Hacker Newsnew | past | comments | ask | show | jobs | submit | jgehrcke's commentslogin

I'm sure you know what you're taking about -- yet, your response reminds me of https://youtu.be/aWfYxg-Ypm4

"drizzle works on the edge"


Thank you for that comment, Mike :-) I was looking for that type of response here :-). As expressed many times: thank you for your work.


Loving your work, as always!


You have some really nice shots there, even with the rare wild dog!

Jumping on the shameless plug train here -- just a few days ago I decided to finally show some of my photography on Instagram (for those of you that still use it):

https://instagram.com/nowslice

I have a deep passion for photography but had so far not put effort into an online presence. Here I intend to publish only the besties from many years of putting myself out there with mostly a fixed focal lens at 135 mm (f/1.8).


Underwater cables seemingly got attacked; the Red Sea situation is likely related: https://apnews.com/article/red-sea-undersea-cables-yemen-hou...


Timeline doesn't seem to line up


Might be related to this event?

> The cut lines include Asia-Africa-Europe 1, the Europe India Gateway, Seacom and TGN-Gulf, Hong Kong-based HGC Global Communications said. It described the cuts as affecting 25% of the traffic flowing through the Red Sea.

https://apnews.com/article/red-sea-undersea-cables-yemen-hou...

https://www.bbc.com/news/world-middle-east-68478828.amp


I'm pretty sure that report is just mainstream media reporting this week old cut https://www.datacenterdynamics.com/en/news/at-least-one-subs...

Pretty neat if a week after a cable is cut, FB falls over.

Especially when most of the source of truth databases are in the US and Europe, and that sort of data flow doesn't cross the Red Sea. FB has datacenters and points of presence all over, but outside the US/EU it's almost all caching.


> Pretty neat if a week after a cable is cut, FB falls over.

that'd be one helluva cache!!


Thanks for the reference. Yeah, may also be entirely unrelated.


> BY JON GAMBRELL Updated 8:25 PM PST, March 4, 2024

Timelines don't match nicely


I'm 95% sure it'll turn out to be a mundane config error somewhere


It will be DNS related.


Handy troubleshooting tool for outages: https://isitdns.com/


reminds me of http://iscaliforniaonfire.com/ even if not directly related to topic at hand


The sysadmin's haiku:

It's not DNS

There's no way it's DNS

It was DNS


It's not unreachable. I can easily see the FB page on my browser. It's just that even after resetting my password it doesn't accept it. Probably something's fucked up in the credentials database.


Those lines were cut yesterday, so it seems like a poor candidate for explaining the current outages. Likewise the geography doesn't match up with the outages.


This shouldn't affect europe. It just stopped working


Somebody might have fat-fingered a BGP configuration while trying to improve traffic routing that was impacted by the cut cables.


Yea I thought too that core of this is not at the services itself but at thr network somewhere.


maybe a long tail consequence of further shifting traffic?


I was thinking is deploy of DMA "compliant" unbundling the day before it takes force.

Could be both.


time to move away from undersea cables to satellites.


We have satellites. We use cables b/c they lack the speed and bandwidth necessary to support the total requirements of the modern internet. Satellite-only is only feasible if you're fine with going back to waiting minutes for your saucy jpegs to load (elder millennials, you know what I'm talkin' about).


ever heard of Musk's Starlink? From thier website "Starlink users typically experience download speeds between 25 and 220 Mbps, with a majority of users experiencing speeds over 100 Mbps" - https://www.starlink.com/legal/documents/DOC-1400-28829-70


LEO satellites would be too inconsistent, and further orbits have way too much latency.


Via Ukraine war footage I learned that "getting off the X" is an established military idiom (for leaving a dialed-in target area of e.g. artillery). Now it might find a newer even more popular meaning.


I want to add that I have learned so much by following the nginx mailing list for more than a decade.

Can we give a huge round of applause to Maxim Dounin for community support and technical excellence?

Maxim and team are answering the deepest of technical questions patiently, to the point.

Every time I read into those threads I am impressed by Maxim. By his dry communication style, his precision, and his patience. It's inspiring.

When you get his reply (which is likely to be the case), you typically get the problem you presented described in his words: with precise language/terms. Very likely he provides a solution. Or a precise quote of reference docs or spec describing why something doesn't work, conceptually. Or a patch (he often replies with "here's a patch that should work", showing a clean diff).

So: https://mailman.nginx.org/pipermail/nginx/ -- highly recommended if you want to learn more about HTTP and web servers in general.

By the way: for forcing DNS re-resolution (mentioned in this thread here) in the open source version by the way there is a weird but extremely powerful workaround (which really works, we have used it in DC/OS successfully over years), also see https://github.com/dcos/dcos/tree/master/packages/adminroute....

It was of course Maxim who described this little trick in the mailing list in 2011 :-) https://forum.nginx.org/read.php?2,215830,215832#msg-215832

It's still highly relevant in 2023 for controlled dynamic service discovery with nginx.


Is mailing list the recommended way to get help on nginx?

I recently made the mistake/challenge to use nginx as a SSL reverse proxy for a bunch of non SSL services running in docker containers .

To my dismay there is no decent documentation for what I thought would be a common usage case - namely docker for everything including nginx.

* SSL was easy enough - I have a wild card certificate and nginx does have good docs on setting it up

* Docker networking was a bit of pain - but I solved it by making a separate network.

* proxy_pass is where I got really bogged down - I got to rewrite location /api and serve it at the internal network + port.

        location /api/ {
        rewrite ^/api(.*)$ $1  break;
        # proxy_pass http://172.19.0.3; # also works
        proxy_pass http://172.19.0.1:9090;
        # most likely something else is needed for fix relative paths
        }
So now I have the problem that proxy works for mysite/api/index.html but not for any relative paths ie static/css/style.css is not loading (but docker exec -it mycontainer curl does work)

Maybe it is Google's fault but it seems near impossible to find a good AUTHORATIVE reference on setting up reverse proxy server with nginx.


Not entirely clear why you need to rewrite if you're also doing vhost based "routing" (wildcard certificate).

But as the saying went with apache, if you have a routing problem, you can fix it with mod_rewrite - now you have two problems!

You might want to (re)read:

https://nginx.org/en/docs/http/request_processing.html

and skim:

https://nginx.org/en/docs/http/load_balancing.html

And (re)read:

https://nginx.org/en/docs/http/ngx_http_proxy_module.html#pr...

It seems dubious that you need any rewriting for your setup.

You might need a handful of server blocks (vhosts) with either proxy_pass or a few locations with proxy_pass?


Indeed I am wary of rewrite from apache days.

So using a subdomain should solve routing issues - api.myproject.myorg.org instead of myproject.myorg.org/api ?

Two issues - my wildcard cert is *.myorg.org so not 100% it would cover subdomains of subdomains.

Second issue - you'd need to set up DNS for subdomain of subdomain, would you not?

Sadly DNS setup would require opening an uncertain to complete support ticket in myorg...


> my wildcard cert is *.myorg.org so not 100% it would cover subdomains of subdomains.

it won't:

https://www.rfc-editor.org/rfc/rfc2818#section-3.1

> Matching is performed using the matching rules specified by [RFC2459]. If more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.) Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.


Ah, I assumed you already had subdomains set up. Path based routing should be fine, but you probably still don't need rewriting - just "mount" the appropriate proxies in appropriate location blocks (read over the examples in the documentation carefully).



This sounds like an nginx-based k8s ingress-controller. See:

https://kubernetes.github.io/ingress-nginx/deploy/


The login system of the Bahn app amd website is experiencing issues right now -- wonder if it has to do with HN peak traffic, hm :).


I keep being impressed by this project. Has served me so well over the years, and the depth of the technologies is so exciting. Assembling ffmpeg command line arguments is a meditative exercise, with almost arbitrarily deep research allowed.


I do wish there was an official complementary UI that would make all the options explicit.


I would be very afraid of what that UI would look like. I have a feeling it would be more difficult than a Sony camera menu system.


They exist for Windows (bulk ffmpeg encoder is popular) and they look horrible, probably because they just have to.

Handbrake is the best frontend for it and "works fine" on basic settings and looks OK. But try to do anything advanced and....

Video processing is just really, really complicated when it involves compression/transcoding. There's no other way around it. And that's alright!


Yeah, I think a more workable "interface" to the complexities of FFmpeg would be some sort of terminal "shell" application that allows the user to easily tab-complete their command and visually separate out the command's various parts (i.e., input opts and output opts on separate parts of screen; each track in the container tabbed out and line-returned from the last track; etc.)

Also some users may benefit from a program that can identify what the particulars are about the input file(s) to help them make better commands. Or even ask them first what kind of result they want and work backwards from there. If the user knows they want multiple PNGs and then the input file is an MPEG-4 container with an x265 video bytestream, it's pretty clear what the user may want to do. But unless you're quite initiated, today's FFmpeg still really makes the average user work for it.


> Yeah, I think a more workable "interface" to the complexities of FFmpeg would be some sort of terminal "shell" application [...]

I was thinking something similar, but hadn't thought about tab completion - interesting idea! I was picturing something with a nano-like interface. Run the program from your terminal, get a simple set of menus you can navigate with a keyboard, tick off boxes for options, etc., then have an auto-updating command example output in a bottom "pane" showing you in real time what the cli args would be for what you specified.

In C* land I think they use ncurses to build those, if memory serves, but I probably wouldn't write it in C myself just since I'm not very well versed in it. Probably Go or Rust...

Anyway, good idea. If I hack on this I may see about implementing something like that, some day!


VLC is pretty close


Perhaps as an interface to `ffplay`, but it's certainly not complete enough to be the GUI for `ffmpeg`.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: