CloudFlare's CEO says that free SSL will use SNI with ipv4 [1] and possibly non-SNI with ipv6 [2]. A CloudFlare engineer has discussed splitting the SSL handshake between servers so their many edge nodes don't need to keep customer secret keys in memory [3]. However, this sounds slightly different than the lazy loading behavior in the blog post.
For what it's worth, other scrypt wrappers have had similar difficulty in locating the scrypt primitive [1]. When I first browsed the scrypt source code, I have to admit I was also distracted by the file encryption code.
For commercial websites, the cheapest certificates I've seen are PositiveSSL certificates resold by gogetssl [1]. It's $4.55 for one year or $17.25 for 5 years.
Disclaimer: I have no affiliation with either site. I've never used gogetssl, but I will probably give them a shot the next time I need a certificate.
I've also experienced problems with lack of host/container separation with lxc on arch linux, e.g. shutting down container shut down the host. I suspected the problem was an improperly mounted/unmounted /dev or /sys in the guest.
I've had a much smoother experience with lxc on Ubuntu than arch. The core lxc developers work for canonical, and Ubuntu lxc bootstrap scripts are much more refined. Lxc support for arch linux is provided by the community, and at least when I tried last year, there were minor problems here and there.
On arch linux, I've found that systemd-nspawn support is much better than lxc's. The commands mkarchroot and arch-nspawn (in the devtools package) make running arch in arch straightforward.
Ideally both halves of the spacebar would default to space for accessibility, with a software or hardware toggle to change one side. For typist that use the left half of the space bar, the right half is wasted real estate.
I like the minimal ideals of the happy hacking keyboard but I think it went a little overboard. I like having an arrow cluster and page up/down for applications that don't support emacs/vi bindings. I do like how the number pad is removed. It's too infrequently used and increases the distance between keyboard and mouse.
I actually recently came across Japanese layouts because a user requested support in http://typing.io, a programmer's typing tutor I work on. I like the smaller space bar but dislike the shrunk delete/backspace key [1]. Backspace is already hard to type because of its distance from the home row. The problem is even worse for programmers because the right pinky not only needs to type most of the symbol keys, it also needs to correct typos made when these symbols are mistyped.
Caps lock should not be changed despite it's ostensible uselessness. Programmers often remap caps lock (I personally use this tool [1]), and it's nice to have a big target for the pinky. Remapping is of course possible with these new keyboards, but the split key design that replaces caps lock leaves a much smaller target. In addition, I'm sure there are hunt and peck typists that still legitimately use caps locks instead of shift because it requires less coordination and hand contortions, so leaving caps lock alone also has accessibility benefits.
One area where keyboard designers aren't innovating enough is the spacebar. The left 2/3 of the space bar is rarely used by most touch typists and hogs very accessible real estate. I like how Microsoft split the spacebar on their new keyboard [2] and replaced the left half with backspace, the most commonly typed (but normally most hard to reach) key.
I'm disappointed to see thinkpad/lenovo make these mistakes given their reputation for quality laptop keyboards. I personally use an x230 [3], which has a similar chiclet keyboard as the x1 carbon in the article without the transgressions.
My understanding is that Adam Langley prefers AES-GCM to all the other mac-then-encrypt cipher suites in tls 1.2. He's working on AES-GCM support in NSS [1].
Also, the if c1 ~= c2 branch is obviously not constant-time, but in practice it’s close enough that it won’t matter for our case. I’d prefer XORing the two strings together and seeing if the result is 0, but Lua doesn’t seem to include a bitwise XOR operator. If I’m wrong on this, I would appreciate a correction.
LuaJIT provides bitwise operators out of the box [1], and the creator also provides an extension for regular lua [2].
Systemd provides a hook (ExecStartPre [1]) for running test commands before starting a service, e.g. checking nginx configuration before starting. However, I also prefer the flexibility of shell scripts over something like systemd's INI service definition format.
I agree that nginx needs supervision less than most processes because it reinvents many wheels. However, supervision is still nice, e.g. your 'service nginx' example that uses Ubuntu's supervisor Upstart.
I agree it's not worth straining to make nginx's binary upgrade work with arbitrary supervision. However, if someone created a supervisor that solves this problem (systemd), I might give it a try.
Disabling daemonization allows nginx to be monitored initially and through conf reloads but not binary upgrades (e.g. nginx 1.5.1 -> nginx 1.5.2). The binary upgrade process forks the master process, which it 'orphans' from runit and reparents under pid 1.
Supervision has many benefits besides automatic restarts after crashes. Supervising programs provide a consistent way to start, monitor, and log long running programs. Nginx reinvents its own interface for some of this functionality (like daemonizing, log rotating/compression, conf reloading, etc.), but it's useful for all services to work under the same interface. This is especially true for monitoring nginx's status, where a supervisor like runit is much nicer than 'pgrep nginx' or 'ps aux | grep $(cat /where/nginx/dumps/its/pid)'.
Systemd provides many knobs for tuning cpu, memory, and io settings [1] using cgroups. This deep integration is one of the reasons why systemd only runs on linux.
I use runit in production for http://typing.io. I appreciate runit's strong unix philosophy (shell scripts instead of dsls). However, I'm starting to experiment with systemd because of features like properly tracking and killing services [1]. This feature would be useful with a task like upgrading an nginx binary without dropping connections [2]. This isn't possible with runit (and most process monitors) because nginx double forks, breaking its supervision tree.
[1] https://news.ycombinator.com/item?id=7910849
[2] https://twitter.com/eastdakota/status/478369486643658754
[3] http://www.slideshare.net/cloudflare/running-secure-server-s...