Re: Web security

From: Loganaden Velvindron <loganaden_at_gmail.com>
Date: Sun, 12 Apr 2015 17:31:13 +0000

On Sun, Apr 12, 2015 at 3:26 PM, S Moonesamy <sm+mu_at_elandsys.com> wrote:
> Hello,
> At 08:33 10-04-2015, Ish Sookun wrote:
>>
>> I managed incidents on the server(s) where some of the projects of that
>> web agency were running. I qualify those as medium-sized projects :-)
>>
>> What do you qualify as "very large projects"
>

Hi Ish,

I believe that this was before I left the said company in 2012.

In 2010, I worked on a very big project. I'm trying to reach my
ex-boss, but he doesn't seem to be around. I would just like to check
if it's ok with him if I disclose the client's name, which we will
call Big-Client for now.

So big-client came to us to develop a very complex website, and they
wanted it to be both fast & secure.

When we finished the first prototype, it was already quite slow, and
of course, Big-client wouldn't accept it. It was painfully slow, and
Big-client had made it clear that they wanted the website to load
completely in less than 30 seconds, despite the insane amount of
complexity involved in the code :-)

So it fell down to me to design a server architecture that would allow
the website to be fast & scale for huge number of requests. I believe
that it was one of the earliest attempts in Mauritius, at building
large scale infrastructure for a particular website. The standard LAMP
architecture just wouldn't work.

So, I started experimenting with multiple different Open Source
components, and I started hacking the code of said components. One of
them was memcached:

One of the patches here:
http://markmail.org/message/6ekrembdv5ml6o5i#query:+page:1+mid:6ekrembdv5ml6o5i+state:results

So as vulnerabilities were discovered in memcached, I started hacking
the code. memcached helped us to reduce database latency, by caching
the most common queries.

It's funny to think that many large websites scrambled to take my
patches for their memcached for their big websites, including several
large companies in the US :-)
At one point, we pushed the remaining server bits to the client,
documented it, and they took over the maintainance of the big website.

It appears that once I left, the said company took smaller projects in
scale, and they appear to have outsourced the infrastructure
management to another company. ex-employees have told me that it was
hard to find systems engineers who could design high-performance and
secure web servers, and the web agency couldn't find people of the
same caliber to fill in. I guess they scaled down their ambitions, and
went with sysadmins who deployed from templates, and watch servers
with top :-) :-D
Received on Sun Apr 12 2015 - 17:31:25 PST

This archive was generated by hypermail 2.3.0 : Sun Apr 12 2015 - 17:36:02 PST