151–160 of 202 posts
> but it takes 45 steps in the console and 12 of them are highly confusing if you never did it before. I am constantly amazed that software engineering is as difficult as it is in ways like this. Half the time I just figure I'm an idiot because no one else is struggling with the same things but I probably just don't notice when they are.
>Truly serverless >The beauty of this is that a lot of the configuration stuff goes away magically. The competitive advantage of most startups is to deliver business value through business logic, not capacity planning and capacity management! Is this exactly what cloudflare's workers is doing? [0] I love the fact that I only need to think of the business logic. Development without the need for VMs and obscure configu…
Cloudflare recently announced database partners. Higher-level options for storage and especially streaming would be welcome improvements to me. Macrometa covers a lot of ground but sadly it seems like you need to be on their enterprise tier to use the interesting parts that don't overlap with KV/DO, such as streams. [0]
I played with recently launched support for ES modules and custom builds in Wrangler/Cloudflare Workers the other day together with ClojureScript and found the experience quite delightful. [1]
[0]: https://blog.cloudflare.com/partnership-announcement-db/
[1]: https://dev.to/pilt/clojurescript-on-cloudflare-workers-2d9g
Earlier quoted context omitted.
> "you're not allowed to like the NAT" Well, the bigger question might be why do they like NAT? If it's about having a single /128 address so they can do ACLs then that's easily fixed by just lowering the CIDR number. (unless you have an ancient version of fortigate on prem, which likely doesn't work with ipv6 anyway). If it's about not having things poking at your servers through the NAT then the "NAT" really isn't…
Again: "you're doing it wrong" and "you're not allowed to like the NAT" are not valid criticisms. People like NAT because it's an easy batteries-included way to manage, secure and understand your LAN. Taking it away and forcing them to migrate to an incompatible zoo of firewall technologies for no benefit is asinine. > They're just sold to consumers as a single package. Exactly. How in the world is this a bad thing n…
Personally I think this is much easier to reason about.
And all I'm saying is that the NAT part of it absolutely does nothing to defend you, it's trivially defeated, people just conflate the two.
Virtualization eventually will be seen as the unnecessary layer added to make up for operating systems that lack capability based security. It's going to take a decade to refactor things to remove that layer. Once done, you'll be able to safely run a process against a list of resources.
It already exists in the IBM mainframe. But nobody wants to write apps for it..
Virtualization eventually will be seen as the unnecessary layer added to make up for operating systems that lack capability based security. It's going to take a decade to refactor things to remove that layer. Once done, you'll be able to safely run a process against a list of resources.
Virtualization, no. A hypervisor running a Windows kernel and a Linux kernel side by side is not about capability-based security. You can even see it like cap-based security approach: VMs only see what the hypervisor gave them, and have no way to refer to anything that the hypervisor did not pass to them. Containers , yes. They are a pure namespacing trick, and can be replaces by cap-based security completely.
Earlier quoted context omitted.
What I find common is people conflate NAT with stateful firewalling, and believe that if you lose NAT you lose all forms of edge/perimeter network security. They don't understand that you can still filter and prevent unwanted packets from reaching hosts without NAT.
Of course you can. But why would you? You're replacing something that is simple, easy to understand and works perfectly well with a nebulous something that invites user error and security nightmares. For example, my (modest) home LAN is five routers, a NAS/media server, a media player, two "smart TVs" and dozens of notebooks and phones connected via Wi-Fi. What do you propose? Manage a firewall on each of those devic…
Earlier quoted context omitted.
> but test talks to all production business systems too I'm not sure I understand this, would you mind explaining more? Do you mean you have multi-tenancy in databases and application (the "tenants" being stage/test and prod)?
I think what op’s referring to is a staging app version that talks to production services and databases. Eg you have a “clone” of your production UI, accessible only to devs. This clone is configured to talk to the same DB and call the same dependencies as the production service but since it’s access is limited it’s used by devs to test their new feature(s). This pattern is used where I work too. It’s been incredibly…
Earlier quoted context omitted.
At home I really appreciate the NAT. I'm glad not every device has a public IP and gets hammered with attacks 24/7. It's not fail-safe but it definitely adds some security.. As for cloud, no idea what the benefit should be there.
This is what a firewall is for.
Earlier quoted context omitted.
Again: "you're doing it wrong" and "you're not allowed to like the NAT" are not valid criticisms. People like NAT because it's an easy batteries-included way to manage, secure and understand your LAN. Taking it away and forcing them to migrate to an incompatible zoo of firewall technologies for no benefit is asinine. > They're just sold to consumers as a single package. Exactly. How in the world is this a bad thing n…
Nothing changes; the firewall instead says "do you want this port open to this device" [y/N]: Personally I think this is much easier to reason about. And all I'm saying is that the NAT part of it absolutely does nothing to defend you, it's trivially defeated, people just conflate the two.
That's exactly what I don't want to do. I have over 20 devices in the home LAN at any given point in time; why do you want to make my life difficult for no good reason?
Earlier quoted context omitted.
Of course you can. But why would you? You're replacing something that is simple, easy to understand and works perfectly well with a nebulous something that invites user error and security nightmares. For example, my (modest) home LAN is five routers, a NAS/media server, a media player, two "smart TVs" and dozens of notebooks and phones connected via Wi-Fi. What do you propose? Manage a firewall on each of those devic…
Your home network and a cloud datacenter aren’t comparable. Many clouds have host level firewall policies as a core feature, and anyone competent is managing them profile-style using Terraform or an equivalent. It’s really quite easy from that perspective.
Of course they are. I didn't need to think about firewall automation before, and now I do. For what gain?
> anyone competent
Not an option for most people. Let's make networking and security things more foolproof, not less, okay?