Remote access to production infrastructure (death to the VPN)
mattslifebytes.com
Remote access to production infrastructure (death to the VPN)
1–10 of 120 posts
Re: Remote access to production infrastructure (death to the VPN)
#2Hey Matt. I appreciate images in articles, but GIFs are very distracting while trying to read. May I suggest static images next time?
Re: Remote access to production infrastructure (death to the VPN)
#3Hey Matt. I appreciate images in articles, but GIFs are very distracting while trying to read. May I suggest static images next time?
[deleted]
Re: Remote access to production infrastructure (death to the VPN)
#4Hey Matt. I appreciate images in articles, but GIFs are very distracting while trying to read. May I suggest static images next time?
I second this. I had to zoom way in so I could scroll between the animations for undisturbed reading.
Re: Remote access to production infrastructure (death to the VPN)
#5The critique against VPNs is exactly right, they're such garbage compared to the standard we otherwise hold SSH, TLS etc to, and the access granularity is too wide, and there's no transparency on how wide the access is configured from VPNs. And they're very often on the wrong side of the it dept vs devops responsibility split so often misconfigured.
Re: Remote access to production infrastructure (death to the VPN)
#6> One of my biggest pet peeves about VPNs is that they hijack all your network traffic. They can be configured not to, but our customers and security controls like NIST 800-53 SC-7(7) typically require that they do.
VPN is dead because some customers want you to route the internet interfaces of all machines through the VPN server.
How does this even make any sense?
Re: Remote access to production infrastructure (death to the VPN)
#7Hey Matt. I appreciate images in articles, but GIFs are very distracting while trying to read. May I suggest static images next time?
This article actually got me to go track down the firefox pref "image.animation_mode". "none" is a very nice choice.
Re: Remote access to production infrastructure (death to the VPN)
#8Hey Matt. I appreciate images in articles, but GIFs are very distracting while trying to read. May I suggest static images next time?
Thanks all for your feedback. I have removed the images to improve readability, especially for mobile users. The post was originally written for an internal blog where we have a GIF-heavy communication culture, and I probably should have cleaned it up a bit more for general public consumption.
Re: Remote access to production infrastructure (death to the VPN)
#9> One of my biggest pet peeves about VPNs is that they hijack all your network traffic. They can be configured not to, but our customers and security controls like NIST 800-53 SC-7(7) typically require that they do. VPN is dead because some customers want you to route the internet interfaces of all machines through the VPN server. How does this even make any sense?
As I alluded to in the post, it's a legacy viewpoint. These customers hand you a 300+ security questionnaire that hasn't been updated in 10 years. When you tick the 'VPN' boxes, alarms sound, but they are thinking about the term 'VPN' in a different context, like employees accessing a network file share. But what we really have is a Bastion host (aka jump box), which is fundamentally different. By not saying you run VPN software, the conversations shift significantly, especially when dealing with the F100 banks and the like that may not be as familiar with modern cloud architectures.
Re: Remote access to production infrastructure (death to the VPN)
#10Agree on VPNs. They need to die.
Let elect ZeroTier to be the president of remote, secure access :)