Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Interview with CEO of rsync.net: “no firewalls and no routers”

console.dev

Post reply on HN
Print view View original

181–190 of 343 posts

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#181

Post by walrus01 »

RaitoBezarius wrote: post #142

You write down that you have no router, though your primary US location is connected to a "quintuple-homed network" and all global locations are at least triple-homed. What does that mean exactly? Is your IP provider quintuple-homed? Or are you running a bit more complicated setup than you explain but the gist is that you have no particular routing mechanisms? What does that say regarding your high availability? If o…

I read it not as there are no routers anywhere, but that they've abstracted the problem of running the routers to their upstream hosting/colo/datacenter provider. Obviously there are routers and their systems are connected to somebody's ASN, or you wouldn't be able to reach them over the Internet.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#182

Post by mfincham »

My first experience with rsync.net was very disappointing. To this day they still advertise “append-only mode” support for restic at https://www.rsync.net/products/restic.html.

Their support people confirmed it doesn’t work (though they didn’t seem to understand why it would be fine for them to support it as advertised...) yet 6 months later they still advertise that they support it, even when I have e-mailed to remind them (and it still doesn’t work either) :(

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#183

Post by mfincham »

mfincham wrote: post #182

My first experience with rsync.net was very disappointing. To this day they still advertise “append-only mode” support for restic at https://www.rsync.net/products/restic.html . Their support people confirmed it doesn’t work (though they didn’t seem to understand why it would be fine for them to support it as advertised...) yet 6 months later they still advertise that they support it, even when I have e-mailed to rem…

The tl;dr as to why it doesn’t work is that they blanket forbid calling “rclone serve”, which is required for “append-only” support in restic.

This doesn’t make sense given that the specific invocation of “rclone serve restic --stdio” doesn’t open any network sockets, it’s no less safe than e.g. “tar”

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#184

Post by touisteur »

wahern wrote: post #145
touisteur wrote: post #119

Earlier quoted context omitted.

And you can update it at its own rhythm, potentially different from your upgrade path. And you can make them tls-end for you. Your customer might even have 3000 of those and already know how to keep them happy running. Not so bad.

> And you can make them tls-end for you. Nothing says end-to-end security like terminating TLS at a network choke point so intruders can easily snoop all traffic.

What is the threat model there? What if the system can't be upgraded for reasons? What if your service/gateway is just behind the 'network choke' (who said you had to have only one?). Are you paying to upgrade everyone and their perfectly working mainframes or java 8 apps to TLS 1.3? How do your intruders come in? They have to break the appliance? How's the chance you have better tuned/setup your TLS terminator or FW than network security 'experts'?

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#185

Post by okl »

hayst4ck wrote: post #176
korethr wrote: post #48

I wonder if they have any sales to large enterprises or similar institutions. In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the pa…

On one hand, a firewall that accepts incoming port 22 connections isn't that different from only having port 22 listening. On the other hand, a firewall is an explicit declaration of the ports you want open and who you want them open to, which seems like, at the very least, a useful thing to do. If nothing else it seems like defense in depth. I'm not sure I buy that a system designed around "default deny" is an incre…

> [...] but complexity that would hurt security?

Higher complexity = larger attack surface.

For example, if they used a firewall with one of Cisco's infamous backdoors.

https://www.zdnet.com/article/cisco-removed-its-seventh-back...

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#186

Post by dinglefairy »

rsync wrote: post #10
Aeolos wrote: post #7

> "I have a early-2009 “octo” Mac Pro [...]" > > OS: macOS Does this make anyone else a bit uncomfortable? I don't think MacOS is still receiving security updates on that hardware. I'm all for using old hardware for as long as it keeps working, but I would never browse the internet with a vulnerable OS on a vulnerable processor (spectre etc...) Or am I missing something?

"Or am I missing something?" Yes, one minor thing ... Although you are correct that Apple is not officially supporting the latest versions of OSX on that hardware, there is a trivially easy hack of the system that will allow you to load newer versions of OSX. So, like many of you, I am not running Catalina but I am running an updated, patched version of OSX.

happy to hear that I'm not the only one [sys admin type person] doing this.

although i use Windows, i do have Catalina installed [and Debian for the triple boot]. also using open core. I'm pretty sure i downloaded a copy of osx from one of their repositories 0.o I'm super lazy, it's really not that hard.

my average cost for hardware since i bought my Mac is now less than 400/year CDN. is it worth it? while I'm slightly concerned about the security [I'm probably the biggest risk anyways since I'm not confident in my knowledge of secops], i get 95 fps playing pubg, can edit in 4k, run 100+ tracks in Cubase, and run 3 different OSes or as many vms as you'd like [which i think can also run bare metal vm on the 144 firmware upgrade]. on top of that the case still looks good and I've kept at least 50+lbs of ewaste out of landfills or whatever... seems pretty worth it [hopefully no one ever tries to steal pictures of my cats]

[we could also get into a discussion about the right to repair bill in the EU, talking this way]

do you game? i feel like that might have been intentionally left out of the interview?

what info would you keep unencrypted on your servers?

how much does a colo cost for a 2u server typically? how about back in 06?

is rsync a good solution for video files backup? what are the benefits over say, running a home server and keeping physical backups at your friends house or iron mountain or something?

can rsync use 'live' encrypted data? in other words, how do you encrypt/decrypt on the fly? say for streaming an mp3 or something? [not that you would do this if you were paying per GB...]

please excuse my ignorance. I'm not a real sys admin, just an old wanna be hacker that could never get his shit together.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#187

Post by pezezin »

korethr wrote: post #48

I wonder if they have any sales to large enterprises or similar institutions. In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the pa…

> ...incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today...

You just described my workplace. We have some rules that nobody understands and nobody remembers where they come from, but we have to follow them blindly. For example, they require that any access to the web services should go through a VPN, which would be fine if:

- The VPN actually worked, but it doesn't.

- The servers already uses TLSv1.3, all the services require user authentication, and there are 3 layers of firewalls and an integrated virus scanner in front of the services.

- We are an international project with people from 10 different organizations in 6 countries on 2 continents, and it's really difficult to impose these kind of rules.

So for example, I'm managing a GitLab instance that I can't use myself. I can only SSH login from a very specific computer to manage it, but I can't upload my own code from my office computer.

And I don't want to go into their blind devotion to the firewall and their concept of one way connections...

So I'm just letting time go by, until everybody is so angry they are finally forced to change. Doesn't help that this is Japan, the epitome of rigidness and "even it is broken, don't fix it".

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#188

Post by audience_mem »

lokl wrote: post #179
audience_mem wrote: post #170

Earlier quoted context omitted.

> Backblaze Test your backups. https://messengergeek.wordpress.com/2018/03/09/backblaze-rev...

Thanks for sharing this.

No problem. I hate the thought of data loss. They may be better now, but who knows, it's worth being sure.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#189

Post by jeffbee »

mcosta wrote: post #154
jeffbee wrote: post #98

I always liked this set of marketing materials. But I also see where they conflict with my experience. "You may visit our datacenters any time you like for a personal tour and inspection to satis[f]y whatever due diligence requirements you may have" probably appeals to many customers, but for my dollar I would prefer a datacenter that nobody may enter.

> I would prefer a datacenter that nobody may enter. If a disk break, who changes it?

Not tourists, clearly.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#190

Post by punnerud »

rsync wrote: post #123
learn_more wrote: post #80

Earlier quoted context omitted.

FYI, your "pricing" link at the top of that pci.html page 404's. The pricing link works from other pages however.

I see that that has now been fixed - thanks for pointing it out.

The “burger menu” does not work on iPhone. Works from the front page.
Post reply on HN