Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing App Engine Firewall

cloudplatform.googleblog.com

Post reply on HN
Print view View original

21–30 of 35 posts

Re: Introducing App Engine Firewall

#21

Post by metachris »

wcarron wrote: post #20

I think this is a good product offering, and it's nice to see them compete with AWS on another front, as well as Digital Oceans' offering. However, I wonder if these abstractions are detrimental to developers understanding the underlying technology? I'm not a supremely experienced developer but it takes very little effort to understand, for example, ufw and iptables on Linux distros. Personally, though I'm (mostly) f…

I think you are right with the understanding, but its a trade-off to be able to build bigger things more quickly and easily.

Re: Introducing App Engine Firewall

#22

Post by skim1420 »

victor106 wrote: post #3

This is a good feature. Wish app engine provides capability for blue-green deployments.

For those looking for a more automated approach for doing things like blue/green, take a look at Spinnaker (http://spinnaker.io). Here's a quick video for App Engine - https://youtu.be/pOPgTHz_nYw

Disclaimer, I work on the project.

We don't have a deployment strategy named "blue/green" for the App Engine provider for various reasons, but do provide stages such as "deploy", "disable", "enable", "destroy", as well as setting traffic split percentages that you can string together in a pipeline.

Edit: okay, no markdown on HN

Re: Introducing App Engine Firewall

#23

Post by cobookman »

wcarron wrote: post #20

I think this is a good product offering, and it's nice to see them compete with AWS on another front, as well as Digital Oceans' offering. However, I wonder if these abstractions are detrimental to developers understanding the underlying technology? I'm not a supremely experienced developer but it takes very little effort to understand, for example, ufw and iptables on Linux distros. Personally, though I'm (mostly) f…

iptables on the face is easy to use. But at scale becomes difficult to use.

Also iptables does much more than just firewalls and can become a confusing tool.

Also, in a large enterprise organization the firewall guy is different than the software engineering team which is different than architect.

Re: Introducing App Engine Firewall

#27

Post by derefr »

wcarron wrote: post #20

I think this is a good product offering, and it's nice to see them compete with AWS on another front, as well as Digital Oceans' offering. However, I wonder if these abstractions are detrimental to developers understanding the underlying technology? I'm not a supremely experienced developer but it takes very little effort to understand, for example, ufw and iptables on Linux distros. Personally, though I'm (mostly) f…

I like things like this not because they make the underlying tooling more opaque/encapsulated, but because they expose that tooling to network-API-based management, through tools like AWS's CloudFormation et al.

To be able to set up firewall rules for my app in concert with installing the app—and to roll out changes to those rules as part of rolling app updates—my cloud orchestration system has to be told that a given box "is" a firewall, or discover that fact through SNMP or WSDL probing. If it has that capability, then it may as well let me assign properties to the "box-as-firewall" object in its convergence model, rather than the "box-as-box" object—and then, given that it's not doing anything other than being a firewall, maybe let me leave the "box-as-box" object unspecified and have it created automatically by requirement of the "box-as-firewall" spec.

Now we're back to the "opaque appliance" abstraction (at least by default), without ever having chosen to design things that way.

Re: Introducing App Engine Firewall

#28

Post by gramakri »

wcarron wrote: post #20

I think this is a good product offering, and it's nice to see them compete with AWS on another front, as well as Digital Oceans' offering. However, I wonder if these abstractions are detrimental to developers understanding the underlying technology? I'm not a supremely experienced developer but it takes very little effort to understand, for example, ufw and iptables on Linux distros. Personally, though I'm (mostly) f…

While they look the same, the technologies serve different purposes.

iptables/ufw block requests at the VM level. So traffic flows all the way to your VM and then your VM spends CPU cycles rejecting those packets.

In contrast, these firewall technologies can block traffic at the network edge of the cloud provider. This is done by propagating rules to the edge routers.

Re: Introducing App Engine Firewall

#30

Post by wcarron »

gramakri wrote: post #28
wcarron wrote: post #20

I think this is a good product offering, and it's nice to see them compete with AWS on another front, as well as Digital Oceans' offering. However, I wonder if these abstractions are detrimental to developers understanding the underlying technology? I'm not a supremely experienced developer but it takes very little effort to understand, for example, ufw and iptables on Linux distros. Personally, though I'm (mostly) f…

While they look the same, the technologies serve different purposes. iptables/ufw block requests at the VM level. So traffic flows all the way to your VM and then your VM spends CPU cycles rejecting those packets. In contrast, these firewall technologies can block traffic at the network edge of the cloud provider. This is done by propagating rules to the edge routers.

Ahh, that changes my perspective on this. That suddenly seems vastly more useful than it did, to me.
Post reply on HN