Viewing profile — weavenetwork

Thanks @takeda. Are you aware that we did not roll our own crypto? Instead we used the NaCl crypto libs[1]. Weave adds about 300 LOC to integrate NaCl. You can read about it here -…

What about them? Would you recommend one of them over the others?

I'll have to stop saying please when in the US then ;-) But seriously, thanks for taking the time to explain your point of view. alexis.

cripes. on each host? what kind of physical network are you using, and how many containers per host? how many hosts? let me know if I should email about this instead.

What throughput do you need, on a per-host basis?

We are open to recommendations, help and overall insight from expert contributors in security. As many people on this thread have pointed out, it is a big and complex world..

We did not roll our own crypto. We used NaCl. The rationale is explained here - http://weaveworks.github.io/weave/how-it-works.html#crypto We agree that other approaches are possib…

No, for example it is 100% uncharitable and unreasonble to assert that "please" is sarcastic. The truth is quite the opposite.

Paul, I think our work is good. We thought about our approach very carefully.. And we have built systems like this before. The main difficulty is to combine moving fast with limite…

Complaining on twitter is not the same as finding an issue! Criticism has value, but not all commentary deserves equal weight or time before it is reasonable to request reciprocal …

indeed. at the risk of entering tinfoil hat land, note the following http://blog.cryptographyengineering.com/2014/12/on-new-snowd... ..although also the not 100% reassuring https:/…

although, sometimes not obviously so: https://github.com/GoogleCloudPlatform/kubernetes/pull/4483#...

Tony, the team recently updated the crypto docs to clarify the rationale etc etc - http://weaveworks.github.io/weave/how-it-works.html#crypto ... Moreover the entire crypto code fo…

Using an account that I share with other people in the same team is not the same as 'marketing'. I am sorry if this somehow offends, but think of the handle as just one poster.

edit: here is a kubernetes link: https://github.com/GoogleCloudPlatform/kubernetes/pull/4483#... the author, who was part of the MS Azure team at the time, said: "as of today, this…

True. We did try ipsec, and couldn't find an implementation that was oss, demonstrably safe, and easy enough to pull into a first release. As weave matures, we'd love to work with …

I'm sorry but I find your interpretations of 1-4 completely uncharitable and unreasonable.

I don't think anyone meant, or said, "fuck you". Why are you even implying such a thing? Ultimately we can't work on even a fraction of the features that every person wants, and La…

as laurie mentions in his article, you can easily use off the shelf security solutions with weave... the point of the current crypto is to provide something basic that works. we ch…

You can of course use etcd with weave... indeed weave can be run with no dependencies, so it may make sense as a way to bootstrap etcd ;-)

I haven't seen those used in the wild yet, but fwiw, weave is working on a 'fast data path' that uses the same kernel path as ovs

I should add that one way to get more throughput is to use more than one CPU.

yes, microseconds surely - we estimate that the cost of switching from kernel to user space, and back again, several times, adds up to 2-300 microseconds. in return for this, you g…

I'm not sure why you think so, but fwiw, irl, I am alexis at weave dot works

Correct! Once upon a time people said Amazon cloud was too slow. Then they said it wasn't suitable for large workloads. Then they said it did not make money ... etc etc. I'm not sa…