121–130 of 148 posts
Earlier quoted context omitted.
I don't think this is the bottomless pit that you think it is. A virtualised instance is a lot more secure than a container, and it's probably fine to stop at virtualised instances.
A lot more secure? In what ways?
One day I would love to see what having 2.000 microservices entails. Which features each service covers. I can't think of 2.000 micro services an online bank would have.
Disgruntled former Monzo customer here. Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? It's happened to countless users and the customer experience when they do it ("we refuse to tell you why" and in some cases holding onto their money for months) is a kafkaesque nightmare. https://www.vice.com/en/article/bvg7n3/monzo-freezing-closin... https://www.reddit.com/r/U…
Switched to Starling instead and created one instantly.
Earlier quoted context omitted.
> "Exactly. containers are not secure sandboxes by default and if one is breached all those K8s networking ACLs are worthless." Your suggestion being? Putting a sandbox inside a sandbox? How many layers deep should this be, before being considered "secure"?
Most serious security teams do not consider containers a security boundary. So it’s not a sandbox inside a sandbox, it’s just a sandbox. Gvisor and firecracker are the most popular sandboxes for containerized workloads.
How good of a boundary it is may be another story. There's some seccomp filters going on and namespacing is pretty sweet too.
But an attacker can escape by exploiting the kernel, which I think most security people would consider to be not particularly high effort.
So, suitable for internal services that you generally trust, not suitable for hostile code or highly exposed services. In an ideal world maybe we'd all use Firecracker but it's not nearly as easy to do that vs just putting something in a container.
Earlier quoted context omitted.
A lot more secure? In what ways?
Developers working with docker are almost always in the 'docker' group on their local machine, which is functionally equivalent to running everything as root.
Earlier quoted context omitted.
The only meaningful difference between breaking out of a process-isolated "container" and a full-blown VM is what's waiting for you outside once you've broken out. Whether it's kernel/OS or a bare metal hypervisor isn't really all that meaningful: exploits and vulnerabilities exist for either. There should be proper hardware-level isolation here, depending on the scenario. Most cloud companies can't afford that thoug…
Genuinely, would you be happy with just container isolation between you and other customers of your cloud provider? Most people absolutely would not.
But that's exactly how VPS hosting works today - you don't get your own private blade unless you're ready to pay premium prices and have the competence needed to run them yourself. The technicalities of how private resources in a VPS are isolated from each other will differ, but the concept remains the same nonetheless.
People bite the bullet, only to be subject to things like rowhammer [1], or other container escape scenarios [2].
The top comment in this thread reflects the proper way of dealing with this: containers or sandboxes are may not be treated as a secure boundary.
[1] https://www.usenix.org/conference/usenixsecurity16/technical...
[2] https://www.intezer.com/blog/research/how-we-escaped-docker-...
I think it's great that more companies are open about what they are doing for security. It makes it sound like they are confident in their abilities unlike other people who are nervous to mention things like "We use Octopus" or "We use AKS" because we are less confident that the information is not an invitation to a hacker! Now all we need is to somehow capture some of this "best practice" and make it normal practice…
One reason why companies would not do this is to give a little bit of protection against zero-days. When a zero-day is released all providers notice a huge scan for the vulnerability. Scanning huge blocks of the internet takes time but if a hacker has a list of companies using which tools and where it can be narrowed down a lot. AWS/Azure/GCP/... for example have published IP-ranges of services. If a zero-day for any…
> more than 20,000 containerised workloads across more than 2000 microservices to date. This is insane . What am I missing here that an organization is bragging about having 2000 moving parts?
I can imagine 2000 microservices being rather low for a bank.
Earlier quoted context omitted.
Others replying here are jumping to conclusions. A frozen account could be due to any number of things. The customer service person may or may not have access to the reasons. In any case, it might be money laundering (from the bank’s perspective), therefore they can’t tell you anything. Of course this is ridiculous. Due process should exist, even when a private organization “accuses” someone of illegal activity.
It’s definitely their anti money laundering (AML) detection system kicking in. However it’s clearly getting false positives and their internal AML team is getting hit with a high amount of them thus causing the delays in resolving them. This is why you don’t build your own solutions to well solved problems.
There should be a penalty for this. When "innocent" users are denied access to their money, those actions are much more felt by the user than the bank. That user's money is a rounding error to a bank, but to the user it is everything.
An incorrectly frozen account should come with some sort of "oops we're sorry" type of something that a bank can understand: monetary reward for the user.
I would rather criminals get away with a laundering transaction than me not being able to buy/pay for something in my day to day because of some dumbass AI algo.
Earlier quoted context omitted.
> Do they still have a haywire fraud detection system that randomly freezes innocent people's accounts? I As others have pointed out already, AML/KYC laws are strict. They are strict in general for financial services, but for banks, because of their privileged position in the financial system, its even stricter. But there is a second aspect which is that challenger banks such as Monzo take an even more cookie-cutter…
Is it Andrews & Arnold? I remember their director blogging about moving the business to Monzo so they can get real-time webhooks for incoming payments. I've just checked and they still appear to be using Monzo as per their "bank details" page.
Nope, not them. I'm surprised they haven't been frozen given Monzo's stated policy[1]:
"Certain industries have higher risks, where we need to put extra checks and controls in place. We’re currently focusing on industries that don’t need these. In future, we might offer accounts to some of these industries. But we appreciate this is disappointing for some businesses at the moment."
Followed by a long list that includes "technology equipment, like lasers or telecommunications"
(For those wondering, telecoms wasn't there at the time the other guys had an account, and they were not selling equipment anyway)