Jaan Paljasma | Tech Blog

Amazon Web Services announced yesterday a long-awaited update to their OpsWorks product by including free tier and t1.micro instance types, something that has always keeping me away of trying OpsWorks, because smallest instance was always m1.small. You can provision now following instance types for your web, database, haproxy, e.t.c.: Micro t1.micro Standard 1st gen. m1.small m1.medium m1.large m1.xlarge Standard 2nd gen. m3.xlarge m3.2xlarge HighMEM m2.xlarge m2.2xlarge m2.4xlarge HighCPU c1.medium c1.xlarge HighIO hi1.4xlarge HighStorage hs1.8xlarge From operating systems only Amazon Linux or Ubuntu 12.04 LTS are supported. As with OpsWorks, you can launch web server stack behind HAProxy (Amazon reps say they will support Elastic Load Balancer very soon), and in addition to 24/7/365 servers you can prepare time-based servers and load-based spare servers, which will start/stop on demand, or "follow-the-sun" approach. AWS OpsWor

Two biggest WordPress caching plugins are reported having serious vulnerability, allowing arbitrary code execution in specific HTML comments. Meaning, adversary can post comment on your site including specific text, and bug in W3TC allows executing any code he wants. Here's an example: <!–mfunc echo PHP_VERSION; –><!–/mfunc–> This command will output web server PHP version in a comment area. Whats the big deal? Well, nothing stops writing into mfunc real function which will print out mysql connection strings in first comment, and use second comment to wipe out everything from your database, something like this: <!–mfunc echo file_get_contents(ABSPATH.'wp-config.php'); –><!–/mfunc–> If you are using 3rd party commenting plugins you are safe, but you should still keep your WordPress installation and all plugins always up to date. Original article can be found here: http://blog.sucuri.net/2013/04/update-wp-super-cache-and-w3tc-immediately

You have made right choice by selecting nginx as your web server! According to Netcraft nginx served or proxied 12.96% busiest sites in April 2013 . Setting up nginx with OpenSSL is easy, and I will not cover it here. The goal is to enable SSL on your domain.com website, and just like anything with nginx, everything is very straight forward. I am using latest Amazon Linux in AWS with nginx/1.2.6 and php-fpm installed,  and GeoTrust as digital certificate provider. GeoTrust has product called QuickSSL Premium , which takes just minutes to get your certificate, and it even comes with free trial. Step One - Generate Certificate Signing Request (CSR)  Lets generate a key pairs. In this example, I will bypass the passphrase request. 1) generate private key Log in to your Amazon linux box via SSH, and generate 2048 bit RSA private key: openssl genrsa -out www.domain.com.key 2048 For encrypted keys, use -des3 parameter. If you don't use encryption for your private ket, you sho

Node.js Node.js (and more often simply called "Node") is simply put a JavaScript on the server side. It's a platform built on Chrome's javascript runtime, very useful building fast scalable network applications. Update v.0.10.5 This latest node.js stable release v.0.10.5 adds support for VS 2012, fixes unlikely buffer overflow in os.type(), applies fix to unshift() race conditions in stream, http module doesn't try to destroy nonexistent sockets anymore, plus additional updates on crypto, assert, dgram and handle_wrap modules. Source code:  http://nodejs.org/dist/v0.10.5/node-v0.10.5.tar.gz Issue tracker: https://github.com/joyent/node/issues Original article on Node.js blog:  http://blog.nodejs.org/2013/04/23/node-v0-10-5-stable