mbit / sec.

Notice the hyperlink here in their clause on how to proceed. Seems that permanent really isn’t permanent if you start paying, but wait – the clause says 6.90 per additional TB used, but when clicking through, Option 1 states 6.90 for each additional GB of bandwidth – that’s a HUGE difference. I can’t help but think one of those is a typo.

Again, I’m not saying Unlimited is necessarily bad – just that you need to calculate the risks associated with these offers by reading the fine print first. Whether or not a provider offers limits on bandwidth or offers unlimited is not a reflection of the quality of their respective services.

Revised Oct 21, 2011

Private versus Public Cloud Solutions
Let’s face it, there are BILLIONS of dollars invested in existing IT infrastructure. As more and more enterprise vendors step into the cloud arena, will business in general migrate to the public cloud or opt instead to keep much of their investment in legacy code and custom applications in-house via a private cloud?

The future of cloud computing is up in the air (pun intended)
At this point, we don’t really know how cloud technology is going to shake out. Even if cloud technology gets huge, there’s likely to be a split between private and public clouds for the foreseeable decade. I think as the industry matures, you’ll see commodity services migrate to the public cloud and mission-critical stuff linger in a private cloud.

OK, so what is cloud computing?
Essentially, cloud computing is simply another way of delivering computing resources to run websites and web applications. It allows clients to scale their operations, horizontally and vertically, based on the demands of their users, while ensuring that there are adequate resources to support their apps. You can think of it as technology services delivered on-demand.

Traditional web hosting services are offered in packages with set limits on disk space and data transfer, so as traffic fluctuates, data and transfer needs vary resulting in excess, unused capacity during lean times.

Who could benefit from Cloud Services?
Essentially, everyone could benefit from cloud technology. Businesses that experience seasonal spikes, especially eCommerce retailers, where 80+ percent of their business peaks during holiday seasons, are prime candidates for cloud services.Cloud computing offers those businesses enough services to meet their increased traffic demands, then the option to scale back after the holidays, aligning their operating costs with revenue.

Taking the lead from the BIG vendors
Nearly all of the BIG vendors, from Microsoft to HP and IBM to CISCO, are talking cloud, with most listing their top two priorities as virtualization and cloud computing (virtualization is a cloud enabler). Google and Amazon already host public clouds while vendors like EMC are promoting solutions that virtualize existing servers and storage (private cloud).

Types of private versus public cloud solutions
As the following graphic from Microsoft highlights, there are choices to both private and public cloud services. Of course, these are not all inclusive. In the following months, I’ll address different cloud scenarios, demystifying some of the confusion about what cloud services really offer

There are over 500 pages of articles - on Wikipedia related to DDoS attacks, and a quick Google search this morning returned 3 1/2 million results. So what are DDoS attacks and should you be concerned?

I found a great definition of DDoS at TechTarget.com:

A distributed denial-of-service (DDoS) attack is one in which a multitude of compromised systems attack a single target, thereby causing denial of service for users of the targeted system. The flood of incoming messages to the target system essentially forces it to shut down, thereby denying service to the system to legitimate users.

In a typical DDoS attack, a hacker (or, if you prefer, cracker) begins by exploiting a vulnerability in one computer system and making it the DDoS master. It is from the master system that the intruder identifies and communicates with other systems that can be compromised. The intruder loads cracking tools available on the Internet on multiple — sometimes thousands of — compromised systems. With a single command, the intruder instructs the controlled machines to launch one of many flood attacks against a specified target. The inundation of packets to the target causes a denial of service.

I’ve read tons of threads about DDoS attacks - on web hosting forums, but didn’t fully realize how destructive they could be, or how hard they are to mitigate. After reading through some articles like the ones below, I’ve come to realize that these attacks can, in fact, cripple a provider’s ability to deliver stable hosting solutions to not just businesses, large or small, but to the infrastructure of governments, as well.

DDoS Attacks On the Rise in 2011

The company’s semi-annual Web Hacking Incident Database (WHID) report found the attacks jumped 22 percent from the first half of 2010, overtaking methods such as SQL injections and cross-site scripting (XSS) attacks. DDoS attacks occupied 32% of attacks while SQL injection and XSS attacks took up 21% and 9% respectively.

Head of Russian Payment Processor held over DDoS-for-Hire plot

 One of the co-founders of ChronoPay (a Russian 3PP – 3rd Party Payment Processor) was arrested on the alleged connection between him and a hacker who was hired to run a distributed denial of service attacks against a business rival. Russian Pavel Vrublevsky who is also an owner in a company called RS-Promotion …

Malware in Recent Korean DDoS Attacks Destroys Systems

 There has been quite a bit of news recently about distributed denial of services (DDoS) attacks against a number of South Korean websites. About 40 sites– including the Presidential, National Intelligence Service, Foreign Ministry, Defense Ministry, and the National Assembly–were targeted over the weekend, beginning around …

WordPress.com DDoS Attacks Primarily From China

 After recovering from the largest Distributed Denial of Service attack in the service’s history (“multiple Gigabits per second and tens of millions of packets per second”) yesterday morning, blog host WordPress.com was attacked again very early this morning, finally stabilizing its …

There is a DDoS mitigation industry devoted to - fighting these attacks, and some companies are better than others. So how would you know which DDoS mitigation company is best suited to minimize your risks? Like every other industry, longevity speaks volumes – how long have they been in business? Some questions to ask:

• What’s their track record?
• How many attacks do they mitigate each month?
• What is their typical “time to mitigate?”
• How much bandwidth do they have dedicated to mitigating attacks? (DDoS attacks take up a LOT of bandwidth)
• How is their network globally distributed?
• Which tools and techniques do they employ to detect, analyze, and mitigate DDoS attacks?