It’s a very small, 50MB distribution of linux that is not that easy to install if you don’t have a linux box to start with. Despite the large number of Linux boxes that I once owned, I’ve replaced all of them with Mac OS. Fortunately, there is a simple way to install DSL on a USB boot drive from Mac OS, using VMWare Fusion.

You’ll need a 1GB USB drive. The smaller the drive is, the better. Some systems cannot boot off of very large USB drives. 512MB or 1GB is recommended.

Here’s the how to…

Download the latest copy of DSL from a mirror.

Do not use syslinux, but get the ISOLINUX version. This is the ISO named dsl-x.x.x where x.x.x is a version number. I used dsl-4.4.10.iso, although in retrospect I should have used the VMWare VMX Image. Either works.

Insert the pendrive and format it.

Mac OS will auto mount the pendrive. Open Disk Utiilty.
Format the device as MS DOS FAT and MBR.
One Partition.

Important: Unmount the pendrive before starting VMWare Fusion.

Create a new VMWare Fusion Virtual Machine

The general idea here is to create an empty VM using fusion, and to boot off of the ISO you have just downloaded.
It can be reasonably small. You do not need to allocate disk space on your HD.
Configure the VM as Linux/Ubuntu and to mount the CD.

Mount the pendrive as an “Alcor Micro Mass Storage” device. It will appear to your VM as /dev/sda.

Install DSL

When DSL boots up, at the “boot:” prompt, type “install”
Then, select “5″ for “USB Pendrive HDB boot install”

Answer yes to all prompts, and the install will (hopefully) complete.

Now What?

You’re done. DSL is great for password recovery, emergency repair, or system rescue. So long as your system supports booting from USB drives, you’re good to go!

Details of the talk are available on the Veloctiy 2009 site.

You can Watch the presentation (off of blip.tv) and download a PDF containing all of the slides here.

Update: It looks like blip.tv and O’Reilly moved some links around. Page updated.

mod_telemetry keeps track of all URLs on your site and how long it takes your server to deliver each request. It reports these by using a status handler (like Apache’s /server-status) to display real-time status information about the performance of your site.

It is extremely useful in optimizing back-end processes (for example, when connecting to Java, FastCGI, or Ruby back-ends) to identify when specific pages are performing slowly.

Because it runs in the server, it’s able to show end-to-end performance on each request

It requires that mod_status be enabled to work.

An initial version of this code is available on google code. Please help me debug and expand it’s capabilities.

I recommend you checkout the SVN trunk and not download the tar. It works with Apache 2.x and 2.2.x.

The CERT advisory is here.

A partial overview, from the PDF released by Secuonis…

On July 8th, technology vendors from across the industry will simultaneously release  patches for their products to close a major vulnerability in the underpinnings of the Internet. While most home users will be automatically updated, it’s important for all businesses to immediately update their networks. This is the largest synchronized security update in the history of the Internet, and is the result of hard work and dedication across dozens of organizations. 

Earlier this year, professional security research Dan Kaminsky discovered a major issue in how Internet addresses are managed (Domain Name System, or DNS). This issue was in the design of DNS and not limited to any single product. DNS is used by every computer on the Internet to know where to find other computers. Using this issue, an attacker could easily take over portions of the Internet and redirect users to arbitrary, and malicious, locations. For example, an attacker could target an Internet Service Provider (ISP), replacing the entire web — all search engines, social networks, banks, and other sites — with their own malicious content. Against corporate environments, an attacker could disrupt or monitor operations by rerouting network traffic traffic, capturing emails and other sensitive business data. 

Exact details on this are being withheld for the safety of the Internet; I prefer full disclosure, but that doesn’t seem to be the case here given that the hole is so large and vulnerability so widespread. 

The day opened (for me, at least) with the Measuring Performance presentation. The general takeaway from that was “If you can’t measure it, you can’t manage it.”. That’s the mantra of most of this Operations-specific conference.

I’ve also attended a scaling presentation on Hotmail with Microsoft’s Aladdin Nassar, and while I disagreed with most of the limits that he gave in – 300kbit/s as a international limit for bandwidth (because of the speed of light… whaa?), most of his presentation is relevant to today’s site operations.

I’m currently in the Cloud Computing panel discussion, where cloud providers from Joyent, Rackspace, Engine Yard, and a few others are discussing the pros and cons of moving your application into the cloud.

I’m still a bit against cloud computing; I tend to work on web sites which are large, memory, and disk hungry monsters that simply can’t be placed into the cloud. As you increase resource utilization on cloud based sites, costs typically increase. The majority of this cost (at least on Amazon web services) is in network and disk bandwidth.

Video providers can’t run in the cloud without paying high costs, but the cloud computing environment is a perfect nursery for startups and companies which are about to experience an immediate increase in load, without the corresponding network and systems administration infrastructure to support that load. (I’m hearing from one of the Rackspace speakers that they can easily handle a half petabyte or more of storage per customer, but at what cost? They’re a very, very expensive provider!)

The cloud is also an excellent place for performing repeatable functionality testing without damaging your production environment. You can reduce cost by not instantiating your QA environment until it’s needed, and throw away QA wen you’re not using it.

Some sites further exploit this by only turning up servers when load is present, and disabling servers in the middle of the night when load is at its lowest.

They are also making predictions now that cloud computing will replace standard data center management in the future, regardless of enterprise size. I’d say, if you’re a sysadmin, it’s time to work for one of these companies or start learning a new job. The clock is ticking.

(( More posting later as I hit the various sessions. ))