NOt about programming .. .about VPS - page 3

 
cloudbreaker:

Folks, latency was mentioned above. This is a priority issue for SOME, not all trading strategies

I'd go further. If US<->Europe levels of latency are a major issue for the strategy, then I'd question whether MT4 (and its brokers) is the right platform. I think we've had this conversation before.

If anyone wants my recommendation (based on having studied them physically on site) for a truly professional Switzerland-based hosting company (who are not interested in whether you are running an EA or a banking app), then drop me a PM.

An associate of mine once tried to persuade CERN to sell him bandwidth. It's not CERN, is it?

 
jjc:
That comment is a little lost on me [...]
When trading from a VPS that specifically targets EA hosting - both people working in the hosting company and people outside the company know what's being hosted. Knowing is the first step to attempting a hack (or in the case of an inside job - an IT manager that simply decides to copy the EA or snoop around). I am not saying that this is likely to happen, I am just saying that it is less likely to happen if u get a VPS at a 'regular' hosting company, since they won't know (or care for that matter) that you are hosting an EA.
 
gordon:
When trading from a VPS that specifically targets EA hosting - both people working in the hosting company and people outside the company know what's being hosted.
Ah, I see. Security in the very specific sense of protecting your intellectual property. Unless you're going to colo your own hardware - and even that's not fool-proof - then there'd actually be an argument in favour of using a hosting company with lots of MT4 customers. It becomes painfully difficult for the hosting company to identify the tiny number of good EAs among the masses of rubbish being run on their servers.
 
jjc:
Ah, I see. Security in the very specific sense of protecting your intellectual property. Unless you're going to colo your own hardware - and even that's not fool-proof - then there'd actually be an argument in favour of using a hosting company with lots of MT4 customers. It becomes painfully difficult for the hosting company to identify the tiny number of good EAs among the masses of rubbish being run on their servers.

You can colo without having to SUPPLY the hardware.

In other words, the hosting company will supply it in a similar spec to the rest of their kit, rack mount it, provide remote power cycling etc. etc.

But the only person with privileges to access the system can be you.

There's also the issue of contractual obligations with the hosting company, regarding security.

CB

 
cloudbreaker:

You can colo without having to SUPPLY the hardware. [...]

Indeed. That's what my own colo'd boxes are: built by the hosting provider. My wording was imprecise. I should more explicitly have drawn the distinction between installing the O/S yourself versus having it pre-installed for you, and also between data sitting on your own disks versus on the provider's SAN.
 
jjc:
Ah, I see. Security in the very specific sense of protecting your intellectual property.

What other sense is there?

It becomes painfully difficult for the hosting company to identify the tiny number of good EAs among the masses of rubbish being run on their servers.

That's assuming they have "masses of "... Who knows? Maybe they only have dozens. Maybe that's just a niche for them while the majority of their clients are normal hosting clients (perhaps sold under a different brand name). The point is that by getting a VPS targeting EA hosting, you are providing information as to your intended usage. I much prefer the anonymity provided with a normal hosting company. IMHO.

 
gordon:
The mere fact that you are promoting your solution as a MT4 specific hosting service is the biggest security risk of all.

Why ? What's your point ? I don't agree, having a windows solution is a concern for people knowning about security implication of having an live account with 10'000 USD. Are you in peace when you trade such amount of money knowing any failure can ruin your trades ? Are you concerned about 'man in the middle' attacks ? Windows based VPS only offer poor 128 bits encryption (or not at all by default) with Remote Desktop protocol. We do encrypt every traffic with 2048 bits at least.

 
cloudbreaker:

DON'T presume to patronize me about security, forexvps.

In a previous role I architected the security around an Internet banking solution for a number of well known banks which was formally described at the time by a penetration testing company (who were contracted to the US CIA) as "the most secure Internet banking solution we've ever seen". That included network design, OS and system software hardening and application design to include statistical attack prevention etc.

Residual Risk (as you will know) is a function of Impact, Probability and Mitigation and in terms of the execution environment which we have implemented, I have spent the time, done the sums and produced an architecture which I am happy to take accountability for.

CB

I didn't presume that; I also worked for security companies as a security specialist. I just wanted to point out the security aspect for the other users : )
 
gordon:
When trading from a VPS that specifically targets EA hosting - both people working in the hosting company and people outside the company know what's being hosted. Knowing is the first step to attempting a hack (or in the case of an inside job - an IT manager that simply decides to copy the EA or snoop around). I am not saying that this is likely to happen, I am just saying that it is less likely to happen if u get a VPS at a 'regular' hosting company, since they won't know (or care for that matter) that you are hosting an EA.
For this purpose we do encrypt files with 4096 bits key that are mounted only when users logs in. If any hack attempt were to come that far, he'd only be able to pick a bunch of bits. Totally useless.
 
gordon:

What other sense is there?

Surely protecting intellectual property is a niche concern, specific to worlds such as MT4, because most people don't have any on their computer?

Most attempts to penetrate computers on the internet are aiming to do one of the following:

  • Set up a spam relay (with consequent impact on the performance, stability, and bandwidth usage of the machine)
  • Inject trojans/spam into any web pages being served from the machine
  • Install a keylogger (and then watch for things like credit card numbers)
  • Scan the hard disk for things like credit card numbers

Therefore, the usual aim of security measures such as firewalls is to prevent things like this. Protecting intellectual property is an uncommon aim, and is usually dealt with as a side-effect of protecting against more common classes of intrusion.

Reason: