So, how is that PHP on CGI going?

[colossus]

Hi:

It's more than 3 months now that the server we are hosted in, Platinum, was upgraded (MySQL, CGI-PHP and e-mail system). The first days after the migration, everything seemed to be as usual (not too bad) or even a little bit worse. But, from then on, I must say that the server has been faster and more stable than ever.

I was wondering, how are things going for other Jag users?

Regards, and happy new year: Colossus

[Vin DSL]

It's more than 3 months now that the server we are hosted in, Platinum, was upgraded...

The first days after the migration, everything seemed to be as usual (not too bad) or even a little bit worse...

But, from then on, I must say that the server has been faster and more stable than ever...

This is a joke, right?

They kicked me off Platinum about "3 months (ago) now", and a "few days after the migration".

If you guys miss the old days, I'll move back...

Bwahahaha!

Happy New Year, bro...

[mattsiegman]

That means you shouldn't have been there anyway & you had outgrown shared hosting :P

[Gwaihir]

Yes, it does. But what he probably means to say is that Platinum's sudden stability has little to do with the PHP change, but everything to do with his site leaving it. He could be right, though of course, he may be giving himself / his site, way too much credit, as usual .

[Vin DSL]

Heh! Sceptical, eh?

I don't normally do this, but since this isn't privileged info anyway, and you're basically calling me a liar...

2006-10-03 / 23:47:22

As you are probably aware that the server Platinum goes under high loads frequently, so much so that the server becomes inaccessible. And only a restart of services brings it back to normal. We have been monitoring this for the last couple of days. After carefully watching the server processes at the time when the load increases and server becomes inaccessible, we have identified that your account is one causing this problem with a VERY HIGH web traffic utilizing very high CPU.

You need to upgrade the account to a SEMI-DEDICATED or VPS.

Names have been removed to protect the innocent...

Satisified?

[Gwaihir]

Heh! Sceptical, eh?

I don't normally do this, but since this isn't privileged info anyway, and you're basically calling me a liar...

Neh; not doubting for a moment that you wouldn't have been anxious to fork over the extra money unless told you really had to upgrade. I just hope it takes two or three accounts like yours to bring a shared server like Platinum from in the green all the way up to in the red. That note suggests something like that to be the case, identifying your account as "one causing ..", as in "one of a few", rather than "the (only) one".

Oh, and aside from that, it was just to good a chance to bait you a bit to pass up . Didn't think it would be that easy though.

[JPC-Greg]

Actually platinum may have been in part due to Vin there but to answer you; the php cgi change has made a significant improvement to all the systems that were changed. Stability, reduced downtime, finding problems or problem site/users faster, and the end results just been more performance and stability. It was a good move for us and our users.

[colossus]

...It was a good move for us and our users.

I agree. Besides security and stability, our web is easier to manage now (all files been your user's, you know). And the fact that you may link a problem to a particular account is a good side-effect I hadn't thought of until I read Vin's post.

Good work

Regards: Colossus

[Vin DSL]

And the fact that you may link a problem to a particular account is a good side-effect I hadn't thought of until I read Vin's post.

Good work

[colossus]

Do not misunderstand my words. When you said you were overloading the server I thought "Sure: with all that CGI thing, relating a problem to an specific user must be a lot easier to Jag Staff". That's all.

As I told you some time ago, it was good to hear that you were in the same server than us. You'll be missed

Anyway, you needing a semi-ded now means that your webs are doing fine, doesn't it?

Regards: Colossus

[Ron]

I guess I can tell what that proof of concept was now.

I sent to JAG an email proving that in 9 minutes I had gone from concept to holding in my hand the database passwords of another account on my server, to writing down the whole process and sending it as the PoC. 9 minutes. Having the password in hand meant that I could have dumped out the data, modified the data, or completely emptied the database. Whatever.

If I had gone on, in under an hour or two (depending on the speed of the disk) I could have had the password for every database on the server. Further, everything on /home was vulnerable, so keeping things "outside of your webspace" wasn't secure either, as suggested by some.
Some OS files were probably vulnerable. I didn't want to muck around with them, so I didn't check.

There was a reason for the change!

Someone was fond of deriding this change and saying that it was only because I was on the server. That really wasn't the main issue. The main issue is that once ANY site on the server had been compromised by a hacker ALL SITES on the server were then completely naked to the hacker. That's an environment in which I didn't want to be.

[Ron]

Oh yeah, and by the way if I remember correctly, PHP announced itself as an Apache module in the server headers. Niiiiiiice touch!

[Vin DSL]

Here's the thing...

My point, all along, has NOT been whether or not PHP-CGI is secure, but rather that it is inefficient and CPU intensive. However, that idea was either attacked or dismissed. It was, like, "Vin doesn't know what he's talking about", "Vin doesn't like change", "Vin is just being paranoid", and finally, "STFU, Vin, it's our servers, not yours." So, I went along with 'the program', albeit kicking and screaming, figuring it's JagPC's CPUs, not mine. No skin off MY nose!

What happened after 'the upgrade', so called?

After three years, all of a sudden MY web site was deemed inefficient, CPU intensive, and ultimately suspended.

Anyway, this is still a sore point with me, so I'll stop. In the end, everything worked out.

And, life goes on...

[Ron]

No Vin, you kept saying that the upgrade was going to be a nightmare, and there was no valid reason for doing it. You were simply being obstreperous and scaring people.

There was no nightmare, Masood had it covered, it went more smoothly than even I hoped, and you KNEW that your site was going to be flagged as resource intensive, and THAT is why you did it. It was selfish... and you know it.

It is your own fault that your site is resource intensive, too. You invited all the bots to index away like crazy, and seemed to enjoy getting tens of thousands of spam emails a day. But mostly, you just haven't figured out how to re-work your app to be server friendly. Since the vast majority of your traffic (according to the stats you yourself published) are bots, how about making some quasi-static pages for the bots, Vin. Update the files once a day or once an hour if you must.

If you put that energy of yours into a more productive avenue, you'd still be on a Longhorn, and wouldn't have been the reason for everyone else's nightmare on your old server.

By the way, why are you so happy about that?

[Ron]

...and finally, the test of time has PROVEN that YOU WERE WRONG about resources and CGI speed on top of it all.