ronin coder

I just picked up a 22″ widescreen LCD from [Newegg](http://newegg.com/) — it’s an Acer, which is not a brand I normally associate with quality, but the reviews looked good, and it was $240 with shipping, which is pretty stupidly-cheap for a panel that size.

As soon as I connected it and fired up Lightroom, I knew that I had made the right decision. My first though was, “ooh…this is full of *win*.” More screen real estate really is better when dealing with 10MP digital photos.

The process of moving my email back onto my own server has just been reminding me why just about everyone I know switched to GMail once it became generally available: managing email yourself in this age of mega-spam is a huge PITA. It’s not just a matter of setting up a server and doing basic lock-down to keep it from becoming a spam relay. Now you have to install sophisticated local spam filters, greylisting, and other hacks just to keep from being overwhelmed.

Considering that the state of the art in the open source world seems to be [SpamAssassin](http://www.spamassassin.org) and [Akismet](http://akismet.org), I suspect there’s some real room for improvement from the AI old guard. (And no, I don’t mean [Paul Graham](http://www.paulgraham.com/spam.html) — he’s done enough damage for one lifetime already.)

We have the same problem at work — our senior sysadmin probably spends a good 25% or more of his time tweaking spam filters and managing blacklists, just to keep the influx at a manageable level. The aggregate cost has to be in the billions of dollars per year, and yet there doesn’t seem to be more than a trickle of funding for real research into the problem.

If we’re not going to fix it, can we just declare email broken and move on?

I’ve been doing some initial experimentation at work on using virtual machines to host web applications, rather than running a bunch of vhosts out of the same system-wide Apache install. The big potential win is the ability to sandbox an application so that bugs and security holes don’t have the potential to take down other apps running on the same box, along with the (nice, but not essential) ability to migrate an app from one machine to another by simply sending a snapshot of the VM over the network.

We’ve been running our high-volume apps behind [`mod_proxy_balancer`](httpd.apache.org/docs/2.2/mod/mod_proxy_balancer.html) for a while now, and had pretty good using it to mask the actual hostname running an application, as well as doing SSL on the load balancer instead of the application server. However, the backend servers each run a single instance of Apache, (albeit listening on a handful of high-numbered ports) managed by the usual Debian administrative infrastructure, so any syntax errors, high-CPU-load pages, or security holes have the potential to break every app on the server.

One option to get around this would be to run multiple instances of Apache, each listening on their own port, with separate effective uids and document roots. However, we’d lose all the Debian goodness that makes dealing with Apache, PHP, and their respective dependencies so much less painful. I’ve managed non-trivial services using a full built-from-source LAMP stack before, and lemme tell you, updating for a minor security fix is decidedly non-trivial.

So, I’ve been trying out [KVM](http://kvm.qumranet.com/kvmwiki), which is an open-source virtualization tool similar to [VMWare](http://vmware.com/) but fully open-source and integrated into the mainline Linux kernel. (The other major open source option, [Xen](http://xensource.com), is interesting, but requires custom patches to the guest OS to run, and doesn’t have the support of the kernel developers.) With it, I can run a handful of lightweight virtual machines on each web app server box, each with their own basic Debian system environment and Apache install.

Within each sandbox, those systems are then free to do whatever bone-headed crap they like, and modulo the unavoidable resource-contention issues (CPU and IO bandwidth being the biggies) they can’t really take down any other services. As a bonus, I can easily clone a virtual machine at pretty much any time, move it to another physical host, and more or less double the throughput of my app, at least for those applications that are written with a truly “share nothing” architecture.

My initial naive benchmarks showed something like a 3x slowdown, though, for running a basic “Hello, world!” PHP app under virtualization vs. natively. I was pretty much ready to give up on the idea until I decided to test the system behavior assuming that an SSL-protected, native instance of Apache would be forwarding requests via the afore-mentioned `mod_proxy_balancer` model, and lo and behold, the difference dropped to within 10%. At that point, I’m willing to seriously look at using the VM model, since it brings so many potential security and manageability benefits to the table.

Of course, this also highlights the importance of looking for bottlenecks in your *entire* stack, not just the component you’re considering changing. I’m not convinced that the delta will be quite that small once I’ve placed a more representative load on the virtualized web server, but if I had rejected the idea out of hand due to the initial bad numbers, I never would have gotten to the point of properly evaluating the architecture.

…and installed Windows XP on my home desktop again, so I could try out Lightroom.

All I can say is, “wow, I wish I had done this a year ago!” Being able to work with RAW images as quickly as I could with JPEG files in the GIMP is liberating, and the set of tools available in Lightroom is pretty much “just right” as far as I’m concerned.

This is one of those rare applications that makes you think that maybe, just maybe, the programmers that created it had some clue what they were doing. It’s snappy, focused, and trendy in all the right ways. Apple may have created this market with Aperture, but Adobe has done a better job of making the same functionality available to cheapskates like me who want to use commodity hardware.

I have been pleasantly surprised to see how well it worked with only 1GB of RAM. I’m sure that an upgrade will help the overall performance, but I could make do with my rather modest current system for a while without too many complaints.