Meltdown, Spectre, and the Processor Problem That We All Face

Michael PhillipsBy now you may have read about an issue affecting Intel, AMD, and other processors, potentially exposing sensitive memory data. Until now, that data has been assumed to be safe, since a program running on a system isn’t supposed to be able to access the memory used by the kernel or core of that system. There are two separate bugs involved, known by the names “Meltdown” and “Spectre.” The bugs affect virtually every device that uses an Intel or AMD processor: desktop computers, laptops, tablets, phones – essentially almost all computing devices made since 1995.

No one knows yet whether the bugs have been exploited, since the potential exploits do not leave any trace in traditional log files. But there have been proof-of-concept demonstrations that the bugs are exploitable, so software and hardware manufacturers are issuing patches and firmware updates to remedy the problems created by Meltdown and Spectre.

What this means as far as your website hosting is concerned

Microsoft is expected to release a number of patches for their different operating systems on Tuesday, January 9th (UPDATE: patch releases have already begun for the most recent O/S versions). In addition to those fixes, it’s also possible that we’ll have to install a number of different firmware updates for the different types of hardware that host your websites. We will, of course, apply the patches and firmware updates as soon as we can, and we will do our best to keep any disruption to a minimum, but at this point we do not know the extent of any potential outages related to the fixes.

What we do know is that the fixes will almost certainly have an impact on the speed of all of the affected hardware. That doesn’t apply only to web servers, but to all affected devices. Virtual machines, which run the vast majority of websites, will see an impact, since the fixes necessary to counteract Meltdown require changes to the way the operating system handles memory. Preliminary testing indicates that the speed of the memory processing could be slowed by anywhere from 17% to 30%, depending on the task.

We can’t be sure of the overall effect until all of the fixes are in place. When we get to that point we will evaluate the situation, and if any adjustments are necessary on our end to keep things running smoothly for you, we will make them.

This is an unusual and unfortunate situation that is going to impact virtually everyone. No one can predict the ultimate effect it will have, but we will continue to monitor the issue as it unfolds and post any pertinent updates related to your hosting in the forum.

Read more about the issue here.

What is Greylisting?

Calvin WongEveryone hates spam. (The email kind – not the canned meat). Spam is an especially pertinent issue for hosting customers. If you’re starting a new site and registered a new domain name, you’ll likely be bombarded with spam.

The reason is because your domain name registration information (your name, address, phone number, email address, etc.) is publicly available. Anyone can do a WHOIS search on your domain name and find your contact info. There are even services out there that will provide a list of all the newly registered domain names every day, making them easy targets for spammers.

Just do a WHOIS search on a domain, and you’ll find the owner’s email. For example, here’s the WHOIS information for discountasp.net. As you may guess, [email protected], which is listed as the contact email for our domain, gets a ton of spam.

One way to combat this is to get WHOIS Privacy when you register a new domain name. WHOIS Privacy will mask your real contact information by using the information of the registrar instead. It’s important to get WHOIS Privacy when you initially register a domain name. You can add Privacy later, but by then it’s already too late. Your email and contact info has already been published on one of those lists.

Greylisting is another way to combat spam. When an email network “greylists” messages, they do not accept the initial incoming message, but rather instruct the sending mail server to try delivery again later (which most servers will do every few minutes). The assumption being that spam servers will not attempt to send the message again, but legitimate servers will.

A large percentage of spam is sent from compromised home and business computers. Spammers typically send messages from large numbers of these machines, but each machine sends only small batches of mail, in order to avoid detection, and they will almost never try to re-send the mail when they receive the “try again” response.

Greylisting is a very effective anti-spam tool. Our tests show a decrease in spam of 80% to 90% when greylisting is implemented. But it can cause delivery delays. Those delays will vary, depending on the sending server, but are typically no more than a few minutes.

Previously, we had Greylisting enabled by default for all customers. But on October 17th, we decided to disable Greylisting by default for all new customers.

Why did we disable Greylisting?

New customers not familiar with Greylisting thought something was broken with our email service. They would sometimes experience delays of a couple of hours (the delay time depends on how the sending email server is set up to response to the re-send requests).

What can customers do?

You can re-enable Greylisting.

  1. Log in to Control Panel.
  2. Click the “SmarterMail Manager” link on the left side.
  3. Click the “SmarterMail Management Login as Primary Admin” link. You will be automatically logged in as the Primary Domain Administrator.
  4. Once in the SmarterMail interface, click the “Settings” link in the left navigation (it is an icon that looks like gears).
  5. Click to expand the “Domain Settings” folder.
  6. Click “Users”.
  7. Check the box next to the account you want to enable Greylisting for and click “Edit”.
  8. Uncheck the box next to “Disable Greylisting”.
  9. Click “Save”.
  10. Repeat steps 7-9 on all the accounts you want Greylisting disabled for.

You can Get SpamExperts

Our email service, SmarterMail, comes with spam filters. You can tweak those spam filters if you want, but most customers are wary of doing that. Set your filters too strong and you risk false-positives, possibly having legitimate emails go into your spam folder.

So, we partnered with SpamExperts to offer Inbox Filtering. SpamExperts works great! In fact, we adopted it for our own corporate use. The SpamExperts spam filter engine will scrub your incoming emails and take out spam, viruses, phishing and other malicious email messages. It works great out of the box, with no tweaking – set it and forget it.

Most other spam filtering services charge for each email account. If you have 20 email accounts/users, you have to pay for 20 of them. SpamExperts, on the other hand, just charges per domain. So you can have as many email accounts/users as you want and pay just $3.95/month!

If you do decide to leave Greylisting disabled, or if you just get too much spam, we highly recommend you get SpamExperts. We did, and we love it!

Reducing .NET Core Memory Usage

Ray HuangOver the months of troubleshooting .NET Core memory issues, one of our customers kindly pointed out to us there is a simple solution you can apply, and that is to change the server garbage collection mode from server to workstation.  To do that, just change the “System.GC.Server” element in the project.json file in Visual Studio 2015 from “true” to “false“:

"runtimeOptions": {
  "configProperties": {
    "System.GC.Server": false
  }
}

And because the settings have moved to the ASPNETCore.csproj file for Visual Studio 2017, you need to change the “ServerGarbageCollecton” XML node from “true” to “false“:

<PropertyGroup> 
    <ServerGarbageCollection>false</ServerGarbageCollection>
</PropertyGroup>

This is because according to Mark Vincze:

the CPU count greatly affects the amount of memory .NET will use with Server GC

And since all of the DiscountASP.NET’s servers run on multiple processors, changing this value should reduce the amount of memory that your .NET Core application will use.  Many thanks to Mark Vincze and his tests to help the .NET Community out.

Adventures in resuscitating a 14 year old website

Michael PhillipsIf you’ve been to the DiscountASP.NET website recently you may have noticed its new look. Those of you who remember the old site (and who could forget it?) may have been surprised, or concerned that maybe we’d been bought out or taken over, or that perhaps there had been a catastrophic rupture in the space-time continuum.

I can assure you that it’s still us. We’re still here and we’re still the scrappy, independent .NET host that you know and love. But if you were surprised to see a new site, it’s understandable. After all, the old site had the same general appearance for 14 years, so a lot of you probably assumed it would never change. I get it. There were times that I thought it might never change too.

The old site was…well, let’s put it this way, have you ever seen a Dr. Bronner’s soap label?

Crazy, isn’t it. But I know why Dr. Bronner did that. He had a whole lot of messages that he thought were very important, so he used every square millimeter of space on his label to communicate those messages.

Does it remind you of anything? Like, oh, I don’t know, a certain trusty old website?

Now that site — well, come on, you can see the vintage charm, can’t you? And you can see what it was originally intended to do. It was intended to provide information about a certain specific kind of website hosting to a mostly technically-adept and focused audience that was more interested in information than style. Or, apparently, order.

Though in fairness, that site was designed in 2003, and it became what you see above after 14 years of things constantly being added to it. Also by virtue of being created and maintained by people who aren’t exactly what you’d call professional web designers. If you put the auto mechanic in charge of the garage’s billboard, you aren’t going to get an award winner, you’re going to get what the mechanic thinks is important.

Over the years a couple of attempts to replace the site were explored, then scuttled or sidetracked. The thing is, we’re a lean, mean fighting machine around here, so no one has a lot of “extra” time to do things that aren’t important or time sensitive. Contrary to what you may have heard about Internet companies, we’re not having six hour ping pong tournaments or tapping a keg and building human pyramids out in the parking lot. Not every day, anyway.

So the new site kept being delayed and “set aside for next quarter,” and as a result, it continued to sit there, fundamentally unchanged, mocking us. Actually it didn’t just sit there. Like I said, we added to it. All the time. Information on top of more information, which is how it eventually became Dr. Bronnered.

Then about a year ago (scratch that, I just saw that I first mentioned starting on a new site two years ago – ha), we decided to just do it already. To make the time. Bite the bullet. Drain the swamp. So to speak.

But where to start? Dr. Bronner’s label says, “Dilute! Dilute!” and that’s sound advice for anyone redesigning an old website. Not to dilute the message, but to reduce the visual chaos and focus on fewer messages per page.

So that’s what we set out to do. It started with mapping out the existing site and the hundreds of pages that had been added over the years. Then we went about getting rid of pages, consolidating pages, reducing text, adding some visual breathing room. All of which isn’t particularly difficult.

What is difficult about that process is communicating everything you want to communicate, or feel you need to communicate, while at the same time trying to get rid of half (or more) of the site. That’s the crux of the thing, and the main problem anyone has to overcome on a project like this.

And it’s worth pointing out that the considerations you have to make for a website today are slightly different than they were in 2003. Back then we only expected to see https on an order form, not across an entire site. We didn’t browse hosting websites (or any websites) on our phones (remember composing text messages by repeatedly pressing the numbers on your phone keypad?). Having a “responsive” website meant that you answered email questions in less than a day.

How did we even survive back then? The mind boggles.

Of course today’s websites have to be more flexible and simple to adapt to the way we use the web now. But the underlying code necessary to give the illusion of simplicity is increasingly intricate, so simplifying a website involves a tremendous number of decisions and concessions. Not to mention a lot of letting go of old ideas. It can can get to a point where you start to wonder, “Who thought this was a good idea?” and find yourself looking at your old site thinking, “You know, it’s not that bad…”

Did I say we started on the new site a year ago? Yes I did. Even after deciding to “just do it already,” it took a long time to get it done. As I mentioned, none of us have much time to spare on a typical day, and there were 568 pages to go through on the old site with the end goal of consolidation and reduction. The new site has only half as many pages. And if you don’t count the archived press releases, there are a mere 104 pages on the new site. That’s a pretty fair pruning, I’d say.

But you know the urban legend that says that it takes so long to paint the Golden Gate Bridge that by the time they finish, they have to start over again at the other end? Well, the same thing happened with the new site. Since it took so long to finish, we had to go back and update half the pages with more recent information before we launched it.

Well, that’s our problem, not yours. But I’ll bet more than a few people reading this have tackled similar projects. Or have a similar project haunting them, waiting to be tackled. All I can say is, just do it already. You may feel miserable while you’re in the midst of it, but when you get to the end of the bridge and put down the paintbrush you will want to shout and leap up and down and buy yourself an expensive bottle of bourbon. Go ahead do do all those things. You will deserve it.

When you’re looking at our new site it may seem sparse, and not terribly visually exciting, especially if you compare it to the the Electric Kool-Aid Acid Test of years past. But it does what it’s supposed to do. And more importantly, what you need it to do. It presents specific information about a lot of different things, in way that’s (hopefully!) easy to navigate and lends itself to more relevant and fruitful discovery.

And if it starts to look stale in another decade or so, we’ll do it all again. But by then we’ll all be commuting in flying Google cars, just like the Jetsons, right? Maybe we’ll luck out by that time and websites will redesign themselves.

Hmm, that’s not a bad idea…websites that redesign themselves…

Excuse me, I have to go update the next development meeting agenda. See you later.

DiscountASP.NET attains Swiss-US Privacy Shield Certification

Takeshi Etoprivacy shield frameworkLast year we achieved EU-US Privacy Shield Certification with the help of our privacy management solutions partner, Truste. When we updated our privacy policy we included some legacy language for the old Swiss-US Safe Harbor policy. However, earlier this year, a new Swiss-US Privacy Shield Framework was finalized, and on April 12th, the US Department of Commerce started accepting applications for companies adhering to the new Swiss-US Privacy Shield framework. We again worked with Truste to make sure that our privacy policies and practices meet the requirements of both Privacy Shield frameworks.

I’m  happy to announce that we have achieved Swiss-US Privacy Shield Certification.

I Do Not Think It Means What You Think It Means

John MeeksIf you run a “Define:” search on the word “Exact” in Google you get this:

Not approximated in any way; precise.

Pretty close to what you were thinking, no? Well according to the Google AdWords team YOU ARE WRONG SIR!

If you have ever been a user of Google AdWords you know there are 3 basic keyword types for your advertising; Broad, Phrase, and Exact.

Broad match is pretty simple, anything with that keyword or phrase has the ability to show your ads. The keywords in a phase could be out of order, with words in between them, doesn’t matter. Google puts it this way:

Ads may show on searches that include misspellings, synonyms, related searches, and other relevant variations.

Pretty simple and quick right?

Phrase match gets a little more complex. With phrase match ads will show for searches that match the phrase you provide. Words can come before or after the phrase, but as long as the phrase in in there, your ads can show. Again, Google puts it like this:

Ads may show on searches that match a phrase, or are close variations of that phrase, with additional words before or after. Ads won’t show, however, if a word is added to the middle of the phrase, or if words in the phrase are reordered in any way.

Little more complex, but again pretty simple.

Exact match use to be exact, at least as we all would define it. Before 2012, exact match meant just that: exact. It was very simple and easy. You entered a keyword and your ad only came up for that word. You were responsible for covering misspellings and plurals.

This ended up being the preferred match type of marketers. You had control over where your ad showed and depending on the detail of your keywords you gained insight into the rise and fall in the popularity of specific products or services (internally we were able to watch the rise and fall in popularity of ASP.NET versions, Silverlight, and AJAX).

Then in 2012 Google started their campaign of redefining. It started very innocently really. Google decided in 2012 that they would start to include plurals, misspellings, typos (aren’t those misspellings?), and other versions of a keyword in the exact match definition. For most marketers this was more a minor inconvenience.  Most had already covered these added variations in their keyword lists, if they wanted them covered at all.

After 5 years Google decided it was time to add to their new definition of “exact.”  In April Google announced that on top of the above additions in 2012, they would now include variations in word order and function words. How does Google say it?

Ads may show on searches that match the exact term or are close variations of that exact term. Close variations here may also include a reordering of words if it doesn’t change the meaning, and the addition or removal of function words (prepositions, conjunctions, articles, and other words that don’t impact the intent of a search).

So, in other words kinda sorta exact, when we think it makes sense. Something that really stands out in all this is the reordering of words. Word order can make a big difference, especially in the tech industry. A perfect example for our industry is “Windows Host” and “Host Windows”; One is looking for a Windows host, the other is looking to host Windows, possible on your own server. Google is basically asking advertisers to trust them and their ability to discern searcher’s intent.

Marketers have been pretty vocal about their displeasure over these latest changes, but be sure this is the future for Google. Google is shooting to make AdWords what is called “Set and Forget.” In a perfect world Google would have you enter your keywords into AdWords, add a few ads with a budget, and walk away. Google frames it as making it easier for you as the user, so you can focus on “what is important.” Some cynics might say it is just Google trying to spend more of your money for you.

In either case, it is the future of advertising at Google, so it is time to redefine how we define “exact.”