Live data from Hacker News

Interview with CEO of rsync.net: “no firewalls and no routers”

console.dev

141–150 of 343 posts

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#141
post #48

I wonder if they have any sales to large enterprises or similar institutions. In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the pa…

Anything is possible if you are willing to get a little dirty and negotiate with other humans.

We initially had some troubles navigating these waters in the financial sector, but once we were able to convince 1 big customer to try our system on a trial basis, everyone else started to play along really nicely. No one wants to be the first one to try a new thing and get burned by it.

In 2021, you can sometimes leverage things like technological FOMO to make a business owner believe that they are going to lose out on future business value relative to competition, who you might frame as be willing to take on a bigger technological risk. And indeed, smaller clients in our industry are willing to overlook certain audit points (at least temporarily) in order to compete with bigger players.

Some might not like it, but being able to engage in the sales process and bend some rules occasionally is absolutely required to play in the big leagues. Once you are in, it's a lot easier to move around. No one has a perfect solution and everyone knows it. It's just a matter of who is the better sales person at a certain point.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#142
You write down that you have no router, though your primary US location is connected to a "quintuple-homed network" and all global locations are at least triple-homed.

What does that mean exactly? Is your IP provider quintuple-homed? Or are you running a bit more complicated setup than you explain but the gist is that you have no particular routing mechanisms?

What does that say regarding your high availability? If one of your location is down, then it's definitely down until being fixed?

Anyway, that was interesting, just curious about the fact of having no router at all. Thanks!

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#143

@rsync If you had to do it all over again, what would you do different (if anything)? E.g. product/positioning/tech-stack/employees/business-decisions

That's a really good question ...

In terms of product / tech-stack I don't think I would change anything.

In terms of marketing and word of mouth I think we should have given away hundreds of free accounts in the early years (2006-2010) rather than trying to chase them down as paying customers. I believe we had a lot of decent word of mouth but I don't think I appreciated the power of influencers and their ability to amplify a message.

As for business decisions, I continue to wonder how much business we miss due to not having a Canadian location and we have considered deploying in Montreal for years now but have not pulled the trigger. I don't know if a Canadian location (but still a US company) solves the regulatory requirements of Canadian customers.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#144

Earlier quoted context omitted.

> including the backups coming in from customers. Which are encrypted in flight...if they aren't then anyone on the 30 machines between customer and final destination can also see the backups coming in from customers.

True, but the packets in-flight can take different routes. If you have a machine on the switch, you know you've captured all the packets that were in-flight. This make it easier to break the encrypted packets. It's a choice--everything in security is a risk-management assessment, but I'm surprised rsync.net was able to get so many security certifications with this setup.

# tcpdump -i eth0

tcpdump: eth0: You don't have permission to capture on that device

(socket: Operation not permitted)

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#145

Earlier quoted context omitted.

I used to (late 2000s) work for a tiny, tiny company that was courting a customer in the mobile banking space. They wanted us to tick boxes. So we bought a box (some sort of Fortinet) that said it was a firewall and IDS. Plugged it in, used it as our new router. "Cost of doing business." Could we have argued with them during the sales process? Only if we wanted to lose the sale. The Fortinet was cheap compared to the…

And you can update it at its own rhythm, potentially different from your upgrade path. And you can make them tls-end for you. Your customer might even have 3000 of those and already know how to keep them happy running. Not so bad.

> And you can make them tls-end for you.

Nothing says end-to-end security like terminating TLS at a network choke point so intruders can easily snoop all traffic.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#146

I think they need to hire someone that is strong on the security side of the business, for two reasons: * he appears not aware of the role of hardware firewalls in mitigating DDoS by handling efficiently a lot of active TCP sessions (they have specialised hardware for this purpose) * he is describing in great detail a lot of information that a phisher or other type of hacker can treasure to target him

You cant protect from a DDoS with a hardware firewall, a DDoS consists of so much bandwidth that your network hardware is not able to simply handle the incoming traffic before any filtering happens. Your expensive hardware firewall can protect from DoS attacks, but they don‘t happen anymore as DDoS attacks are really cheap.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#147

Earlier quoted context omitted.

I'm not sure what John is using, but they have a very simple example in their documentation. Go here and then click on "twilio-cli" in the right code type selector: https://www.twilio.com/docs/sms/send-messages

Note that twilio-cli is a totally over-weight, un-necessarily complicated node.js app. If you just want to send SMS from the command line, the curl code is much, much cleaner.

I have not used twilio-cli for anything ... I just write my own scripts with curl - here is my basic 'sms' command:

https://0x.co/6K37UZ

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#148
post #146

I think they need to hire someone that is strong on the security side of the business, for two reasons: * he appears not aware of the role of hardware firewalls in mitigating DDoS by handling efficiently a lot of active TCP sessions (they have specialised hardware for this purpose) * he is describing in great detail a lot of information that a phisher or other type of hacker can treasure to target him

You cant protect from a DDoS with a hardware firewall, a DDoS consists of so much bandwidth that your network hardware is not able to simply handle the incoming traffic before any filtering happens. Your expensive hardware firewall can protect from DoS attacks, but they don‘t happen anymore as DDoS attacks are really cheap.

Can you can protect yourself from certain types of things (SYNC flood) with a firewall, though.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#149
post #97

Earlier quoted context omitted.

I used to (late 2000s) work for a tiny, tiny company that was courting a customer in the mobile banking space. They wanted us to tick boxes. So we bought a box (some sort of Fortinet) that said it was a firewall and IDS. Plugged it in, used it as our new router. "Cost of doing business." Could we have argued with them during the sales process? Only if we wanted to lose the sale. The Fortinet was cheap compared to the…

Cost of doing business, or ... introducing new Fortinet vulnerabilities into your infrastructure? I know you mentioned 2000s, but it's funny that these contractually obligated boxes might introduce more worry: https://www.bleepingcomputer.com/news/security/fortinet-fixe...

Which is exactly what Kozubik was talking about!
Post reply on HN