Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Moves Its Corporate Applications to the Internet

blogs.wsj.com

Post reply on HN
Print view View original

61–70 of 155 posts

Re: Google Moves Its Corporate Applications to the Internet

#61

Post by walshemj »

beachstartup wrote: post #39
mahyarm wrote: post #36

Earlier quoted context omitted.

Communication and management overhead of remote workers is harder to do right. Like functional programming.

with modern software, it's only hard to do right if they're not at their laptop/workstation. which means they're doing some other shit other than working. our entire team is remote. it's really obvious when someone isn't at their computer. it's basically the only hard requirement of the job beyond the work product - be at your computer when you say you are going to be at your computer.

Really? some times the crucial part of the job is done away from the computer.

I remember doing a quick fix for one of the attractions at the melenium dome - the core part of the work was working out on paper all the permutations and what should happen the coding at a terminal was the trivial part.

BTW the program correctly run first time and was delivered in less than a day.

Re: Google Moves Its Corporate Applications to the Internet

#62

Post by grantlmiller »

This brings up a few questions: 1) Does Google not use the same publicly hosted version of Google Apps that we all use? 2) Does this only work with privately hosted versions of applications? 3) Are they using the publicly hosted version of Google Auth for the authentication piece? 4) Is the Device Inventory Database hosted on a public machine or is that deployed to a private network? 5) digging into the white paper that provides a bit more information on how they're actually doing this… does anyone care to take a crack at explaining what this means? "BeyondCorp defines and deploys an unprivileged network that very closely resembles an external network, although within a private address space. The unprivileged network only connects to the Internet, limited infrastructure services (e.g., DNS, DHCP, and NTP), and configuration management systems such as Puppet.” (full white paper published by google available here: http://static.googleusercontent.com/media/research.google.co...)

Re: Google Moves Its Corporate Applications to the Internet

#63

Post by istvan__ »

ceejayoz wrote: post #56
istvan__ wrote: post #32

Earlier quoted context omitted.

The only way to succeed with this is with heavy firewalling or VPNs. There are several unknown zero days in any application so just by opening up your application to 0.0.0.0/0 makes it possible for blackhats to get in. The only question is how much your information is worth for somebody. If you it is less than price of a brand new zero day you might be ok, but there are still the script kiddies and political blackhat…

> There are several unknown zero days in any application Does this include the firewall and VPN?

no, I am more specifically talking about the hosted application. There can be security bugs in the firewall or VPN as well, I was focusing on purely what is the difference between hosting a vulnerable application on a local IP vs. a public one.

Re: Google Moves Its Corporate Applications to the Internet

#64

Post by istvan__ »

rixed wrote: post #49
istvan__ wrote: post #32

Earlier quoted context omitted.

The only way to succeed with this is with heavy firewalling or VPNs. There are several unknown zero days in any application so just by opening up your application to 0.0.0.0/0 makes it possible for blackhats to get in. The only question is how much your information is worth for somebody. If you it is less than price of a brand new zero day you might be ok, but there are still the script kiddies and political blackhat…

> There are several unknown zero days in any application I think you want all your applications to authenticate the device and the user before proceeding to anything. This looks indeed impossible with third party closed source apps (if only because you can never be sure there is no backdoor). Then, even if you authenticate every remote peers using TLS client certificates, you have to follow closely the vulnerabilitie…

I am not sure how the open source vs. closed source plays any role in this. You can support a feature with a closed source app as much as you can with an open source.

TLS implementations having serious problems as the last few years proved it. We need a more fundamental change in security protocols and implementations, using reliable crypto (for example elliptic curve cryptography) and implementing them in safer languages (like Rust).

Re: Google Moves Its Corporate Applications to the Internet

#65

Post by mbreese »

One interesting question is: how many companies have enough public IP addresses to publish their applications to the internet? If you assume that there are multiple services and each one is hosted on their own server (or server farm), then you'd need many more public IP addresses. When we live in a world that is severely lacking free IPv4 space, how feasible is this? Or is this just a matter of pushing things from 10.0.0.0/8 land to IPv6 addresses? How many locally developed enterprise apps have good enough security to be put on a public facing site and have good IPv6 support?

I applaud the idea and the effect of forcing security to be dealt with. But I don't know how feasible it is for corporations without their own B or C blocks.

Re: Google Moves Its Corporate Applications to the Internet

#66

Post by colechristensen »

mbreese wrote: post #65

One interesting question is: how many companies have enough public IP addresses to publish their applications to the internet? If you assume that there are multiple services and each one is hosted on their own server (or server farm), then you'd need many more public IP addresses. When we live in a world that is severely lacking free IPv4 space, how feasible is this? Or is this just a matter of pushing things from 10…

If it's http, it doesn't matter much. You can put a thousand different sites on one (or probably a few) IP and have a load balancer distribute the requests to the appropriate set of backend servers.

Re: Google Moves Its Corporate Applications to the Internet

#67

Post by ocdtrekkie »

mynameisvlad wrote: post #54
NovaS1X wrote: post #44

"The Cloud" that they're talking about is their own datacenters (they're certianly not using EC2) and they're hosting their web-apps over a WAN without VPNs or other traditional forms of closing off access. However, this doesn't say much about their datacenters which will still be heavily firewalled. IPMI, SSH, and other access wouldn't be shared over a wide open WAN. The "Cloud" (see: datacenter) LAN will still be p…

I mean, of course it's their own datacenters. They're not going to be putting their corporate data in a competitor's data center. That said, they could be leveraging new things in their Google App Engine cloud, which would actually make it "the cloud" as people refer to it.

The funny thing is, they expect everyone else to put their corporate data in their datacenters! Google has an extremely one-sided view of where data should go. (In all cases, directly to their servers.)

Re: Google Moves Its Corporate Applications to the Internet

#69

Post by zenbowman »

passive wrote: post #20

As a remote worker, it's delightful to see things move in this direction, as VPNs are a regular thorn in my side. Of course, there's a certain irony that Google isn't fond of remote workers. :)

It isn't just corporations that are not fond of remote work. As a lay-employee, I am not fond of remote work either. I would much rather have all my teammates in the same room.

Tribal? Yes, unapologetically so.

Re: Google Moves Its Corporate Applications to the Internet

#70

Post by praneshp »

munificent wrote: post #22
passive wrote: post #20

As a remote worker, it's delightful to see things move in this direction, as VPNs are a regular thorn in my side. Of course, there's a certain irony that Google isn't fond of remote workers. :)

Google doesn't like workers who always work remotely, but periodically working from home (or the bus, or hotel, or coffeeshop, or the lobby at the auto mechanic, etc.) for a day is common for all employees.

That is the same policy that my $BIG_INTERNET_CORP_WITH_FEMALE_CEO copped a lot of flak for because of the news being mis-reported by the media.
Post reply on HN