Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Alien – Self-hosting with remote management (written in Rust)

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 51 posts

Re: Show HN: Alien – Self-hosting with remote management (written in Rust)

#11

Post by nickmonad »

> So you're stuck debugging a system you don't control, through screenshots and copy-pasted logs on a Zoom call.

This is very real.

I work with a deployment that operates in this fashion. Although unfortunately, we can't maintain _any_ connection back to our servers. Pull or push, doesn't matter.

The goal right now is to build out tooling to export logs and telemetry data from an environment, such that a customer could trigger that export on our request, or (ideally) as part of the support ticketing process. Then our engineers can analyze async. This can be a ton of data though, so we're trying to figure out what to compress and how. We also have the challenge of figuring out how to scrub logs of any potentially sensitive information. Even IDs, file names, etc that only matter to customers.

Re: Show HN: Alien – Self-hosting with remote management (written in Rust)

#12

Post by jcgrillo »

nickmonad wrote: post #11

> So you're stuck debugging a system you don't control, through screenshots and copy-pasted logs on a Zoom call. This is very real. I work with a deployment that operates in this fashion. Although unfortunately, we can't maintain _any_ connection back to our servers. Pull or push, doesn't matter. The goal right now is to build out tooling to export logs and telemetry data from an environment, such that a customer cou…

> This can be a ton of data though, so we're trying to figure out what to compress and how. We also have the challenge of figuring out how to scrub logs of any potentially sensitive information.

This is fundamentally a data modeling problem. Currently computer telemetry data are just little bags of utf-8 bytes, or at best something like list>. IMO this needs to change from the ground up. Logging libraries should emit structured data, conforming to a user supplied schema. Not some open-ended schema that tries to be everything to everyone. Then it's easy to solve both problems--each field is a typed column which can be compressed optimally, and marking a field as "safe" is something encoded in its type. So upon export, only the safe fields make it off the box, or out of the VPC, or whatever--note you can have a richer ACL structure than just "safe yes/no".

I applaud the industry for trying so hard for so long to make everything backwards compatible with the unstructured bytes base case, but I'm not sure that's ever really been the right north star.

Re: Show HN: Alien – Self-hosting with remote management (written in Rust)

#13

Post by nodesocket »

nickmonad wrote: post #11

> So you're stuck debugging a system you don't control, through screenshots and copy-pasted logs on a Zoom call. This is very real. I work with a deployment that operates in this fashion. Although unfortunately, we can't maintain _any_ connection back to our servers. Pull or push, doesn't matter. The goal right now is to build out tooling to export logs and telemetry data from an environment, such that a customer cou…

I also used to work with on-premise installs of Kubernetes and their “security” postures prevented any in-bound access. It was a painful process of requesting access, getting on a zoom call and then controlling their screen via a Windows client and putty. It’s was beyond painful and frustrating. I tried to pitch using a tool like Twingate which doesn’t open any inbound ports, can be locked down very tight using SSO, 2fa, access control rules, and IP limiting but to no avail. They were stuck in their Windows based IT mentally.

Re: Show HN: Alien – Self-hosting with remote management (written in Rust)

#14

Post by OlivOnTech »

alongub wrote: post #10
antonvs wrote: post #8

I worked for a few years on an on-premise deployment of a system that was otherwise SaaS. Many enterprise customers simply won’t allow something like this - particularly big financials, aviation, healthcare etc. Realistically, the game ends up being - see what you can get away with until someone notices. Given that, you might want to rename the product to something more boring than “Alien”.

In practice, unmanaged self-hosting is often less secure, because you end up with outdated versions, unpatched vulnerabilities, and no one responsible for keeping things healthy. More and more enterprise CISOs are starting to understand this. The model here is closer to what companies like Databricks already do inside highly regulated environments. It's not new... it's just becoming more structured and accessible to…

I don't agree, I see supply chains attacks as a bigger risk than outdated systems exposed only in the lan.

Re: Show HN: Alien – Self-hosting with remote management (written in Rust)

#15

Post by alongub »

nickmonad wrote: post #11

> So you're stuck debugging a system you don't control, through screenshots and copy-pasted logs on a Zoom call. This is very real. I work with a deployment that operates in this fashion. Although unfortunately, we can't maintain _any_ connection back to our servers. Pull or push, doesn't matter. The goal right now is to build out tooling to export logs and telemetry data from an environment, such that a customer cou…

> Although unfortunately, we can't maintain _any_ connection back to our servers. Pull or push, doesn't matter.

We're working on something for this! Stay tuned.

Re: Show HN: Alien – Self-hosting with remote management (written in Rust)

#16

Post by alongub »

OlivOnTech wrote: post #14
alongub wrote: post #10

Earlier quoted context omitted.

In practice, unmanaged self-hosting is often less secure, because you end up with outdated versions, unpatched vulnerabilities, and no one responsible for keeping things healthy. More and more enterprise CISOs are starting to understand this. The model here is closer to what companies like Databricks already do inside highly regulated environments. It's not new... it's just becoming more structured and accessible to…

I don't agree, I see supply chains attacks as a bigger risk than outdated systems exposed only in the lan.

Both are real risks. But supply chain attacks exist whether you self-host or not... you're still running the vendor's code either way. The question is whether you also want that code to stay up to date and properly managed, or drift silently.

Re: Show HN: Alien – Self-hosting with remote management (written in Rust)

#17

Post by alongub »

nodesocket wrote: post #13
nickmonad wrote: post #11

> So you're stuck debugging a system you don't control, through screenshots and copy-pasted logs on a Zoom call. This is very real. I work with a deployment that operates in this fashion. Although unfortunately, we can't maintain _any_ connection back to our servers. Pull or push, doesn't matter. The goal right now is to build out tooling to export logs and telemetry data from an environment, such that a customer cou…

I also used to work with on-premise installs of Kubernetes and their “security” postures prevented any in-bound access. It was a painful process of requesting access, getting on a zoom call and then controlling their screen via a Windows client and putty. It’s was beyond painful and frustrating. I tried to pitch using a tool like Twingate which doesn’t open any inbound ports, can be locked down very tight using SSO,…

At least they didn't ask you to TeamViewer into a Windows Server 2012 box and open Event Viewer..

Re: Show HN: Alien – Self-hosting with remote management (written in Rust)

#18

Post by nickmonad »

alongub wrote: post #16
OlivOnTech wrote: post #14

Earlier quoted context omitted.

I don't agree, I see supply chains attacks as a bigger risk than outdated systems exposed only in the lan.

Both are real risks. But supply chain attacks exist whether you self-host or not... you're still running the vendor's code either way. The question is whether you also want that code to stay up to date and properly managed, or drift silently.

I agree that keeping things up to date is a good practice, and it would be nice if enterprise CISOs would get on board with that. One challenge we've seen is that other aspects of the business don't want things to be updated automatically, in the same way a fully-managed SaaS would be. This is especially true if the product sits in a revenue generation stream. We deal with "customer XYZ is going to update to version 23 next Tuesday at 6pm eastern" all the time.

Re: Show HN: Alien – Self-hosting with remote management (written in Rust)

#20

Post by alongub »

nickmonad wrote: post #18
alongub wrote: post #16

Earlier quoted context omitted.

Both are real risks. But supply chain attacks exist whether you self-host or not... you're still running the vendor's code either way. The question is whether you also want that code to stay up to date and properly managed, or drift silently.

I agree that keeping things up to date is a good practice, and it would be nice if enterprise CISOs would get on board with that. One challenge we've seen is that other aspects of the business don't want things to be updated automatically, in the same way a fully-managed SaaS would be. This is especially true if the product sits in a revenue generation stream. We deal with "customer XYZ is going to update to version…

This is true even with fully-managed SaaS though. There are always users who don't want the new UI, the changed workflow, the moved button. But the update mechanism isn't really the problem IMO, feature flags and gradual rollouts solve this much better than version pinning
Post reply on HN