Slashdot Mirror

Hi! we run a non-profit website that gets 100 million visitors a day on ~350 servers. we don't even use any "clustering" technology, just replication for databases, and software (LVS) load balancer in front of both app (PHP) and squids at the edge. but oh well, you can always waste money on expensive hardware and clustering technology. and you can always check how we build things

I covered most of Wikipedia technology bits at my previous year MySQL Conference presentation: http://dammit.lt/uc/workbook2007.pdf (thats quite detailed report)

Just for your interest: http://stats.grok.se/ is a nicely processed version of the data available on Domas Mituzas' wikistats page. Domas is one of the Wikimedia database gurus, who started as a volunteer, got hired by MySQL because of it (Wikimedia is a fine example of extreme MySQL) and was recently drafted to the Wikimedia board. Original announcement of good stats, Domas' blog post. And it is indeed every page view, close as we can get it. As you can imagine, getting data this accurate for a site as busy as Wikimedia (#8) with the budget of Wikimedia (>$0, give or take a few million) is an incredible win.

Just for your interest: http://stats.grok.se/ is a nicely processed version of the data available on Domas Mituzas' wikistats page. Domas is one of the Wikimedia database gurus, who started as a volunteer, got hired by MySQL because of it (Wikimedia is a fine example of extreme MySQL) and was recently drafted to the Wikimedia board. Original announcement of good stats, Domas' blog post. And it is indeed every page view, close as we can get it. As you can imagine, getting data this accurate for a site as busy as Wikimedia (#8) with the budget of Wikimedia (>$0, give or take a few million) is an incredible win.

Just for your interest: http://stats.grok.se/ is a nicely processed version of the data available on Domas Mituzas' wikistats page. Domas is one of the Wikimedia database gurus, who started as a volunteer, got hired by MySQL because of it (Wikimedia is a fine example of extreme MySQL) and was recently drafted to the Wikimedia board. Original announcement of good stats, Domas' blog post. And it is indeed every page view, close as we can get it. As you can imagine, getting data this accurate for a site as busy as Wikimedia (#8) with the budget of Wikimedia (>$0, give or take a few million) is an incredible win.

Just for your interest: http://stats.grok.se/ is a nicely processed version of the data available on Domas Mituzas' wikistats page. Domas is one of the Wikimedia database gurus, who started as a volunteer, got hired by MySQL because of it (Wikimedia is a fine example of extreme MySQL) and was recently drafted to the Wikimedia board. Original announcement of good stats, Domas' blog post. And it is indeed every page view, close as we can get it. As you can imagine, getting data this accurate for a site as busy as Wikimedia (#8) with the budget of Wikimedia (>$0, give or take a few million) is an incredible win.

That would be because we do frankly insane things to keep it all working (sanity is cheaper than spending actual money). (Remember, we have no money and mostly volunteer sysadmins!) Also, MySQL employs our DBAs ... we're one of the cutting-edge extreme users that Marten Mickos mentions in his comment above.

Here
Here
Here
Here
Here

Or you can search for php vulns and worms like Santy... Some of the above are probably dupes.

Now confirmed, a worm nicknamed 'Scalper' is spreading that exploits the week old Apache HTTP Server chucked encoding vulnerability. The new worm was first seen after it attacked a honeypot in Lithuania hosted by MicroLink, and seemingly has dDoS objectives in mind. Luckily, the worm has not picked up much steam yet, so take this opportunity to patch your servers.

According to the reference page, the actual exploit is done by sending an HTTP POST request to a vulnerable server. Is it enough to put a restrictive LIMIT POST directive in the .htaccess or httpd.conf file? Or would the server still be vulnerable?

FYI, running on cable in the ever-popular 24 /8 and haven't seen anything strange in the access log (yet)

But why bother with disassembly. Just look at the source code.
http://dammit.lt/apache-worm/apache-worm.c

ELF 32-bit LSB executable, Intel 80386, version 1 (FreeBSD),
dynamically linked (uses shared libs), not stripped

Source code for the worm

Looks like the source code to this worm is now here

Apache worm in the wild, doo-dah, doo-dah. Strangely, IIS is not affected!