Top all-time · #2949
Paul Querna
Personal blog · journal.paul.querna.org/articlesprogrammingsystemsweb
Paul Querna writes Paul's Journal, a personal blog at journal.paul.querna.org about programming, systems and web. Since 2008, 24 different Hacker News readers have linked it 49 times, most often “Making SSL Fast, Overclocking mod_ssl”. The last post was in 2019, but the archive is still widely read.
Too few sampled comments (13) to say how often HN recommends it.?
Why HN links it
HN readers link his posts on SSL/TLS performance and OpenSSL tuning, plus logging as JSON and Go performance. Commenters cite them as technical background for their own points.
Summarised by Claude from a sample of 13 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Making SSL Fast, Overclocking mod_ssl4 people · 4 mentions · first linked 2010-07-10
- Show HN: ffjson: faster json serialization in Go3 people · 3 mentions · first linked 2014-03-31
- Log for Machines3 people · 3 mentions · first linked 2011-12-27
- OpenSSL memory use in Node.js3 people · 3 mentions · first linked 2011-04-05
- Downtime page in Apache2 people · 3 mentions · first linked 2009-08-25
- Security of Infrastructure Secrets2 people · 2 mentions · first linked 2013-11-10
- Drinking the Node.js Kool-Aid2 people · 2 mentions · first linked 2010-06-12
What Hacker News says?
This is a really great step forward - thanks Mitchell! I've recently spent a couple of weeks doing a deep dive into Docker, so I'll share some insights from what I've learned. First, it's important to understand that Docker is an advanced optimization. Yes, it's extremely cool, but it is not a replacement for learning basic systems first. That might change someday, but currently, in order to use Docker in a producti…
Comment linking /articles/2013/10/15/docker-ubuntu-on-rackspace/
on “Vagrant Feature Preview: Docker-Based Development Environments”Submitted The switch: Python to Node.js as a story · 207 points
HN discussionI wrote this up awhile ago for how to do this in pure httpd configuration: http://journal.paul.querna.org/articles/2009/08/24/downtime-...
Comment linking /articles/2009/08/24/downtime-page-in-apache/
on “Website outages and blackouts the right way”Submitted OpenSSL memory use in Node.js as a story · 196 points
HN discussionWhen you use a remote blockstore like they are as your storage, you also generally are always booting via PXE, and so far have a provider controlled kernel. I used to work on Rackspace OnMetal: http://www.rackspace.com/cloud/servers/onmetal https://journal.paul.querna.org/articles/2014/07/02/putting-... In OnMetal this not the case -- you get local storage, you have your local kernel that you can re-install or do wh…
Comment linking /articles/2014/07/02/putting-teeth-in-our-public-cloud/
on “Scaleway: Bare metal SSD ARM servers”Submitted Java Trap, 2010 Edition as a story · 177 points
HN discussionThere are libraries that generate specialized marshallers to fix precisely this issue: https://journal.paul.querna.org/articles/2014/03/31/ffjson-f...
Comment linking /articles/2014/03/31/ffjson-faster-json-in-go/
on “Go Performance Tales”Submitted Drinking the Node.js Kool-Aid as a story · 89 points
HN discussionWhile this is probably security related, disabling compression is actually a good practice for clients which make a large number of SSL requests (like a browser). OpenSSL allocates alot of memory per connection for compression/decompression. See http://journal.paul.querna.org/articles/2011/04/05/openssl-m... for a great discussion of why SSL_OP_NO_COMPRESSION might make sense for you. Even if you don't have direct a…
Comment linking /articles/2011/04/05/openssl-memory-use/
on “Google disables compression for OpenSSL in Chrome - SSL exploit coming?”Submitted Rackspace Interview Process as a story · 87 points
HN discussionI previously wrote about making a downtime page: http://journal.paul.querna.org/articles/2009/08/24/downtime-... One thing you'll probably want to do is set 5xx HTTP status codes on your static site, and to try to get things to not cache it as much as possible.. A redirect to a subdomain hosted on s3 makes it more likely something like Google will pick up on it.
Comment linking /articles/2009/08/24/downtime-page-in-apache/
on “Keep a static "emergency mode" site on S3”Submitted Show HN: ffjson: faster json serialization in Go as a story · 83 points
HN discussionNo, we were not able to find everything we needed out of the box. We had to write many things. There is a list of our dependencies at the bottom of this post: http://journal.paul.querna.org/articles/2011/12/17/technolog... Having said that, the only ones I consider moderately painful is when we need to deal with node-thrift, which on the Python or JVM is well maintained by existing groups.
Comment linking /articles/2011/12/17/technology-cloud-monitoring/
on “The switch: Python to Node.js”Submitted Putting Teeth in Rackspace Public Cloud as a story · 79 points
HN discussionSo on most real world applications, you shave perhaps a second or two off compilation and linking times. That's great, but... why does Go still have such an abysmal regexp package that is an order of magnitude slower than C and C++?[1] Why does encoding/json still rely on reflection, making it slow compared to other approaches?[2] In other words, I guess I feel like there are areas with more bang for the buck. The c…
Comment linking /articles/2014/03/31/ffjson-faster-json-in-go/
on “Go 1.3 Linker Improvements ”Submitted Who are you coding for? as a story · 67 points
HN discussionBit of commentary from somebody who was there (but didn't see anything): http://journal.paul.querna.org/articles/2010/11/06/disappoin...
Comment linking /articles/2010/11/06/disappointed/
on “A hell of a time”Submitted Designing Network Protocols as a story · 66 points
HN discussionthis is our ssl optimisation list. it has some tradeoffs like using small keys (1024bit) which may not be appropriate in a lot of situations. 1. Don't use ephemeral diffie helman for key negotiation. This means if an attacker compromises your private key in the future he can decrypt all your past transactions he has recorded. But it does give a nice speed boost. Understand the security implications and if you are ha…
Comment linking /articles/2010/07/10/overclocking-mod_ssl/
on “Tips to accelerate SSL”Submitted Technology behind Rackspace Cloud Monitoring as a story · 59 points
HN discussionMy time as a system administrator makes me rather fond of logging as text into files. They're simple, easy to scale, to rotate, to compress and to throw away. One variation on this theme that I read about recently is to produce log lines as JSON objects rather than more "traditional" printf-formatted text. This gives machine readability but also makes for really simple tools for extracting whatever "traditional" log…
Comment linking /articles/2011/12/26/log-for-machines-in-json/
on “Three things you should never put in your database”Submitted Security of Infrastructure Secrets as a story · 58 points
HN discussionThere are some server-side implementation notes here, focused on Apache: http://journal.paul.querna.org/articles/2010/07/10/overclock... http://www.imperialviolet.org/2010/09/05/blacklisting.html is also interesting; it says Chrome will use a blacklist to avoid using False Start on some domains. Also, does anyone know which older clients require that the server cache the session information? The article doesn't say.
Comment linking /articles/2010/07/10/overclocking-mod_ssl/
on “Overclocking SSL”Submitted Log for Machines as a story · 55 points
HN discussionYour chained cert might actually be the bottleneck if the total data exceeds 4K and the user has to do a second round trip to ACK the cert. http://journal.paul.querna.org/articles/2010/07/10/overclock... Basically, unless you are certain you need it 4096 bit security, use a 2048 bit key (1024 is not secure anymore) and only include the minimum number of intermediate certs you can get away with. OSCP stapling doesn't…
Comment linking /articles/2010/07/10/overclocking-mod_ssl/
on “Securing a Rails App against Firesheep with HTTPS”Submitted Mod_v8 as a story · 49 points
HN discussionNo idea and probably not. The Bloglines podserver/itemdb was built internally. You can get some idea of the setup by reading the slides from pquerna's GeekSession's talk: http://journal.paul.querna.org/wp-content/uploads/2007/10/bl...
Comment linking /wp-content/uploads/2007/10/bl-geeksessions.pdf
on “Bloglines to close”Submitted SSH Proxy Commands that use `sed` as a story · 42 points
HN discussionNo. The better way is to change the URL -- then you setup your ETags + Cache-Control so that the object never expires, ever. See Also: http://public.yahoo.com/bfrance/radwin/talks/http-caching-ap... http://journal.paul.querna.org/articles/2007/06/06/mod_never...
Comment linking /articles/2007/06/06/mod_never_expire/
on “Amazon CloudFront Support for Custom Origins”Submitted Internet Security is a Failure as a story · 39 points
HN discussion
