News for hackers. Stuff that matters.
Re:Show HN: Anomalous – Real-time monitoring for servers, ap... by falcolas on Tuesday October 01, 2013 @04:28PM (#6478880)

    curl https://getanomalous.com/install.sh 2>/dev/null | sudo bash -s your_app_key your_api_key
Please do not use this kind of install solution! Piping arbitrary commands to an elevated shell is very bad. People who know better won't use it, and people who don't know better will have their "this is an acceptable method of install" bias confirmed, leaving them vulnerable to losing control over their machines.

Provide packages, please, not arbitrary tarballs from s3.

With regards to the MySQL plugin, I don't see any checks for active threads versus max threads, deadlocks warnings, InnoDB status warnings, replication status, long running queries, etc. For actual host monitoring, I don't see anything about load, disk usage, logged in users, memory usage, processor usage...

In short, I don't see anything particularly useful if you're actually monitoring a MySQL host.

Sorry if this seems abrupt, but if you want someone to pay for a Nagios replacement, it has to be an actual replacement for Nagios, which this does not actually appear to be.

Re:Show HN: Anomalous – Real-time monitoring for servers, ap... by tbrownaw on Tuesday October 01, 2013 @05:58PM (#6479333)
Please do not use [curl https://.... | sudo bash]

Provide packages, please, not arbitrary tarballs from s3.

Besides a well-behaved package being automatically uninstallable, what's the difference? Either way you're running code that you only trust because of where you got it from, rather than because you've read it and understand it.

Re:Show HN: Anomalous – Real-time monitoring for servers, ap... by falcolas on Tuesday October 01, 2013 @06:29PM (#6479477)
Well, packages can be signed, packages can be pinned using internal repos, and lists of installed packages (and their versions) can be easily generated.

Packages are also easier to audit and deploy on internal networks than an install script which can change at whim.

In short, I have no guarantee that the bash script or tarball I'm installing via the piped bash method is the script or tarball the authors intended to be installed. I also have no way of installing this on servers without internet access, short of hacking the install script (of course, this matters less since this is monitoring as a service, but as a general principle it still stands).

Re:Show HN: Anomalous – Real-time monitoring for servers, ap... by tbrownaw on Tuesday October 01, 2013 @11:41PM (#6480471)
Oh, you meant "lose control" more as in "have an unmaintainable mess". For some reason I'd only read it as "get 'sploited".
Re:Show HN: Anomalous – Real-time monitoring for servers, ap... by falcolas on Wednesday October 02, 2013 @11:26AM (#6482965)
I did also mean "get 'sploited" - in that when someone is used to running curls into elevated shells, they're more likely to accept this from random forum goers as a valid way to troubleshoot problems; not necessarily as a problem for this company.