Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Interview with CEO of rsync.net: “no firewalls and no routers”

console.dev

Post reply on HN
Print view View original

171–180 of 343 posts

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#171

Post by Alupis »

vidarh wrote: post #155
navaati wrote: post #102

Earlier quoted context omitted.

It’s hilarious that the first "vulnerability" in the example report[0] linked in this page is basically "SSH is accessible". Well… Duh ! [0] https://www.rsync.net/resources/regulatory/PCI_usw-s005_repo... EDIT: It’s marked as "PASS" though, so it’s all fine, just funny.

I once had a someone report responding to ping as a vulnerability. For the public facing firewall. We sent them back a link of prominent servers that respond to ping. Including the web server of the expensive agency that had produced the report. And whose web server had an expired SSL certificate.

Well, PCI compliance is different from regular server administration (a lot of it being smoke and mirrors, yes).

I do not believe ICMP (ping) is an automatic-fail condition for PCI (at least for certain SAQ levels that I'm familiar with) - however they do show up as warnings, particularly if you can get a timestamp response (to be used in timing-based attacks).

PCI prefers systems that handle CHD be "invisible" to the outside world, in an attempt to hide the systems an attacker might take interest in. Not always feasible (eCommerce, for example), but you gotta jump through the PCI hoops if you don't want to be stuck holding the bag if there's some breach.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#172

Post by kortilla »

korethr wrote: post #48

I wonder if they have any sales to large enterprises or similar institutions. In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the pa…

> I'm sure it can be done. IIRC, Cloudflare doesn't use any firewalls

This is a little disingenuous because their product is a modern firewall. It drops packets and conditionally allows sessions to your backend.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#173

Post by richardwhiuk »

e40 wrote: post #148
tpetry wrote: post #146

Earlier quoted context omitted.

You cant protect from a DDoS with a hardware firewall, a DDoS consists of so much bandwidth that your network hardware is not able to simply handle the incoming traffic before any filtering happens. Your expensive hardware firewall can protect from DoS attacks, but they don‘t happen anymore as DDoS attacks are really cheap.

Can you can protect yourself from certain types of things (SYNC flood) with a firewall, though.

It's easier to protect against SYN floods if you terminate the connection.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#174

Post by kortilla »

lima wrote: post #89
vel0city wrote: post #73

Earlier quoted context omitted.

Cloudflare not using any firewalls seems like a strange concept, considering they literally sell firewall-as-a-service. https://www.cloudflare.com/waf/

What would they need a firewall for? They have full control over the entire environment. They can (and should) just filter host-side.

Host level filtering doesn’t make it “not a firewall”. If they drop packets in the NIC before hitting userspace (they do this), that’s a firewall. Iptables is a firewall.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#176

Post by hayst4ck »

korethr wrote: post #48

I wonder if they have any sales to large enterprises or similar institutions. In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the pa…

On one hand, a firewall that accepts incoming port 22 connections isn't that different from only having port 22 listening.

On the other hand, a firewall is an explicit declaration of the ports you want open and who you want them open to, which seems like, at the very least, a useful thing to do. If nothing else it seems like defense in depth. I'm not sure I buy that a system designed around "default deny" is an increase in secrity complexity, certainly it's complexity that would hurt availability, but complexity that would hurt security?

Either way, the real security comes from monitoring the reality of what ports are actually open/listening and verifying a person's assumptions about their systems.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#177

Post by darkarmani »

Alupis wrote: post #171
vidarh wrote: post #155

Earlier quoted context omitted.

I once had a someone report responding to ping as a vulnerability. For the public facing firewall. We sent them back a link of prominent servers that respond to ping. Including the web server of the expensive agency that had produced the report. And whose web server had an expired SSL certificate.

Well, PCI compliance is different from regular server administration (a lot of it being smoke and mirrors, yes). I do not believe ICMP (ping) is an automatic-fail condition for PCI (at least for certain SAQ levels that I'm familiar with) - however they do show up as warnings, particularly if you can get a timestamp response (to be used in timing-based attacks). PCI prefers systems that handle CHD be "invisible" to th…

PCI compliance is to reduce the chances of legal liability. Better security is sometimes a side-effect of that compliance.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#178

Post by jsmith99 »

hertzrat wrote: post #107

I used to run Linux for everything but I’m having to use Windows these days. What would it take to get rsync.net playing nicely with windows? I’m imagining Windows subsystem for Linux (ubuntu) with duplicity installed to it? Are there any major hiccups to that sort of setup?

WSL is tricky for backups because cron jobs don't always run (although it's possible to run WSL command through windows task scheduler). Rclone, restic, and kopia are useful tools with official windows builds.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#179

Post by lokl »

audience_mem wrote: post #170
lokl wrote: post #164

I wish I had a personal use case where the pricing of rsync.net made sense. It looks like a great service. For now, I use Backblaze Unlimited. I realize they are not the same service, but Backblaze works for my personal stuff and the price is great.

> Backblaze Test your backups. https://messengergeek.wordpress.com/2018/03/09/backblaze-rev...

Thanks for sharing this.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#180

Post by dsr_ »

hertzrat wrote: post #109
klodolph wrote: post #64

Earlier quoted context omitted.

On a reasonable-size setup, I would expect that the logs are exported to dedicated log storage (log-only machines) as part of an effort to preserve accurate log files even in the case of a successful attack on one of the hosts. It is not especially hard to ensure that, for example, a record of an SSH login attempt gets recorded to an external server before the request is authenticated. So if you have (for example) an…

The firewall is still helpful in case they hire a new person who opens a port and forgets to close it one day

"Steve, did you open a port? We only use SSH. What's going on?"
Post reply on HN