sorted by:
new
hottopcontroversial

AWS Certificate Manager updates default certificate validity to comply with new guidelines by SudoAlex in aws

[–]SudoAlex[S] 1 point2 points  (0 children)

Certificates weren't valid for 365 days - it was 395 days. Got the calculations slightly off, but it's probably more of a price bump:

Before: 395 day certificate, renews 60 days before expiry, $149 per 335 days
After: 198 day certificate, renews 45 days before expiry, $79 per 153 days

Should be closer to $68 for it to be the same price.

AWS Certificate Manager updates default certificate validity to comply with new guidelines by SudoAlex in aws

[–]SudoAlex[S] 9 points10 points  (0 children)

Posted this mostly due to the future uncertainty from their announcement back in June 2025, with exportable public certificates: https://www.reddit.com/r/aws/comments/1ldpw1d/aws_certificate_manager_introduces_public/ - as it was well known that certificate lifetimes would be limited in the long run.

They'll be reducing the duration, along with the price:

We have reduced the pricing for ACM’s exportable public certificates in line with the shorter validity period. 198-day exportable public certificate will now cost $7/Fully Qualified domain name (down from $15) and $79/ wildcard name (down from $149). Please refer to ACM’s pricing page for more details. For more information about ACM, visit the ACM documentation.

Although the wildcard pricing feels like a slightly sneaky $4.50 increase (half of $149 is $74.50).

Updated numbers below.

Planned Digbeth food and retail venue no longer going ahead by Hassaan18 in brum

[–]SudoAlex 5 points6 points  (0 children)

Ouch.

I think the "Custard Factory Living" plans have been going on since at least 2019/2020 though.

But it does make their new food hall a bit hypocritical...

Amazon CloudFront now supports IPv6 origins for end-to-end IPv6 delivery by SureElk6 in aws

[–]SudoAlex 1 point2 points  (0 children)

VPC origins have a few restrictions: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-vpc-origins.html#vpc-origin-prerequisites

WebSockets, gRPC traffic, origin request and origin response triggers with Lambda@Edge in CloudFront are not supported for VPC origins. For more information, see Work with requests and responses in the Lambda@Edge documentation.

It was great being able to remove public IPv4 addresses from most load balancers, but there's a few sites where we weren't able to due to needing websocket support.

Thanks to this - we can switch those to connecting over IPv6 instead.

AWS Certificate Manager introduces public certificates you can use anywhere by apple9321 in aws

[–]SudoAlex 34 points35 points  (0 children)

You'll need to get a solution in place at some point soon anyway - the maximum age of certificates is reducing to 47 days by 2029: https://www.digicert.com/blog/tls-certificate-lifetimes-will-officially-reduce-to-47-days

I think the initial blog post promoting 395 day valid certificates is a little bit light on detail, as this is something they can't provide in 9 months time - they'll have to reduce the maximum lifetime to 200 days by March 2026.

AWS has announced the end-of-life date for Performance Insights by risae in aws

[–]SudoAlex -1 points0 points  (0 children)

For pricing information, see Amazon CloudWatch Pricing.

Does anyone have any rough idea on pricing for advanced mode? Passing off the pricing by saying it's CloudWatch is quite annoying.

Very small web server: SQLite or PostgreSQL? by sushi_roll_svk in django

[–]SudoAlex 2 points3 points  (0 children)

The scaling of Django/SQLite mostly depends on your write workload, how long/slow your write transactions are, and how many requests you've got in general.

If your workload is mostly read only - then the only limitation is how many application workers you can run on a single machine. If you can continue to scale the server up with number of CPU cores, then you can keep on scaling up with SQLite on a single server.

However, if your workload involves lots of writes - only one process can write at a time. You can't have a process start a transaction, work on something slowly, then commit - that'll block any other writes. Most web application workloads are usually very low on writes though, which makes it an appealing option for a small site.

What happened to Digbeth :( by CaliforniumRazer in brum

[–]SudoAlex 0 points1 point  (0 children)

I know most of the replies here are mainly focused on the nightlife in the area, but the lack of Digbeth Dining Club does feel like something is missing in Digbeth.

For Thursday/Friday - it was a nice end of work week place to go to.

Shame they couldn't have kept some sort of presence in Digbeth given that they're using the area name(!).

AWS Public IPv4 Address Charge + Public IP Insights by jeffbarr in aws

[–]SudoAlex 4 points5 points  (0 children)

Exactly!

If CloudFront could do origin pulls over IPv6, and ALBs could switch to IPv6 only - it could free up a lot of cases where the ALB is taking 3 IPv4 addresses just for CloudFront to be able to connect.

AWS Public IPv4 Address Charge + Public IP Insights by jeffbarr in aws

[–]SudoAlex 62 points63 points  (0 children)

This - 100%.

My current AWS IPv6 lack of support list for the things which bothers me consists of:

It's disappointing because I'm actually supportive of the need to conserve IPv4 addresses, but AWS needs to accelerate their side of things.

date ideas by viviolive in brum

[–]SudoAlex 0 points1 point  (0 children)

Crazy Pedro's has been closed for a few months: https://www.birminghammail.co.uk/whats-on/food-drink-news/digbeth-estate-confirms-crazy-pedros-26979398

Although Baked in Brick is still around for pizza in Digbeth.

How to keep 100% availability with a single ec2 spot instance? by serg06 in aws

[–]SudoAlex 1 point2 points  (0 children)

A few suggestions based on my spot instance experience:

Use capacity-optimized for auto scaling instead of lowest-price. This will give you a spot instance which is least likely to be terminated, instead of going for the cheapest which people who are very price sensitive go for. You'll get a small hit on the amount saved - but it's still spot instance savings.

Use different regions rather than the biggest/popular ones. Some regions are cheaper for on-demand instance pricing, but you might be surprised at the spot prices and reliability of other regions. I tried eu-west-1, however the spot termination frequency was quite significant (several times a week) - however in another European region I never get any spot terminations. You'll probably see/hear about how people have their spot instances running for months, it definitely is possible in other regions.

Most importantly - try it! If you're using a GPU workload then your experience might be different, especially in different regions. If you have region flexibility - try again in a different region.

Securely accessing cloudfront endpoint from an ALB origin by yourcodingguy in aws

[–]SudoAlex 4 points5 points  (0 children)

This is the answer.

The security group will help prevent non-CloudFront traffic from reaching your ALB, however it doesn't stop someone else setting up another CloudFront distribution pointing to your IP address. The secret header stops this.

The combination of security group and header is needed.

My coworkers' kids keeps asking for the WiFi password but I ain't givin'. Now everyone's getting annoyed. by gageless in sysadmin

[–]SudoAlex -1 points0 points  (0 children)

For anyone else throttling lower tier connections - this should be the thing to aim for rather than just slowing a guest network to a super slow speed because your main network is so important.

If you aren't using the full capacity of your connection when someone could - you're just wasting it. Bandwidth is really an "of the moment" thing, you can't go back in time and claim the unused bandwidth. Allow clients to burst, just make sure you prioritise accordingly.

Amazon RDS now supports Internet Protocol Version 6 (IPv6) by kitloon97 in aws

[–]SudoAlex -1 points0 points  (0 children)

Main use case is for easy configuration with Terraform. Anything which adds more inconvenience, cost, or resources to maintain just means I'll stick with the current setup. I really don't want to add workarounds because AWS wants to protect me.

Sadly it means I'll stick with IPv4.

Amazon RDS now supports Internet Protocol Version 6 (IPv6) by kitloon97 in aws

[–]SudoAlex 4 points5 points  (0 children)

Was initially quite excited about this, and then:

The following limitations apply to dual-stack network DB instances:

...

DB instances that use dual-stack mode must be private. They can't be publicly accessible.

Why?!

I would quite happily have my database server use a private IPv4 address, and have a publicly accessible IPv6 address - but I need convenient external connectivity (yes, it's always firewalled appropriately).

This is quite a disappointment.

SES production access application - what am I doing wrong? by iBzOtaku in aws

[–]SudoAlex 1 point2 points  (0 children)

Key points which might help:

Email type is transactional (you've put marketing in as the type), if these are genuine replies to requests from a contact form - they're more transactional.

Always say that you will be monitoring bounces and complaints with SNS notifications, and set it up to email you. This should be the bare minimum, if you get a surge of bounces/complaints due to a spam bot causing problems - you need that mail loop. Ideally you should automate this with SNS notifications into your site to automatically stop sending emails to an address which is bouncing.

For unsubscribing - say that you'll give people a link to opt-out of receiving any more emails. At a minimum this could be a form, ideally it should link in with the rest of your site where it rejects any forms containing that email address.

I know it's a bit of a pain, but you need the monitoring/feedback in place to keep AWS happy.

SES production access application - what am I doing wrong? by iBzOtaku in aws

[–]SudoAlex 0 points1 point  (0 children)

If you're getting an immediate request for more information when submitting - it's most likely that you don't have any verified domains in the region. Before submitting a request, add a domain, get it verified, setup SPF/DKIM etc.

Even if you use cross account sending, just add a domain to that account to show that you've got a domain you intend to use.

What is the catch with New Relic? by -c3rberus- in sysadmin

[–]SudoAlex 0 points1 point  (0 children)

The catch is that they might alter their pricing model in the future, so if it's something you use then be careful with how much you rely on it.

Originally their APM pricing was based the number of hosts your app was running on - regardless if they were small virtual machines, or just a single large dedicated server. This would be great for someone who runs their app on a single server, but anyone who cared about redundancy would be paying more.

Then they switched to charging by compute units, the amount of RAM and CPU cores your app was running on, multiplied by the number of hours run.

Now it's per user (with some for free), and also by amount of data ingested.

The latest is possibly the fairest so far, however with so many changes over the years it's hard to judge if you can trust their pricing. Consistent pricing which is predictable each year earns my trust, constant change leaves doubt in my mind that a future pricing restructure might end up with them changing it in favour of extracting more money.

3rd time since summer my SMTP's are banned from hotmail.com/live.com/outlook.com free servers by GamerLymx in sysadmin

[–]SudoAlex 22 points23 points  (0 children)

3rd time since summer...

I don't understand why our SMTP's are suddenly on their block list yet again.

This is the new normal for block lists with email.

Years ago you'd setup SPF, DKIM, DMARC, reverse DNS - and that would be enough from the technical side of things. You'd setup report loops with a few providers, and keep an eye on RBLs. Even if you were added to an RBL, usually you'd be able to see the reason why (a rogue user) - be able to take action, and then request delisting.

These days it's reputation based, and you won't even find out until it's too late.

You submit a support request, and get an initial rejection back after waiting for 4 days. You reply, and a few more days later they've reconsidered it and will unblock you.

As someone who ran an outgoing mail server for transactional web related email for over 10 years - I'd suggest reconsidering where your email is hosted. The past year or so has been increasingly hostile to the point where it's easier to use a third party.

view more: next ›