Would be interesting to see those shell scripts for sending SMS via Twilio.
I'm not sure what John is using, but they have a very simple example in their documentation. Go here and then click on "twilio-cli" in the right code type selector:
Interview with CEO of rsync.net: “no firewalls and no routers”
121–130 of 343 posts
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#122A simple layer 2 network topology only works in very narrow use cases (like this one). But a "dumb switch" means you also lose a lot of observability and it's very difficult to apply consistent network acls.
Agreed - we are, in a sense, "cheating" because our product is so simple that we do have one of these "very narrow use cases". The benefits are tremendous, however, and go beyond day to day operations. A dumb switch has no credentials to protect and there is almost zero attack surface. Further, if our switch dies we can immediately replace it with any other dumb switch that just happens to be lying around. If you rea…
This aptly describes why I do not want a smart home even as a tech professional and why I drive a generic Toyota with easily replaceable parts.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#123Earlier quoted context omitted.
"I wonder if they have any sales to large enterprises or similar institutions." Yes, certainly. We frequently fill out very detailed checklists and questionnaires related to our quality policy, standards, internal policies, etc. We're also very honest about how we approach these issues: https://www.rsync.net/resources/regulatory/pci.html ... and they generally appreciate the honesty.
FYI, your "pricing" link at the top of that pci.html page 404's. The pricing link works from other pages however.
I see that that has now been fixed - thanks for pointing it out.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#124Earlier quoted context omitted.
You can 'zfs send' to a (special kind of) rsync.net account. We support encrypted zfs[1][2][3] and raw-send, etc. The pricing is the same but there is a 1TB minimum because we need to give you your own VM (bhyve) and we have to burn an ipv4 address for you, etc. [1] https://www.rsync.net/products/zfs.html [2] https://arstechnica.com/information-technology/2015/12/rsync... [3] https://www.servethehome.com/automating-p…
> The snapshots are immutable (read-only) and cannot be altered in any way. In this way, your rsync.net account protects you from ransomware or malicious parties. Is this still true for these special ZFS enabled accounts?
Not /u/rsync, but I have one of these accounts. The snapshots are immutable (as are all ZFS snapshotss) but you have the ability to run `zfs destroy` on them, so there is a risk there. (When they're doing the snapshots for you, you don't have that ability, but then you just have a filesystem, with no access to the underlying ZFS.)
My solution to the `zfs destroy` risk is to make my backups pull-based, where rsync.net connects inbound to my production server, and rsync.net specifies the necessary commands on the production box to grab the raw encrypted streams. That eliminates the ability of an attacker that is on the production server to run arbitrary commands at rsync.net.
There is still a small risk of data destruction if an attacker gets your rsync.net credentials, but those can be protected via off-line storage and secured workstations, which works pretty well.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#125I used to run Linux for everything but I’m having to use Windows these days. What would it take to get rsync.net playing nicely with windows? I’m imagining Windows subsystem for Linux (ubuntu) with duplicity installed to it? Are there any major hiccups to that sort of setup?
Rsync.net is amazing for Linux servers. For windows servers backups are complex and expensive. I tend to offload that to a cloud provider like Azure. Onsite I rotate hard drives. But for desktop users backblaze does everything I need.
If anyone has a recommendation for backing up Windows servers I'd love to hear it.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#126Earlier quoted context omitted.
Agreed - we are, in a sense, "cheating" because our product is so simple that we do have one of these "very narrow use cases". The benefits are tremendous, however, and go beyond day to day operations. A dumb switch has no credentials to protect and there is almost zero attack surface. Further, if our switch dies we can immediately replace it with any other dumb switch that just happens to be lying around. If you rea…
How are you providing network level redundancy with dumb switches? My only guess is that the ISP is already doing HSRP/VRRP on the gateway and you can setup multiple NICs/switches with something like CARP and being careful not to make L2 loops.
Why would they need nework-level redundancy? This is a backup service, and should not have production load on it at any time. I'd rather see a system with a dumb switch and the risk of a 3-4 hour outage if it fails than a smart switch that can then be cracked. (Even then, 3-4 hours is a stretch, as all the remote hands has to do to replace a failed switch is put in any other dumb switch.)
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#127I wonder if they have any sales to large enterprises or similar institutions. In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the pa…
> In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the particular product/service/vendor in question.
And in many cases on the vendor side its some dude from sales filling it out... so pretty noisey on both ends.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#128I wonder if they have any sales to large enterprises or similar institutions. In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the pa…
> In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today,...
They may be even aware, they are just bound by their companys ruleset...
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#129This was maybe the first service I see that was somewhat complex, but the 4 line main page header text clearly explained what the tool does - the subpages are also great, low-key, great reads. Kudos to whoever copywrote the site.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#130Earlier quoted context omitted.
The only "security risk" i see there is number 1, and that is all to do with physical security. > Disadvantage #1 – Open ports on unmanaged switches are a security risk Why? Is there something that would prevent an attacker with physical access from unplugging an existing cable? Does the average managed switch config have mac limits and auto shutdown if a link is lost for just a few seconds? Mac limits are easilly by…
802.1x is trivially proxied anyway, unless you don't reconnect when the link is lost. So an attacker with physical access is going to be able to inspect your packets regardless.
The beauty of SSH-only is that you can assume that all of your traffic is being inspected all the time, but you have a protection against that: ssh-encryption and key fingerprints.
If you wanted to confirm ssh host-key validity, I'm sure rsync.net would perform an out-of-band verification. When they emailed me a request to do some server maintenance, I asked for a verification, and they placed a GPG-signed confirmation on their web-server for me to verify.