That’s when I remember, LAPs can use a DNS record to find the WLC they’re supposed to use if it can’t find one via DHCP option 43. I fire up DNS and sure enough, there are the two entries:

CISCO-CAPWAP-CONTROLLER
CISCO-LWAPP-CONTROLLER

Both were A records pointing to the production WLC. Since every subnet our LAPs are a part of use DHCP option 43, it wasn’t completely necessary for these records to be around. Thinking that was the cause of my problems, I went ahead and removed the records. After waiting a few minutes for DNS to propagate to the other DNS servers, I rebooted the LAP one more time. This time it didn’t connect to the production WLC. Success! Or was it?

The status LED began cycling through red, green, and amber. A simple Google search indicated that this indicates the LAP is searching for a controller. This went on for quite some time before I just gave up and unplugged the LAP. At this point I decide to plug a console cable into the LAP to see any log messages, something I should have probably done a while ago. After the LAP booted, this was being output to the console over and over:

*Mar 1 00:21:57.082: %CAPWAP-3-DHCP_RENEW: Could not discover WLC using DHCP IP. Renewing DHCP IP.
*Mar 1 00:22:00.105: %CAPWAP-3-ERRORLOG: Invalid event 38 & state 2 combination.
*Mar 1 00:22:00.208: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 192.168.1.250, mask 255.255.255.0, hostname AP7081.0500.0000

Translating "CISCO-CAPWAP-CONTROLLER.example.com"...domain server (172.16.50.100)

*Mar 1 00:22:08.083: %CAPWAP-5-DHCP_OPTION_43: Controller address 172.16.50.25 obtained through DHCP
*Mar 1 00:22:08.083: %CAPWAP-3-ERRORLOG: Did not get log server settings from DHCP.
*Mar 1 00:22:08.173: %CAPWAP-3-ERRORLOG: Could Not resolve CISCO-CAPWAP-CONTROLLER.example.com
Not in Bound state.

So it was finding the new WLC at 172.16.50.25, but for whatever reason it could not associate with it. After tinkering with the WLC and investigating even more log files, I was able to discover the WLC was rejecting the LAP because the LAP was using a Self Signed Certificate (SSC). Logging into the WLC and navigating to Security > AAA > AP Policies shows an option for Accept Self Signed Certificate (SSC) under Policy Configuration. Sure enough, checking box and allowing self signed certificates resulted in the LAP successfully connecting to the WLC.

It’s worth noting I also rebooted the WLC after checking the check box to allow SSC. I’m not sure if this had any affect or if it was even necessary, but if you’re encountering this problem as well and checking the box doesn’t fix it, try rebooting the WLC.

In my testing I discovered that this only affects HTTP traffic and not HTTPS traffic. What this means is while your online banking may be safe, any other website you visit over HTTP may cause your privacy to be at risk. This is a prime example of why SSL encryption on websites is so important. However, it may only be a matter of time before Comcast starts executing man in the middle attacks on SSL traffic.

Web Log

Here’s an excerpt from the servers web log

2601:5:300:83:6997:f2b7:4d2d:c7fd - - [20/Nov/2012:21:38:44 -0800] "GET / HTTP/1.1" 200
68.87.68.230 - - [20/Nov/2012:21:38:31 -0800] "GET / HTTP/1.1" 200
68.87.68.230 - - [20/Nov/2012:21:35:58 -0800] "GET / HTTP/1.1" 200
2601:5:300:83:6997:f2b7:4d2d:c7fd - - [20/Nov/2012:21:35:56 -0800] "GET / HTTP/1.1" 200<

All four requests were made by my computer. The first was made straight to the server using my IPv6 address of 2601:5:300:83:6997:f2b7:4d2d:c7fd. The second two requests were hijacked by Comcast so the request ended up coming from 68.87.68.230 (one of Comcast’s used to hijack customer’s web traffic).

After a request is hijacked, HTML code is injected into the web page to display this message

Below is the code that Comcast is injecting into the page. If your browser doesn’t load the code below, you can view it here on GitHub.

Taking a look at the RADIUS logs on the Cisco ACS yields this Christmas colored mess:

The first authentication failure occurs at 10:05:40AM

To put that in comparison, here’s one page before and one page after the incident.

Just before

Just After

The Failure Reason reads: “11514 Unexpectedly received empty TLS message; treating as a rejection by the client“

Clicking on the message gives us some very useful information:

I’ve put in bold the relevant parts of the message. Remember when I mentioned we set this up about a year ago? After putting two and two together I realize the certificate we’re using more than likely expired.

I head on over to System Administration > Configuration > Local Server Certificates > Local Certificates and I take a look at the certificate being used for EAP and that’s when I notice the following:

Adjust the time zone offset and what do you get? Authentication errors starting at exactly the same time the certificate expired. Go figure.

A simple re-issuing of the certificate corrected the issues and clients were once again able to connect to networks using 802.1x.

The Startup

The startup under fire today is a web service by the name of Ice Box Pro posted on Hacker News today proved that point. The service was designed as a way to back up filed to Amazon Glacier that you put in a special Dropbox folder. I was curious to see how well it performed, so I decided to sign up and give it a test run. What follows is a perfect example on how not to handle security.

Clicking on the Account tab brings you to your account page, visible below.

The Your Account page of an Ice Box Pro account

Visible are your name, email, AWS ID and Key, and the AWS Glacier vault created by Ice Box Pro. Upon setting your AWS ID and Key, only the last few characters are actually visible. What’s even more interesting, however, is the /users/87 part of the URL. As it turns out, your User ID is baked into the URL. In this example, I was the 87th user to sign up for Ice Box Pro. My original account was somewhere between 5 and 15, although I entered in random text for the email address so I couldn’t log back in.

So what’s the problem? I’ll give you one guess as to what happens when you change that 87 to another number.

Viewing other users information

That’s right, you could change that 87 to any number you could think of and it would spit back the information for that user. You would see exactly the same information you could see for yourself. This quickly reminded me of the Stripe CTF a few months ago. Since you can only see the Name, Email, and the last few characters of the users ID and Key, the information isn’t too dangerous with the exception of it being a spammers gold mine. But wait, it gets worse…

Compromising accounts

See that Edit link at the bottom of the account page? Click it and you’ll see the account edit view!

In the Edit your profile view, you can change your name, email, password, and AWS info

The important part here is to note that if I had filled out an AWS access key ID and AWS secret access key previously, the entire key would be visible on this screen. So while only the last few characters are visible from the account view, the entire key is visible from the edit view. It’s worth noting that the edit option is available for any user account and can be accessed by anyone.

This means that by going to /users/1/edit and /users/2/edit, you could edit the details of the two founders of Ice Box Pro. From here you can reset their password, login as them, and get access to any file they backed up. Even worse it gives you access to their AWS keys.

If you setup your access correctly, then only your AWS glacier service can be accessed. Some users, however, I found used their master AWS keys which give access to every area of Amazon Web Services (EC2, S3, etc).

Conclusion

Never give any kind of information to a startup that came into existence just 10 minutes ago. At least give it a few days for them to work out the security vulnerabilities such as this. The one I saw today was one of the worst imaginable. Full control over any users account, password, and AWS keys. Users that used their master AWS keys opened themselves up to a major headache if the keys were accessed by the wrong people and not revoked in time.

I did the math and Tweeted my findings.

https://twitter.com/RyanAKearney/statuses/237585880276144128

A few hours later, an AT&T employee Tweets back (at least according to their Twitter bio they appear to be), but then almost immediately deletes their Tweet. No matter, their reply was already sent via text message, email, and cached on my desktop Twitter client Tweetbot. Below is a screenshot.

Someone affiliated with AT&T replies back, only to quickly delete their post.

@RyanAKearney actually 1 character in a msg equals abt 1 kb.1024KB=1MB..same conversion to GB-AT&T charges 19.97/mb or 120mb for $30 #fact

Actually, the body of a text message is 140 bytes which is 160 7-bit characters. I incorrectly assumed they were 160 bytes when I made my initial calculation #fact. So one character in a text message is 7 bits, far off from the 1,000 bits you claim it is. Then she goes off to say AT&T charges $19.97 per megabit and somehow that amounts to 120 megabits for $30? I can see why they deleted the tweet.

Now lets do the math here one step at a time.

1. 1024 bytes = 1 KiB
2. 1024 KiB = 1 MiB
3. 1024 MiB = 1 Gib
4. 1024 * 1024 * 1024 = 1,073,741,824 bytes per GiB
   Now that we know how many bytes are in 1GiB, we can divide that number by 140, the number of bytes of data you can send in a text message.
5. 1,073,741,824 / 140 = 7,669,585 (rounded up)

This means we have to send 7,669,585 SMS messages to send 1GB of data (and this is assuming you can represent any set of data in an SMS message which I don’t believe you can, but that’s besides the point since it would just made this already large number even larger).

Finally, since AT&T charges $0.50 per SMS message, we just multiply our number of messages by $0.50 to get…

$3,834,792.50

If you were sending that 1GiB of data to another AT&T customer, that amount would be

$7,669,585

What’s this mean? If you wanted to send a typical HD video from one AT&T cell phone to another via SMS messages, assuming the video is 4.6GiB in size, it would cost:

$35,280,091

So there you have it. $35 Million to send a 4.6GiB HD movie from one phone to another using SMS while roaming.

Verizon is faster than AT&T

AT&T is slow, very slow. Not too long ago they changed the network indicator from 3G to 4G on the iPhone 4S, despite their network not being any better than 2G. Below here is a screenshot of a speedtest I did on the AT&T “4G” network.

Speedtest on the AT&T “4G” network

To put that in comparison, here’s a speedtest on the Verizon network

Speedtest on Verizon LTE Network

The result? AT&T’s pings are 50% slower and Verizon is 7x faster in downloads and 35x faster in upload speeds.

Now you could argue that the Verizon test was done on a faster LTE network and the AT&T test was done on the slower 3G (sorry, HSDPA) network, however if AT&T wants to call their HSDPA network 4G then I will hold it to the same standards as Verizon’s LTE network. AT&T doesn’t even have LTE coverage in my area (which isn’t unusual) so having a device capable of connecting to AT&T’s LTE network wouldn’t have made a difference for these tests.

Verizon doesn’t charge more for tethering

Devices on Verizon’s LTE network that support tethering may do so, free of charge. You can see this in action with the New iPad on AT&T and Verizon. The Verizon iPad allows you to tether to the device free of charge. The AT&T iPad doesn’t even allow tethering and they’re working with Apple to figure out a way to charge customers extra money to use the feature.

AT&T will stop at nothing to get you off unlimited data

Are you on a legacy family plan with AT&T? Did you know in iOS 6 you can FaceTime over your cellular connection? Well, that is if you switch to their Mobile Share plan (a near exact copy of Verizon’s Share Everything plan which came first). The Mobile Share plan would cause the family plan I’m currently on to increase by $50 for the exact same feature set. You can’t get tethering on an unlimited plan and now you can’t get FaceTime over 3G either. Even if you’re already off an unlimited plan, you’re still required to switch your entire plan over just to use your data for FaceTime.

Verizon is cheaper (by nearly 50%!)

The cost of an AT&T plan with “unlimited” voice, texting, and 5GB of data with tethering and FaceTime costs $199.99 a month. I also have an iPad (which is Verizon, but for the sake of this argument we can pretend it’s an AT&T tablet) so that’s another $10 a month for a grand total of $209.99 a month. To put that in comparison, a plan on Verizon with unlimited voice, texting, 4GB of data with tethering and FaceTime for 1 phone and 1 tablet costs $120.00 a month or $130.00 a month if you want 6GB. That’s almost half the cost of the AT&T plan.

Verizon actually has LTE coverage

AT&T has LTE coverage in 53 cities. Verizon has coverage in over 370 cities. That’s 7x more Verizon coverage than AT&T. See the difference:

AT&T has deployed LTE to very few cities across the US

Verizon covers much more areas than AT&T

Conclusion

For nearly 50% less, you get a provider that has 7x more coverage on a network that is roughly 7x faster. Add the fact that Verizon isn’t allowed to charge you more for the data you already pay for, and the choice is clear. AT&T is heading down a very slippery slope. What’s next? $10 extra per month for Netflix? $1.00 per photo posted to Instagram? $0.50 a minute to use Pinterest? If you’re fine with paying twice as much for terrible service then AT&T it is. If you want lower monthly bills with faster coverage, go with Verizon. If you want lower bills with awful service, go with T-Mobile or Sprint.

$9.99 a month – 50 GB storage + 32 GB referral space + 250MB bonus = 82.25GB

Dropbox

Dropbox offers 2GB of online storage completely free. The free plans have a referral limit of 8GB resulting in a maximum of 10GB of free storage plus 250MB if you complete the getting started steps. If you convert to a paid plan (starting at $9.99 a month) then the amount of extra space you can get from referrals doubles to 16GB. In addition, instead of receiving 250MB per referred user, you gain 512MB. The increased bonus is retroactive so your bonus space will double once you make the switch.

Recently, Dropbox started giving double referral space to students as well! You can claim your double space here: https://www.dropbox.com/edu. You’ll need a .edu email address to take advantage of the double referral bonus for students. Since these two bonus are compounding, you’re awarded with a whopping 1GB of extra space per user you refer, up to a total of 32 extra GB.

So, to maximize your extra storage, you’ll need a paid plan and a .edu email address. If you can’t afford to switch to a paid plan, you can still use the .edu email address to reach 16GB of extra storage, giving you 18GB of storage for free.

Now, the hard part becomes actually getting 32 people to sign up with your referral code. You can only refer new people and you can’t use the same computer your account is on (so you can’t refer yourself over and over to cheat the system). You could try telling your friends and family, posting your referral link to Facebook and Twitter. But what if they all already have, or have no use for Dropbox?

Google Adwords

The advertisement I used.

I know what you’re thinking, and it’s probably something like “Hey, you said this would cost next to nothing, I’m not paying for advertisements!”. But if you continue on, there are actually ways to get $100 in free advertising revenue from Google or a partner. So, without further ado…  I created an advertisement using Google Adwords using the keyword “Dropbox”. I had a bunch of other keywords as well such as SugarSync and box.net (two competing services), cloud storage, online backup, and other terms that could be used to describe Dropbox. However, I noticed that those keywords were not performing as well as I had expected, so I removed them. After all, your best bet is to capture people who know they’re going to sign up for Dropbox, and intercept them with your referral link. This results in a high conversion rate since you aren’t trying to get them to sign up for anything they weren’t planning on.

The Campaign

Default bidding option with $100/day budget.

As far as the advertisement goes, it’s entirely up to you what you want to put for the title/description. You could use a graphical advertisement if you wanted to, or just a text-based ad like I did. There’s just one important thing to note, and that’s your Budget. Make sure you set this to something you’re able to pay. For example, I set it to $100 so I could eat up my Google AdWords credit in 1 day and be done with it. It’s extremely important you realize that if your credit expires, you will be charged for advertising fees if you leave your ad running. With that being said, just make sure you Pause or Delete your campaign when you’re finished. For good measure, in addition to pausing my campaign I went ahead and set the budget to $0.01/day. This was more of a paranoid thing than anything, since the pausing of the campaign took effect immediately.

Choose the devices you wish your ads to appear on.

In addition to setting a budget, you may want to consider which devices your ads appears on. I removed mobile devices since the chances of someone signing up for Dropbox from a mobile phone are quite slim considering you need to install the desktop application to really get started. This ensures you wont waste any money showing ads to people who more than likely won’t get you the referral credit you want.

Choose the networks you want your ad to appear on.

Finally, if you want to change the Networks your ads appear on, you may do so as well. I choose to only display the ad on Google searches since the chances of getting someone to sign up for Dropbox is higher if they are explicitly searching for Dropbox than if they read an article or saw a video that triggered the advertisement.

Getting it all for free

So now, the part that ties it all together. Chances are you don’t want to pay $100 for some easy referrals you may or may not even need. However, fear not because there are many ways you can receive up to $100 in free advertising credit. For example, Hostgator will give you $100 in Google AdWords credit when you sign up f or any one of their shared hosting packages. Many other hosting companies offer the same or similar amounts of AdWords credit. However, if you’re not willing to sign up for a service you don’t need, you can always try creating an AdWords account and letting it sit dormant for a week. Not too long after I created my AdWords account I got an automated email from Google offering me $100 credit to start using AdWords. Users beware, this is the included fine print in the email.

One promotional credit per customer. Promotional credit valid only for new Google AdWords customers with self-managed signup accounts. Advertisers will be charged for advertising that exceeds the promotional credit. Advertisers can suspend their ads at any time if they do not wish to receive additional charges beyond the free credit amount. Offer subject to ad approval, valid registration and acceptance of the Google AdWords Program standard terms and conditions. The promotional credit is non-transferable and may not be sold or bartered. Offer may be revoked at any time for any reason by Google Inc. Advertisers with self-managed signup accounts are subject to a $5 (CAD$10) activation fee. Advertisers who choose prepay billing are subject to a $10 (CAD$20) minimum prepayment fee before their account is activated. Any such prepay amount will be credited to Advertiser’s account once account is activated. Offer valid only for sign ups through the URL provided for the promotion by customers with billing address in the US or Canada. Offer void where prohibited by law. Coupon offer expires in 30 days!

Basically it’s just a fair warning that if you go over your free credit, you are responsible for any additional charges. As long as you don’t forget your ad is running and you don’t set your budget too high, you’ll be fine. When I signed up, my $100 Google AdWords Gift Card was actually counted as $105 and the $5 non-refundable signup fee was deducted from my balance, leaving me with the $100 to use as I please.

The most satisfying thing about this whole process was getting to see Dropbox alert me from the system tray that my quota had been increased. Knowing you’re getting up to 32GB of extra space, for free, with very little effort on your part.

Extra Stats

In the end, I went $1.69 over my credit, my ad got 135 clicks and 24 people signed up for Dropbox. Of those 24 people, 4 have yet to download and install Dropbox and 1 was ineligible due to trying to sign up with an email address that was already registered with Dropbox. Those may or may not be the best results, but I put next to zero effort into the advertisement and the plethora of settings Google gives you to customize how, when, where, and for how much you pay in order for your ad to appear. Using the default settings resulted in an average cost per click of $0.75 but you could have just as easily set a CPC maximum of $0.25 and potentially have received 3 times more referrals than I did. However, if you have a low CPC bid then your advertisement may not appear on top, or in a prime location. If you’re patient and you can wait and let your referrals trickle in than that would be the way to go. However, due to my impatience and just wanting to get it over with, I let Google handle my CPC bids which resulted in a higher cost ad, but a much faster turnaround.

Mail

The first, and probably biggest feature of MobileMe is your email and @me.com email address. While the only way to get an @me.com email address would be to get MobileMe, there are various other methods to go about getting your own email address at your own domain name. I’ve never actually ever seen someone use an @me.com email address which leads me to believe it isn’t too popular. Here’s what Apple has to say:

Email that’s always in sync.

When you join MobileMe, you get a me.com email account that’s always up to date and in sync, no matter where you check it. MobileMe constantly looks for new messages, so you don’t have to. They’re pushed to your iPhone, iPad, and iPod touch automatically, and you’re notified as soon as they arrive.

You’ll also notice that the inbox on your iPhone or iPad looks a lot like the inbox on your Mac or PC. That’s because it is. Read messages are marked as read, and all your folders are exactly the way you left them. Your inbox includes spam and virus protection. And you can access your MobileMe email from anywhere via a powerful, ad-free webmail app at me.com.

Well hey, that sounds great! There’s just one problem with this. All of this “technology” has been available for anyone and everyone to use, for free. As far as the alternative goes for Mail, I suggest the use of Google Apps as it includes Gmail. In order to make use of Google Apps, you’ll need to have your own domain name, usually around $10 a year. If you don’t have your own domain name, you can still get a free @gmail.com email address. Once you set up your Gmail account, you can configure all of your mail clients to use IMAP to access your Gmail account. What’s that mean for you? It means all of your Email stays in sync, across all platforms, desktop and mobile. You can also configure Gmail to push all of your new email to your iPhone, iPad, or iPod touch, as soon as they arrive. And, of course, Gmail also offers spam and virus protection.

My inbox shown in Gmail’s web interface

My inbox shown in Microsoft Outlook

My inbox shown on the iPhone

You would also see the same exact inbox if you viewed it from a Mac, BlackBerry, or Android device.

Along with supporting every feature MobileMe has to offer, Gmail also provides a multitude of other features not supported by Apple. If you want to find out more about Gmail, you can check out their What’s New page. The only thing you don’t get with Gmail is an @me.com email address and the “add-free webmail app”. Gmail includes non-obstructive, text-based advertisements off to the far right of the screen next to the email body. These advertisements only show up in the web interface and even then, they only show up some of the time.

Contacts

Much like the email MobileMe comes with, they also keep track of all of your contacts. Just like the Mail app, these contacts stay in sync between your desktop, mobile devices, and online. Here’s what Apple has to say about Contacts:

Access contacts wherever you need them.

With MobileMe Contacts, your entire address book is accessible from your computer, iPhone, iPad, and on the web at me.com. Say you meet someone and add that person to Contacts on your iPhone or iPad. MobileMe automatically sends the new contact to the cloud, and in seconds it appears in Address Book on your Mac or in Outlook on your PC. You don’t have to connect your iPhone or iPad to your computer or do anything at all. Your new friend’s information — phone number, email address, photos, and notes, such as “sat next to me at the parenting seminar” — is exactly where it should be, anytime you need it.

Syncing your contacts is just as easy as syncing your mail with Gmail. First you have your web interface that’s accessible from anywhere you have a web browser and internet access. After that, you can setup an exchange account on your iPhone/iPad/iPod touch using m.google.com and your Google username and password. After that you can natively sync your Mail, Contacts, and Calendar with your iOS device.

Adding a Google account to the iPhone

Now we’re left with syncing between Google and your desktop. Unfortunately, this is where Google falls short. While they do offer Contact syncing with Outlook, it requires a paid Google Apps account at $50/user/year. You can see the Google Apps Sync page for more information. If you go this method, you’ll be spending $60 a year which, while not free, is still 40% cheaper than MobileMe. Keep in mind, however, that there are free third-party applications you can use to keep Outlook and Google Contacts in-sync. Mac users can read this blog post from Google or check the official documentation regarding syncing their contacts with their Mac.

Calendar

Jumping right into what Apple has to say:

Manage your schedule, not your devices.

MobileMe keeps your calendar in sync across your iPhone, iPad, Mac, and PC, and on the web at me.com, so you always know where you need to be and when you need to be there. Change the time for your doctor’s appointment on your computer at work, and it updates on your iPhone or iPad — no docking required. Add an event on your iPhone or iPad and it automatically appears in the Calendar application on me.com. You can even share calendars with friends and family who are MobileMe members. As soon as someone adds or edits an event, it syncs over the air across everyone’s devices. So you’ll never miss a lunch date, soccer game, or important meeting again.

Since this is becoming slightly repetitive now I’ll try to keep this one short. Anything Apple can do, Google does better. Above you can see Calendars easily sync with iOS devices. When it comes to desktop devices, you can check out Google’s Calendar Sync to sync your calendars between Outlook and Google. Mac users can find out how to sync with iCal by reading Google’s documentation.

Find my iPhone

This is available for free to owners of new iOS devices so it isn’t exclusive to the MobileMe $99/year service.

Gallery

Apple has their Gallery, Google has Picasa. Take a look, check it out.

iDisk

Apple offers 20GB of space to store whatever files you want. Dropbox offers even more features, however their free account only offers 2GB of space. You can get more space, for free, if you refer other people to the Dropbox service. SugarSync offers 5GB account for free, although I prefer Dropbox to SugarSync. In addition to storing files, SugarSync and Dropbox have a much higher feature set than iDisk.

Conclusion

While MobileMe may be just what the average user wants, there is always the risk of losing all of your data. Much like someone who has become attached to their @comcast.net email address or @att.net email address, you may not have it forever. For instance, let’s say you move to another state. You currently have Comcast but the area you’re moving to has Verizon FiOS. Since you’ll no longer be needing Comcast’s services, your email address goes with it. I could be wrong, Comcast may let you keep your address, but I think it’s the former. With Gmail, you always have your @gmail.com email address and there’s never anything to pay. Apple tries to make their services seem very simple to use and beneficial to the customer. While they are, customers also need to realize that there are a multitude of free alternatives out there of equal or greater quality.

When you compare, there’s no comparison
– AT&T

Ultimatrix pointed out where Steve Jobs compared the iPad to a Netbook, so you can stop posting comments about comparing two completely different devices.

Skip to 1:30

The problem is, Netbooks aren’t better at anything
– Steve Jobs

Well Steve, let’s see what the Netbook is better at.

$829	Price	$699
1Ghz	Processor	1.66Ghz
64GB	Disk Space	320GB
9.7″	Screen Size	11.6″
1024×768	Screen Resolution	1366×768
140,000	Applications Available	Millions
0	USB Ports	3
2GB	Mobile Data	Unlimited
	AT&T
	Verizon
	Sprint
	Tether to existing phone
	Download Apps From The Web
	Handle Compressed Archives
External	Physical Keyboard
	Bluetooth
	Webcam
	Firefox/Chrome
	Safari
	Adobe Flash
	Optical Drive	External
	Video Chat
	Adobe Photoshop
	Microsoft Outlook
	Multitasking
	Windows 7
	Run Any Linux Distro
	Run OSX
	Removable Battery
	Hardware Upgradeable
$10/Month	Hulu	Free
	Netflix

Response Time

We will start by taking a look at the response time for the three services over a period of 1 week

Rackspace Cloud Files came in first place with an average response time of just 69ms, however, GoGrid CDN was very close behind with 70ms. In third place was Amazon Cloud Front with an average response time of 225ms and in last place was SimpleCDN with an average response time of 402ms. Here’s a chart with the four Content Delivery Network’s average, fastest, and slowest response times over a period of one week.

Not only did Rackspace Cloud Files the lowest average response time, it also had the fastest response time overall in the one week time frame. GoGrid CDN also proved to be a good contestant with an average response time of a mere one millisecond over that of Rackspace Cloud Files. While Amazon Cloud Front had quite a bit higher average response time, it did have the lowest, slowest response time with 522ms as the longest response time. SimpleCDN has slowest response time of over two seconds, which is just awful for a content delivery network.

Pricing

Here’s a quick breakdown of pricing for Amazon and Rackspace CDN services.

*After June 30th inbound data transfer is $0.10 / GB
†Variable Cost; Decreases as more space or bandwidth is used.
††Storage not necessary, more information in the features section.
‡Higher charges apply for other regions such as Japan. Click here to view the full pricing model.

I wouldn’t consider SimpleCDN to be a true pay-as-you-go service, they require you to add funds to your account, with the smallest amount being $50. You can view the cost calculator for the services here. Rackspace Cloud Files, Amazon Web Services, SimpleCDN, (GoGrid CDN currently has no cost estimation calculator). Keep in mind when you setup the Amazon Web Services monthly calculator you will need to add S3 and Cloud Front. The S3 account will hold all of your data, and the outbound bandwidth will vary depending on how many files you have, their sizes, and how often the Cloud Front endpoints refresh their cache of your data. Cloud Front will then be where you allocate your total projected outbound bandwidth and average object size (which is to calculate GET requests I’m guessing) as well as allocate percentages to different regions, since Amazon charges differently per GB depending on the region the server responding to the request is located.

Speed

Next up is a speed test. I’ve uploaded a 100MB file to Amazon S, Rackspace Cloud Files, SimpleCDN, and GoGrid CDN to download from various locations. Listed below is the time taken (in seconds) to download the 100MB file. Each test was done three times with the fastest of the three tests listed below.

Not counting the slow residential ISP download rate we can see that Amazon Cloud Front came out ahead on the speed tests with an average download speed of 39.3MB/s. Coming in second was GoGrid CDN with 36.9MB/s followed by Rackspace Cloud Files at 34.3MB/s and finally SimpleCDN with just 28.3MB/s. SimpleCDN had some good tests, however, with a fastest speed of 54MB/s clocked from Amazon’s networks in Northern California. The 3.09MB/s speed was what really brought it down, which came from ThePlanet’s network in Texas. All these tests were done between 7PM and 9PM EST and are subject to change throughout the day due to network congestion.

Features

What’s a CDN without features? Well, it’s just a CDN. But hey, that’s what a CDN does, deliver content. Anything above and beyond that is an added bonus. Lets go over the various features Amazon and Rackspace have to offer.

GoGrid also offers live streaming, allowing you to push your live content to a rtmp server and having others tune in. GoGrid charges you their standard rate for how much bandwidth you use, however, SimpleCDN charges you a flat monthly fee for Live services starting at $59 a month for 250 concurrent views and going up from there. On the plus side, there is no bandwidth charges for their Live services, and no limit to the video bitrate. You would have to do the math to determine if GoGrid or SimpleCDN would be more cost-effective for you. Chances are if you plan to do a lot of streaming, or stream high-definition content, SimpleCDN might be the better  bet for you.

GoGrid and SimpleCDN offer something else that Rackspace and Amazon don’t, the ability to map a CDN URL to your server. What I mean is, instead of uploading files to GoGrid and SimpleCDN and having to pay monthly storage costs, you could just host the files on your server and use what they call Customer Origin/Mirror Buckets. After you map one of these to a URL where you keep all of your files, requests to the file through the CDN url will cause that end point to fetch the data from your own server and cache it for future requests. You’ll be able to get the same CDN delivery speed with none of the CDN storage costs.

Using Amazon Cloud Front requires an Amazon S3 account. Having an S3 account means you can use its torrent feature. If you add “?torrent” to the end of any S3 URL, the server will return a .torrent file instead of the file requested. This is especially great for large files since you will have other users helping you out with distribution, lowering your bandwidth cost. The torrent uses Amazons’ tracker and their S3 machines are seeding the file. This way your torrent will never die, so long as the file remains on the S3 servers. Once again, while this isn’t a feature of their CDN service, it’s still a feature of S3, which is required to use their CDN service. If it’s streaming video you want, then GoGrid CDN or SimpleCDN is the choice for you. Both offer Windows Media and Flash Streaming services for your content. Using these will allow users to fast forward through your video without having to wait for it to load to that point. GoGrid also offers a way to throttle bandwidth usage. This is especially useful and can save you a ton on bandwidth costs. Limiting the users bandwidth will allow the video to buffer and offer a constant viewing experience, however, it will prevent the entire video from buffering too quickly. This way, if the user decides they do not wish the watch the entire video, you won’t have to pay for the bandwidth of the entire video, only that which has been buffered.

Conclusion

GoGrid CDN is still in beta and is relatively new. However, it’s proven so far to have very low response times like Rackspace Cloud Files. While GoGrid wasn’t as fast as Amazon Cloud Front, it was still in second place and achieved very high speeds. SimpleCDN used to be a great CDN service, giving users streaming capabilities with their media. However, now with GoGrid CDN stepping up to the plate with the same streaming services as SimpleCDN, it looks like it’s taken the lead. The great thing about pay-as-you-go CDN networks is that you can use them all, and not have to pay  large monthly fees. For example, I’m using GoGrid CDN to deliver streaming video content, while using Amazon Cloud Front to deliver my static content. It all comes down to what you need. And if you need to stream live high-definition content to thousands of people at the same time, well then SimpleCDN just might be the best thing for you. Each CDN has their own features, and it’s up to you to decide exactly what you need. With pay-as-you-go services, you really have nothing to lose but your time.

Update (December 17, 2009)

I’m in the process of adding 2 more CDN networks to the charts along with different tests (i.e. rtmp streaming, downloading many small images, and anything else I can think of). A new article will be posted with the new test results along with pretty charts and graphs!