131–140 of 158 posts
So, how do I make sure my connection isn't MITM-ed? There is no server host key anywhere to compare. No CA certificate support. Doesn't look like ed25519 is supported either. Somehow people don't use self-signed certificates all over the web but for sftp it's "fine" apparently.
An alternative to doing file based SFTP is to just treat SFTP like an API. A company I work for implemented an SFTP service where every operation simply translates to some SQL DB lookup. And a file download kicks off a larger SQL query and generates the report on the fly, streaming the result straight through to the SFTP client. Works great! SFTP can be an API just like HTTP. Under the hood the protocol is reasonably…
What if you open an SFTP handle, and then write 5 bytes halfway through a 20 GB file and close the handle? How do you translate that?
There are a handful of services out there that do this, I know because I've needed it on multiple occasions. It's nice that Amazon is providing it in house now, but it just reminds of me the last time I went to re:invent and walked through the vendor area and thought about how many of these companies are four dev cycles away from Amazon producing a baked in competitor. Hard to make a B To B Amazon tool these days.
So, how do I make sure my connection isn't MITM-ed? There is no server host key anywhere to compare. No CA certificate support. Doesn't look like ed25519 is supported either. Somehow people don't use self-signed certificates all over the web but for sftp it's "fine" apparently.
Charged by the hour... pay for an instance.. Tsk tsk.. The thing I love about S3 and cloud services in general is when I pay per request and can scale through the roof. Whenever a services is meter by number of instances my interest fades, and I look for other solutions.. S3 has this very handsoff feeling to it :)
AWS should investigate a new concept called serverless.
So, how do I make sure my connection isn't MITM-ed? There is no server host key anywhere to compare. No CA certificate support. Doesn't look like ed25519 is supported either. Somehow people don't use self-signed certificates all over the web but for sftp it's "fine" apparently.
For SSH (+SFTP) you are expected/obligated/etc. to have some way to verify the correct host key. There is no relationship to the clusterfudge of public CAs. Nor are there x509 certs.
Earlier quoted context omitted.
Can you elaborate? I mean a plain CentOS server running SFTP, S3FS seems about as set and forget as it gets. And each? Surely chrooting users would let you consolidate all of those servers into one (or one cluster for HA I suppose).
> Can you elaborate? I mean a plain CentOS server running SFTP, S3FS seems about as set and forget as it gets. Think about the operational costs: someone needs to manage keys, logging, security updates, when S3FS coughs a lung and hangs you need to catch that problem and remount it to restore service, etc. This service reuses the existing authentication systems so you don't need to spend time configuring and managing…
We're more interested in what happens when things break (and who's responsibility it is) than minor cost savings in calm waters.
Earlier quoted context omitted.
Nothing beefy, probably, but as for HIPAA compliance, AFAIK, you need to sign several specific contracts with your provider and blahblahblah, probably they're just billing you for the incovenience and for having the HIPAA seal. "I'm HIPAA, the rest aren't, just pay for it".
You have to sign a single business associate agreement (BAA) depending on the nature of the business you are working with. These are usually boilerplate contracts around 2-3 pages long and full of legalese. It is uncommon for someone to charge you for signing a BAA. It is very common to tie these plans into enterprise only pricing. This is terrible because it adds unnecessary costs to the medical system (which get pa…
"Pricing for Box Enterprise or Elite plans as well as the DICOM Viewer additional seat surcharge can be handled by our Box sales team once we know how many seats your are looking for across your company and what types of collaboration use cases you need. "
Earlier quoted context omitted.
I don't know about comically easy, but should be doable to have some sort of shared frontend. $214 (even $100) is a really beefy vm, though. I wonder whats provisioned and why.
Nothing beefy, probably, but as for HIPAA compliance, AFAIK, you need to sign several specific contracts with your provider and blahblahblah, probably they're just billing you for the incovenience and for having the HIPAA seal. "I'm HIPAA, the rest aren't, just pay for it".
“HIPAA seals”, which several vendors offer, are mostly BS and have no actual meaning under HIPAA.
I don't think any big vendor has them (Google's HIPAA page explicitly notes that no certifications are recognized by the government.)
The price is quite high for small projects though: $0.30/hour > $216/m > $2592/y