Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloud Firewalls

digitalocean.com

Post reply on HN
Print view View original

51–60 of 119 posts

Re: Cloud Firewalls

#51

Post by toomuchtodo »

tyingq wrote: post #49
toomuchtodo wrote: post #41

Earlier quoted context omitted.

Can you explain your use case? I know a lot of businesses solely using us-east-1

My specific use case isn't really that interesting. Many use cases where a single AZ or region failure shouldn't stop business exist.

It is very, very rare from my professional ops/devops experience to see an org built to survive a region outage; the tools are there, the money/business case is not.

Re: Cloud Firewalls

#52

Post by majewsky »

vultour wrote: post #40
the_common_man wrote: post #30

Can someone clarify if the traffic between two droplets is "secure" i.e other droplets cannot see them? On AWS, I can create a VPC and put two ec2 instances on that.

I'm not expert on hypervisors but is what you're saying even possible? One would think that dispatching the correct packets to the correct VM would be an integral part of the virtualization environment.

Not an expert either, but afaik customer isolation is quite easy when you put each customer on their own VLAN (or similar) and remove the VLAN tag only after the packet has reached the virtual NIC of the customer's VM.

Re: Cloud Firewalls

#53

Post by SXX »

the_common_man wrote: post #30

Can someone clarify if the traffic between two droplets is "secure" i.e other droplets cannot see them? On AWS, I can create a VPC and put two ec2 instances on that.

I have no idea if something changed, but at least about year ago "Private Networking" on DO was shared between more than just your droplets and required additional firewall / encryption.

Re: Cloud Firewalls

#54

Post by majewsky »

toomuchtodo wrote: post #41
tyingq wrote: post #34

Earlier quoted context omitted.

B2 is nice, but the single location is something of a deal-breaker as far as being an S3 replacement.

Can you explain your use case? I know a lot of businesses solely using us-east-1

Well, for starters, all customers that are not in us-east. Such as US west coast, Europe or Asia.

Besides latency, data protection issues also become a problem when you cross borders. My employer's (SAP) cloud platform advertises as a unique selling point that they have data centers in a wide variety of locations, so that a customer's data never has to leave their jurisdiction (which is important e.g. for government and its contractors).

And that's before we get to high-availability setups. Remember how AWS us-east was down just a few months ago?

Re: Cloud Firewalls

#56

Post by tyingq »

toomuchtodo wrote: post #51
tyingq wrote: post #49

Earlier quoted context omitted.

My specific use case isn't really that interesting. Many use cases where a single AZ or region failure shouldn't stop business exist.

It is very, very rare from my professional ops/devops experience to see an org built to survive a region outage; the tools are there, the money/business case is not.

It doesn't have to be HA and replication. Sharding by customer would mean a region outage takes out only 1/N customers. That wouldn't have a higher cost, other than whatever dev effort is needed to work that way.

Re: Cloud Firewalls

#57

Post by quicksilver03 »

the_common_man wrote: post #30

Can someone clarify if the traffic between two droplets is "secure" i.e other droplets cannot see them? On AWS, I can create a VPC and put two ec2 instances on that.

It isn't by default, that's why DO calls it "shared private network" (their words, not mine).

To secure internal traffic on DO you have to encrypt it, using for example something like tinc.

Re: Cloud Firewalls

#58

Post by blfr »

I know this is not strictly related but how well does Digital Ocean hold under a DDoS nowadays? Are they closer to Hetzner who just blackholes your IP or OVH who can withstand virtually anything?

Re: Cloud Firewalls

#60

Post by McBlorker »

ino wrote: post #55
jbrooksuk wrote: post #46

Really all we (the company I work for) need now is Block Storage in LON1!

We need it for ams3

We published the roll-out schedule for Block Storage a little while back. Both LON1 and AMS3 are planned for this year: https://blog.digitalocean.com/block-storage-comes-to-singapo...
Post reply on HN