2015 Latest professional police HD video camera

2015-06-24 Thread Jenny

0.9USD LED Strip

2015-06-24 Thread HSUN LED
Hello, In the June our company recommend you SMD3528 and SMD5050 serires with super quality bright chips Big Promotion price as below : 1) 8MM-30 LED SMD3528 IP20--0.90USD/M 2) 8MM-60 LED SMD3528

Need your help on HAProxy Load balancing algorithms

2015-06-24 Thread Vinod Kishan Lalbeg
Dear Sir/ Madam, I am a PhD student in Pune, India. I am working on Dynamic Algorithms for High-Availability CloudServer Load Balancing in Linux Environment for QoS. I am very new to this concepts and technology.  As I was reading 

Re: Need your help on HAProxy Load balancing algorithms

2015-06-24 Thread Baptiste
On Wed, Jun 24, 2015 at 10:13 AM, Vinod Kishan Lalbeg vklal...@yahoo.com wrote: Dear Sir/ Madam, I am a PhD student in Pune, India. I am working on Dynamic Algorithms for High-Availability Cloud Server Load Balancing in Linux Environment for QoS. I am very new to this concepts and technology.

Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-06-24 Thread Olivier
Hello, Great ! I was actually speaking about it this morning at work ! Would love to see this feature integrated (can it be backported to 1.5 too ?) 2015-06-23 20:07 GMT+02:00 Dave Zhu (yanbzhu) yanb...@cisco.com: Hello all, I have a proposed enhancement that I have coded up and would like

Re: HTTP/2 -- is support required on the back end?

2015-06-24 Thread Shawn Heisey
On 6/24/2015 1:23 PM, Willy Tarreau wrote: Thus my first goal with HTTP/2 in haproxy really is to make it a solid H2-H1 gateway in order to provide a seamless migration to H2 to everyone, just like haproxy was massively used to provide IPv6 connectivity for the last IPv6 day. I'll still

Gopro,Xiaomi,SJ4000 Accessories promotional price

2015-06-24 Thread Ms. Cathy
PromotionalGopro,nb=sp;Xiaomi,SJCAM ActioncameraAccessoriesasfollows: MonopodPrice:usd1/pcs8stepFlexClipPrice:usd6.5/pcsGopro4DoublechargerwithC=ablePrice:usd2.28/setGopro4Battery1200mah

RE: Need your help on HAProxy Load balancing algorithms

2015-06-24 Thread Lukas Tribus
Hi Vinod, First, good luck in your PhD. For load-balancing algorithm, you want to read this part of the doc: http://cbonte.github.io/haproxy-dconv/snapshot/configuration-1.6.html#balance about the source code, it's available here: http://git.haproxy.org/?p=haproxy.git Also checkout 

Re: Spam

2015-06-24 Thread Hoggins!
Oh great ! I was not aware that this list was also a nest for personal attacks. Thank you. Le 24/06/2015 16:03, Willy Tarreau a écrit : On Tue, Jun 23, 2015 at 02:40:51PM +0200, Hoggins! wrote: Ha ha ! We could also imagine an anti-sarcasm filter. Not needed. Anyway, that still does not

Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-06-24 Thread Jarno Huuskonen
Hi, On Wed, Jun 24, Willy Tarreau wrote: On Tue, Jun 23, 2015 at 06:07:43PM +, Dave Zhu (yanbzhu) wrote: Hello all, I have a proposed enhancement that I have coded up and would like your comments. The idea behind this is that when HAProxy is used to terminate SSL, and is

Re: Spam

2015-06-24 Thread Willy Tarreau
On Tue, Jun 23, 2015 at 02:40:51PM +0200, Hoggins! wrote: Ha ha ! We could also imagine an anti-sarcasm filter. Not needed. Anyway, that still does not explain why such discussions on spam problems do not occur on other mailman MLs. Maybe you've been living under a rock for the last 20

Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-06-24 Thread Willy Tarreau
Hello Dave, On Tue, Jun 23, 2015 at 06:07:43PM +, Dave Zhu (yanbzhu) wrote: Hello all, I have a proposed enhancement that I have coded up and would like your comments. The idea behind this is that when HAProxy is used to terminate SSL, and is configured with multiple

RE: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-06-24 Thread Lukas Tribus
Currently, I?ve coded it so that this only happens when the client does not specify an SNI, but I?m looking for guidance on what you would consider to be the best solution. This approach can certainly be taken to be compatible with SNI. Is this something that you would be interested in

Re: LB as a first row of defence against DDoS

2015-06-24 Thread Baptiste
hi all, Sorry for not answering sooner, but you know, you say I'll do it in a couple of minute, then you focus on something else, then you forget, then you say I'll do it in a couple of minute, then :) First of all, such type of article takes a long time to write, to review, to fix, to

Re: LB as a first row of defence against DDoS

2015-06-24 Thread Krishna Kumar (Engineering)
On Wed, Jun 24, 2015 at 11:33 PM, Shawn Heisey hapr...@elyograg.org wrote: I agree - the blog talks of handling multiple attacks individually, but what we are trying to understand is - how can we handle multiple types of attacks in a single configuration. Not the exact configuration file, but

good news

2015-06-24 Thread Hanson
Dear Sir/Madam,Hello,thisj=olinafromCHZLightingTechnologyCo.,Ltd.,ourcompanyisa=professionalled down lightmanufacturerwithyearsexperien=ce.Ourled down lightareCE/ROHSlisted,warmlywelcomedb=ylotsofNorthAmericanclients.Sowewanttakeourselvesofopportu=nity toestablishingbusinessrelationwithyou.

Re: LB as a first row of defence against DDoS

2015-06-24 Thread Shawn Heisey
On 6/18/2015 4:32 PM, Shawn Heisey wrote: On 6/17/2015 9:29 PM, Krishna Kumar (Engineering) wrote: Referring to Baptiste's excellent blog on Use a lb as a first row of defense against DDoS @ http://blog.haproxy.com/2012/02/27/use-a-load-balancer-as-a-first-row-of-defense-against-ddos/ I am

led strip

2015-06-24 Thread HSUN LED
Hello, In the June our company recommend you SMD3528 and SMD5050 serires with super quality bright chips Big Promotion price as below : 1) 8MM-30 LED SMD3528 IP20--0.90USD/M 2) 8MM-60 LED SMD3528

Re: Spam

2015-06-24 Thread Willy Tarreau
On Tue, Jun 23, 2015 at 05:43:46PM +0100, Kobus Bensch wrote: I don't get any. None. Nada. Zilch. We actually *do* forward a bit of spam which is not caught by the filter, but nothing people can't cope with, and quite often the last-mile anti-spam can easily catch them while letting the

RE: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-06-24 Thread Lukas Tribus
Hey Willy, Lukas explained it pretty well, but I can expound on it some more. You can imagine a situation where HAProxy has 2 certificates of different key types; one ECDSA and one RSA. In the current codebase, if no SNI is used, the certificate that is used will be whichever certificate is

Re: LB as a first row of defence against DDoS

2015-06-24 Thread CJ Ess
Someone posted a link to a really tricked out anti-ddos haproxy config not long ago, it might be interesting to you: https://github.com/analytically/haproxy-ddos On Wed, Jun 24, 2015 at 11:51 AM, Shawn Heisey hapr...@elyograg.org wrote: On 6/18/2015 4:32 PM, Shawn Heisey wrote: On 6/17/2015

HTTP/2 -- is support required on the back end?

2015-06-24 Thread Shawn Heisey
When http/2 support lands in haproxy, will http/2 support also be required on the back end to take advantage of it? I'm hoping that I can leverage http/2 without immediate support on the back end. I would expect that the LAN connection between haproxy and the back end servers will be fast enough

Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-06-24 Thread Dave Zhu (yanbzhu)
Hey Willy, Lukas explained it pretty well, but I can expound on it some more. You can imagine a situation where HAProxy has 2 certificates of different key types; one ECDSA and one RSA. In the current codebase, if no SNI is used, the certificate that is used will be whichever certificate is the

Re: HTTP/2 -- is support required on the back end?

2015-06-24 Thread CJ Ess
http/2 takes how web sites have been architected for the last decade and turns it upside down, so I suspect it will take a while to really take hold. On haproxy's roadmap http/2 is in the uncategorized section. =P Also many people think that the TLS overhead that browsers have forced on http/2

Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-06-24 Thread Dave Zhu (yanbzhu)
I’ve coded up the functionality to check all of the intermediate certificates to ensure that they match the private key of the crt file. I’ve decided to toggle this functionality as a config option. Users can either choose to disable this entire feature (default), match only the private key/cert,

Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-06-24 Thread Willy Tarreau
On Wed, Jun 24, 2015 at 04:26:58PM +0200, Lukas Tribus wrote: Currently we mostly use RSA certificates. ECC (ECDSA) are different certificates and until RSA certificates are fully removed from the industry, we will have to support both. The change, if I understand correctly, allows serving

Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-06-24 Thread Dave Zhu (yanbzhu)
No, I do not handle that case at the moment. This is the kind of feedback I¹m looking for so thanks! I will start modifying the code to try to accommodate this. Any thoughts on the version of OpenSSL to try to code to? -Dave On 6/24/15, 11:54 AM, Lukas Tribus luky...@hotmail.com wrote: Does

Re: LB as a first row of defence against DDoS

2015-06-24 Thread Willy Tarreau
On Wed, Jun 24, 2015 at 09:51:36AM -0600, Shawn Heisey wrote: I was going to comment on the blog post so the author would see the request to put together a complete config with multiple front ends and back ends, with all of them using every one of the DDOS techniques included on the blog post.

Re: High performance HAProxy

2015-06-24 Thread Eduard Rushanyan
Hi Willy, I am happy to follow-up on the thread. Long story short - based on your suggestions we did further experiments with the setup and good news is things got improved. Thank you. Short summary would be: - cpu idle increased from 50%-80% - system avg load decreased from 8 - 3 -

Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-06-24 Thread Dave Zhu (yanbzhu)
On 6/24/15, 2:58 PM, Willy Tarreau w...@1wt.eu wrote: What I'm understanding here is that instead of using SNI only as the key to pick a cert, we want the (SNI, algo) combination. Coudln't we have two certs per SNI entry ? One in RSA form, the other one in ECDSA, and only provide what is supported

Re: High performance HAProxy

2015-06-24 Thread Eduard Rushanyan
On Thursday, June 11, 2015 5:42 PM, Eduard Rushanyan eduard.rushan...@yahoo.com wrote: Hi Willy, Many thanks for your time and all the suggestions. This looks great. I imagine we are going to try those and experiment for the next few days. I guess we'll hold off on the process binding

Re: Contribution for HAProxy: Peer Cipher based SSL CTX switching

2015-06-24 Thread Willy Tarreau
On Wed, Jun 24, 2015 at 03:06:32PM +, Dave Zhu (yanbzhu) wrote: Hey Willy, Lukas explained it pretty well, but I can expound on it some more. You can imagine a situation where HAProxy has 2 certificates of different key types; one ECDSA and one RSA. In the current codebase, if no SNI

Re: HTTP/2 -- is support required on the back end?

2015-06-24 Thread Willy Tarreau
On Wed, Jun 24, 2015 at 10:26:24AM -0600, Shawn Heisey wrote: When http/2 support lands in haproxy, will http/2 support also be required on the back end to take advantage of it? To add to what CJ Ess said, I'd mention that the real gains of HTTP/2 are between the client and the first point in