Category: Hosting

Well, that’s a wrap! After 12+ years in the web hosting business, I’ve just moved the very last customers off of the server, migrated my personal domain over to Dreamhost, and updated the final DNS records. And with that, Birdhouse Hosting is no more. It’s been an amazing dozen years – both fulfilling and frustrating. I made some money, lost a whole lot of sleep, and had way too many vacations and weekends interrupted with sudden needs.

It’s amazing to see how drastically the hosting landscape has changed in the past decade. The emergence of tools like GMail made custom mail hosting all-but-irrelevant – there’s absolutely no way a small web host can provide the level of spam control, or storage, or excellent interfaces that they do. And the emergence of serve-yourself site builders like the ones offered by Squarespace just can’t be touched by open-source software.

Except in special cases, pretty much all of the need (and the reward) has been drained out of the boutique hosting business. It was time to let it go. I’m honored to have been able to host so many fantastic sites, and to have worked with so many fantastic customers over the years.

Once the dust settles on the new year, I look forward to getting back to a bit of freelance web dev work, though next time around I plan to focus on higher-end web application needs rather than WordPress.

See you in the new year!

I’m about to send the hardest note I’ve ever had to write to my loyal customers at Birdhouse Hosting, which I’ve had the pleasure (and pain) of running over the past decade+

Continue reading “All Good Things: Birdhouse Hosting is Closing”

Over the past few months, we’ve watched as customer sites at Birdhouse Hosting seemed to hit their monthly bandwidth allotments sooner and sooner. At a certain point, it became obvious that this could not be explained by upticks in popularity – upon closer study of awstats logs, it became apparent that a great deal of that traffic was coming from malicious bots.

And the traffic was not just attempts to post spam into weblog comment forms either – this was traffic on images, random pages, RSS feeds, PDFs, everything.

A few days ago, a new suite of ModSecurity rule management tools landed in cPanel (cPanel is the hosting platform I use to run Birdhouse). I went looking for mod_sec rules intended to curb bad bot traffic, and seem to have hit the jackpot with a rule that consults the spamhaus Malicious Bot RBL. And because it’s installed globally, it protects all of my customer sites simultaneously. Here’s the rule I used (all on one line of course):

SecRule REMOTE_ADDR "@rbl sbl-xbl.spamhaus.org" "phase:1,id:'981138',t:none,pass,nolog,auditlog,msg:'RBL Match for SPAM Source',tag:'AUTOMATION/MALICIOUS',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.automation_score=+%{tx.warning_anomaly_score},setvar:tx.anomaly_score=+%{tx.warning_anomaly_score},setvar:tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var},setvar:ip.spammer=1,expirevar:ip.spammer=86400,setvar:ip.previous_rbl_check=1,expirevar:ip.previous_rbl_check=86400,skipAfter:END_RBL_CHECK"

Over the past 24 hours it’s blocked  over 150,000 requests by bad bots to all of my customer sites. Absolutely incredible.

I’d  like to thank the fine folks  at spamhaus for doing what they do, and for helping to make the internet a better place – for free!

The Spamhaus Project is an international nonprofit organization whose mission is to track the Internet’s spam operations and sources, to provide dependable realtime anti-spam protection for Internet networks, to work with Law Enforcement Agencies to identify and pursue spam and malware gangs worldwide, and to lobby governments for effective anti-spam legislation.

 

Note: This is an honest personal endorsement. I was not paid or offered any incentives for this post.

I’ve been running Birdhouse Hosting for more than a decade now, and most of that time I’ve been hosting my services on a dedicated VPS at Servint.

I absolutely love the reliability and support I get through Servint, but every so often wonder whether I could reduce expenses by moving to Amazon Web Services, which lets you “pay as you go.” But every time I scratch the surface and try to do a real apples-to-apples comparison, I come to the same conclusion: Birdhouse is already in excellent hands, and I would not actually save money by moving, all things considered.
Continue reading “Servint vs. AWS”

I’ve run a small web and mail hosting business on the side for around a decade. The hosting platform I use (cPanel) comes with spamassassin and support for a couple of real-time blacklists (zen.spamhaus.org and bl.spamcop.net) built in. On top of that, I’ve compiled in Razor, DCC, and ClamAV.

But with spam control settings set to their highest levels, I’ve struggled over the years to keep fall-through spam from reaching the mailboxes of my power users – the spammers  just move too fast,  are too crafty. Spams that look the same from day to day actually have quite different signatures, and manage to evade my arsenal of tools. It’s been incredibly frustrating.

A few months ago, I came up with a set of techniques to let desktop mail clients train the server-side Bayes database about what’s spam and what’s ham. That worked well for a couple of months, but eventually the Bayes dbs became polluted with false hits (probably a result of users incorrectly marking / not marking messages). Is it even possible to operate as an organization smaller than Google and still guarantee low spam levels for users?

Real-time blacklists (RBLs) tap the hive mind – the collective judgement of thousands of human users spread around the world, marking ham and spam every minute of every day. When all of those judgements are collected into a single, continuously evolving database that any host can tap into, it should be possible to create an almost perfect blockade. We know that Akismet has made their RBL work amazingly for weblog comment spam (as I write this, Akismet claims to have blocked 54 million comment spam today alone).

RBLs always seemed like the smartest way to go, but spamhaus and spamcop sure weren’t getting the job done. Doing research in the cPanel forums a few days ago, I discovered that Barracuda Networks, who make a series of firewall appliances for enterprises, maintain their own RBL and provide free access to it for organizations like mine.

Decided to give it a whirl and was blown away. Within 24 hours, the amount of un-tagged spam getting through to my users had dropped to a trickle. I haven’t found an anti-spam tool this effective since… ever. It took almost no effort to set up, and will require almost no effort to maintain in the future. Super stoked.

To the great engineers at Barracuda: The internet thanks you.

Update: A couple of months later, I no longer feel quite so positive about Barracuda. Yes, it’s definitely a help, but not the silver bullet I called it above.  I do keep Barracuda running, but overall, spam numbers are worse than ever, and there’s tons slipping through that neither SpamAssassin nor Barracuda are catching.

 

Birdhouse Hosting is proud to welcome Grounded Theory Review:

The Grounded Theory Review is an interdisciplinary, online academic journal for the advancement of classic grounded theory and scholarship. The Grounded Theory Review adheres to the highest standards of peer review and engages established and emerging scholars from anywhere in the world. While centered in social sciences and the health disciplines, the Grounded Theory Review is open and welcoming to contributions from any academic field.