Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Interview with CEO of rsync.net: “no firewalls and no routers”

console.dev

Post reply on HN
Print view View original

191–200 of 343 posts

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#191

Post by bigiain »

ev1 wrote: post #97
deadlyllama wrote: post #75

Earlier quoted context omitted.

I used to (late 2000s) work for a tiny, tiny company that was courting a customer in the mobile banking space. They wanted us to tick boxes. So we bought a box (some sort of Fortinet) that said it was a firewall and IDS. Plugged it in, used it as our new router. "Cost of doing business." Could we have argued with them during the sales process? Only if we wanted to lose the sale. The Fortinet was cheap compared to the…

Cost of doing business, or ... introducing new Fortinet vulnerabilities into your infrastructure? I know you mentioned 2000s, but it's funny that these contractually obligated boxes might introduce more worry: https://www.bleepingcomputer.com/news/security/fortinet-fixe...

I guess you can still tick all the compliance checkboxes if you install the contractually obligated Fortinet device outside your DMZ and internally treat it as no more trusted that the rest of the internet...

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#193

Post by [deleted] »

sideshowmel wrote: post #56
Jonnax wrote: post #49

Earlier quoted context omitted.

I'm not sure those reasons really apply to their case. Especially since they're running the boxes that it's connected to. They can do resiliency, network segmentation, and monitoring on their platform. What's a Cisco box going to do for them?

Dumb switches will blast packets to all interfaces that are connected. If there's a machine on the switch that's in promiscuous mode, it can see all the packets on the local network (including the backups coming in from customers). Managed switches typically have ACL support. I get the KISS principle, but this setup seems to be trading security for simplicity.

[deleted]

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#194

Post by lolc »

jsmith99 wrote: post #44
sparkling wrote: post #26

Hetzner has a similar product at better pricing that i have been using a minimalist dropbox alternative https://www.hetzner.com/en/storage/storage-box Access via rsync/sftp/scp

It seems a very similar product, also offering zfs snapshots, but I like the fact rsync.net snapshots are immutable: you can browse them but there is no way to delete them without contacting support (and the CEO once posted he would review every such request). It makes me feel more confident about my backups if someone got hold of the cached credentials from my backup software.

Nice to read they've baked this in. It is a barrier that can let one recover even after attacks from insiders.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#195

Post by bigiain »

touisteur wrote: post #184
wahern wrote: post #145

Earlier quoted context omitted.

> And you can make them tls-end for you. Nothing says end-to-end security like terminating TLS at a network choke point so intruders can easily snoop all traffic.

What is the threat model there? What if the system can't be upgraded for reasons? What if your service/gateway is just behind the 'network choke' (who said you had to have only one?). Are you paying to upgrade everyone and their perfectly working mainframes or java 8 apps to TLS 1.3? How do your intruders come in? They have to break the appliance? How's the chance you have better tuned/setup your TLS terminator or FW…

The threat model is that any foothold an attacker gets behind you TLS terminator potentially allows then to snoop plaintext traffic - which likely includes login creds and auth tokens for all those mainframes and java 8 apps.

(Note, I do exactly this a bit myself - terminate TLS at Elastic Load Balancers - and I feel a little dirty about it ever4y time I'm reminded... I sometimes wonder if I spend more time ensuring VPCs are appropriately isolated and keeping instances running untrusted or less trusted code out of vpcs with production customer data flying around unencrypted, than I would setting up to use encrypted data-on-the-fly everywhere. The big inertia holding that back is that we have so much legacy stuff running on stuff like Grails3 and Java8 that) he benefits of starting "doing it right" are not going to be fully realised for many years while those old platforms still need to run, and the added complexity of running two differently architected platforms is a big issue... I know what we should be doing, but the path to get there and the expense of travelling down it are high. We'll get there in "drip feed" mode where new projects and major updates to existing projects will do it right, but I'll be astounded if we don't still have some old untouched Java8 or Grails3 running in production in 5 years time...)

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#196

Post by [deleted] »

touisteur wrote: post #184
wahern wrote: post #145

Earlier quoted context omitted.

> And you can make them tls-end for you. Nothing says end-to-end security like terminating TLS at a network choke point so intruders can easily snoop all traffic.

What is the threat model there? What if the system can't be upgraded for reasons? What if your service/gateway is just behind the 'network choke' (who said you had to have only one?). Are you paying to upgrade everyone and their perfectly working mainframes or java 8 apps to TLS 1.3? How do your intruders come in? They have to break the appliance? How's the chance you have better tuned/setup your TLS terminator or FW…

[deleted]

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#197

Post by stavros »

high_byte wrote: post #101
rsync wrote: post #53

Earlier quoted context omitted.

"I wonder if they have any sales to large enterprises or similar institutions." Yes, certainly. We frequently fill out very detailed checklists and questionnaires related to our quality policy, standards, internal policies, etc. We're also very honest about how we approach these issues: https://www.rsync.net/resources/regulatory/pci.html ... and they generally appreciate the honesty.

> Our platform only answers on port 22 with OpenSSH. I do security and I title this "Most secured platform in the world."

Oh yeah? Well I run one where no ports are open. In fact, I haven't even connected it to the network.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#198

Post by colejohnson66 »

rsync wrote: post #123
learn_more wrote: post #80

Earlier quoted context omitted.

FYI, your "pricing" link at the top of that pci.html page 404's. The pricing link works from other pages however.

I see that that has now been fixed - thanks for pointing it out.

If we’re discussing website bugs, the “SSAE16 / SAS70” page[0] mentions 2015 as “upcoming”

[0]: https://www.rsync.net/resources/regulatory/sas70.html

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#199

Post by rfd4sgmk8u »

richardfey wrote: post #134

I think they need to hire someone that is strong on the security side of the business, for two reasons: * he appears not aware of the role of hardware firewalls in mitigating DDoS by handling efficiently a lot of active TCP sessions (they have specialised hardware for this purpose) * he is describing in great detail a lot of information that a phisher or other type of hacker can treasure to target him

I read it this way too. Having the OS kernel have to process all internet junk traffic (including all the IoT worms) wastes CPU cycles that could be used serving traffic to legitimate users. It is better to offload the packet filtering to a dedicated device, with an OOB management. If the host was flooded, one might not be able to activate a host based firewall to fix in such a DDoS condition.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#200

Post by bigiain »

kortilla wrote: post #174
lima wrote: post #89

Earlier quoted context omitted.

What would they need a firewall for? They have full control over the entire environment. They can (and should) just filter host-side.

Host level filtering doesn’t make it “not a firewall”. If they drop packets in the NIC before hitting userspace (they do this), that’s a firewall. Iptables is a firewall.

I am confident 99.9% of the people insisting on having you tick the checkboxes have no idea what "they drop packets in the NIC before hitting userspace" means...

Pretty sure getting your PM to just drop the firewall icon into their Visio diagram is a better way to meet stupid compliance requirements than explaining the difference between user space and kernel space to a just-graduated big4 consulting company intern "auditor"... /s

Post reply on HN