Terraforming 1Password
blog.agilebits.com
Terraforming 1Password
1–10 of 119 posts
Re: Terraforming 1Password
#2I’ve always wondered — from a security perspective, is this kind of an in-depth engineering blogpost a good idea? You’re basically handing a map of your internal infrastructure to any potential attacker who reads the blog.
Of course obscurity is not security blah blah blah. Still I can’t help feeling that writeups like this could backfire down the line.
Re: Terraforming 1Password
#3I’ve always wondered — from a security perspective, is this kind of an in-depth engineering blogpost a good idea? You’re basically handing a map of your internal infrastructure to any potential attacker who reads the blog. Of course obscurity is not security blah blah blah. Still I can’t help feeling that writeups like this could backfire down the line.
On the other hand, you have a team of X employees who work at the company. I'm sure many of them have access to this map.
By sharing this with the world, you are encouraged to face any vulnerabilities that you may have overlooked.
Re: Terraforming 1Password
#4I’ve always wondered — from a security perspective, is this kind of an in-depth engineering blogpost a good idea? You’re basically handing a map of your internal infrastructure to any potential attacker who reads the blog. Of course obscurity is not security blah blah blah. Still I can’t help feeling that writeups like this could backfire down the line.
I imagine the examples are probably fictional. The only thing you know is that they are using AWS.
Re: Terraforming 1Password
#5I’ve always wondered — from a security perspective, is this kind of an in-depth engineering blogpost a good idea? You’re basically handing a map of your internal infrastructure to any potential attacker who reads the blog. Of course obscurity is not security blah blah blah. Still I can’t help feeling that writeups like this could backfire down the line.
On the flipside, being this open might mean that weaknesses come to light because of the increased scrutiny.
It's just like when talking about secure communication, you explain exactly how the public/private key exchange works, what algorithms are used, and how the entire handshake takes place. You don't say "We are keeping those details secret just in case it might aid some hacker".
The added benefit of everybody examining the process and agreeing that it's sound and secure is just too great to give up.
Re: Terraforming 1Password
#6I’ve always wondered — from a security perspective, is this kind of an in-depth engineering blogpost a good idea? You’re basically handing a map of your internal infrastructure to any potential attacker who reads the blog. Of course obscurity is not security blah blah blah. Still I can’t help feeling that writeups like this could backfire down the line.
The map / description in the blog post probably describes about 50% of all the applications running in AWS that I’ve seen, almost identically.
If they listed out security group and IAM configurations, or how exactly they’re connecting through the bastion, then it would be a little more risky, yes.
Re: Terraforming 1Password
#7The code comparison between CloudFormation’s abysmal JSON formatting and Terraform’s DSL is a bit disingenuous.
CloudFormation has supported YAML for at least a year or two now, and it’s leagues more readable and compact, not to mention maintainable—you can even add comments to your code with YAML (something that is impossible with the old JSON format).
I’ve spent a lot of time working between the two, and while Terraform does have a lot to offer and is often a very valid option, CloudFormation has its virtues, especially the fact that almost all bleeding edge AWS features are first available to be managed via CloudFormation (sometimes with weeks or months of lead time), and many bugs can be more readily ironed out with AWS support (assuming you have it).
Again, not saying don’t use Terraform, just that I don’t think the decision is quite as black and white as this blog post seems to make it.
Re: Terraforming 1Password
#8The code comparison between CloudFormation’s abysmal JSON formatting and Terraform’s DSL is a bit disingenuous. CloudFormation has supported YAML for at least a year or two now, and it’s leagues more readable and compact, not to mention maintainable—you can even add comments to your code with YAML (something that is impossible with the old JSON format). I’ve spent a lot of time working between the two, and while Terr…
CloudFormation is really bad compared to TF.
Re: Terraforming 1Password
#9The code comparison between CloudFormation’s abysmal JSON formatting and Terraform’s DSL is a bit disingenuous. CloudFormation has supported YAML for at least a year or two now, and it’s leagues more readable and compact, not to mention maintainable—you can even add comments to your code with YAML (something that is impossible with the old JSON format). I’ve spent a lot of time working between the two, and while Terr…
Personally I find YAML for cloudformation worse than JSON because of the whitespacing requirements. JSON isn't much better mind, especially once your template reaches to hundreds of lines with nested objects.
Recently I've come around to using Troposphere [1] to write cloudformation templates, it's actually very pleasant to use. You just write your infrastructure in python, and it will generate you a template at the end. The developers seem to respond quickly to changes AWS make to the CF templating language too.
Re: Terraforming 1Password
#10would've been easier to just migrate to k8s and used some kind of ignition/managed k8s (and maybe ansible, if things still needs some manual tweaking).