Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Interview with CEO of rsync.net: “no firewalls and no routers”

console.dev

Post reply on HN
Print view View original

201–210 of 343 posts

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#201

Post by ac29 »

okl wrote: post #185
hayst4ck wrote: post #176

Earlier quoted context omitted.

On one hand, a firewall that accepts incoming port 22 connections isn't that different from only having port 22 listening. On the other hand, a firewall is an explicit declaration of the ports you want open and who you want them open to, which seems like, at the very least, a useful thing to do. If nothing else it seems like defense in depth. I'm not sure I buy that a system designed around "default deny" is an incre…

> [...] but complexity that would hurt security? Higher complexity = larger attack surface. For example, if they used a firewall with one of Cisco's infamous backdoors. https://www.zdnet.com/article/cisco-removed-its-seventh-back...

Isnt a firewall largely a defense in depth thing? If everything is working perfectly and the firewall gets compromised, then yes, you'd just be listening to port 22 with SSH anyways, so it wouldn't really matter. But if something went wrong on the system behind the firewall (configuration mistake, software defect, malware, hacking) but the firewall itself was still secure, it would limit the damage that could be done.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#202

Post by ac29 »

chewbaxxa wrote: post #161
tfsh wrote: post #159

Meta: I really dislike the style of console.dev, the article is shunted to the left and leaves the rest of the screen real estate to be taken up by an - albeit pretty - but unnecessary piece of digital artwork. This - https://ibb.co/nzbFxjW - is what the article looks like on my ultrawide which made for very uncomfortable viewing

Not sure why you couldn’t just resize the window here?

Thats a bit of a chore with a tiling window manager if you generally have the browser on its own workspace - you either need to spawn new windows around the browser window to push it into the geometry you want, or add borders to it.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#203

Post by bigiain »

globular-toast wrote: post #168
tfsh wrote: post #159

Meta: I really dislike the style of console.dev, the article is shunted to the left and leaves the rest of the screen real estate to be taken up by an - albeit pretty - but unnecessary piece of digital artwork. This - https://ibb.co/nzbFxjW - is what the article looks like on my ultrawide which made for very uncomfortable viewing

What would you prefer? Having an entire paragraph of text on a single line? Your monitor is the wrong shape.

That's a pretty unhelpful way of thinking about this.

Any web designer who doesn't, in 2021, understand and make allowances for 4k/5k ultra wide monitors as well as phone sizes screens in portrait mode - isn't doing their job right.

The problem here is not the monitor shape or the user's browser window width, it's the css (and maybe html) and the lack of understanding of how to use it properly (or, more sympathetically, perhaps a conscious choice on the part of the people paying for the website to not allocate enough budget to cover all their competent webdev's suggestion?)

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#204

Post by bigiain »

ac29 wrote: post #202
chewbaxxa wrote: post #161

Earlier quoted context omitted.

Not sure why you couldn’t just resize the window here?

Thats a bit of a chore with a tiling window manager if you generally have the browser on its own workspace - you either need to spawn new windows around the browser window to push it into the geometry you want, or add borders to it.

It's not a great suggestion for, say, iPad users either...

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#205

Post by bigiain »

rsync wrote: post #136
cannam wrote: post #117

Earlier quoted context omitted.

> rsync.net is one part of my personal computing setup that I never even think twice about I've been using them in a small but important-to-me way continuously since 2008, and I have occasionally forgotten the service needed maintaining at all - at one point I forgot to pay them for an embarrassingly long time after a credit card expired, and they kept my storage going for me until I finally got myself in order. Plea…

RE: git ... We just added git-lfs / LFS support. So now, when you do things like: ssh user@rsync.net "git clone --mirror git://github.com/LabAdvComp/UDR.git github/udr" ... you can successfully pull over LFS assets, etc.

Oooh, nice!

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#206

Post by tasssko »

wahern wrote: post #145
touisteur wrote: post #119

Earlier quoted context omitted.

And you can update it at its own rhythm, potentially different from your upgrade path. And you can make them tls-end for you. Your customer might even have 3000 of those and already know how to keep them happy running. Not so bad.

> And you can make them tls-end for you. Nothing says end-to-end security like terminating TLS at a network choke point so intruders can easily snoop all traffic.

We ditched the the tls termination in nginx strategy, shifted to a nlb with tls termination in app. We used let’s encrypt because we needed something dynamic so we didn’t have to manage certs. Well we received one of those CISO forms from a big enterprise and one of the questions. Do you use LetsEncrypt? We said yes and the responded that it wasn’t a permitted tls solution. For what it’s worth I was happy with it.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#208

Post by hayst4ck »

ac29 wrote: post #201
okl wrote: post #185

Earlier quoted context omitted.

> [...] but complexity that would hurt security? Higher complexity = larger attack surface. For example, if they used a firewall with one of Cisco's infamous backdoors. https://www.zdnet.com/article/cisco-removed-its-seventh-back...

Isnt a firewall largely a defense in depth thing? If everything is working perfectly and the firewall gets compromised, then yes, you'd just be listening to port 22 with SSH anyways, so it wouldn't really matter. But if something went wrong on the system behind the firewall (configuration mistake, software defect, malware, hacking) but the firewall itself was still secure, it would limit the damage that could be done…

A FreeBSD machine running as a firewall might make sense without significantly increasing attack surface. But inviting a new hardware product into your infra is a significant increase in attack surface. SolarWinds is a very fresh example of a catastrophic supply chain attack and a clear example why it might not be a defense in depth thing.

If your network is secure, and a well configured machine only listening on port 22 is pretty secure, you have to ask how the production machine will interact with the outside world. Well every update is an inverse remote code execution. You are getting remote code from an external location and then running it directly in production. So while you might trust FreeBSDs package manager, do you trust Cisco? Do you trust SolarWinds? Even if you do, it's hard to argue that your attack surface hasn't been increased.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#209

Post by bigiain »

Alupis wrote: post #88
gambiting wrote: post #71

Earlier quoted context omitted.

So I don't agree, and I will use the car analogy again - old cars are not "supported" in any way and yet many people keep them going. There's serious engineering effort to make the parts, to write new software, to improve existing firmware etc. By your logic, that's also "wasted" effort since the manufacturer chooses to abandon cars after just few years, so why would you keep them going. I feel the same way about com…

The difference there is you're not violating some TOS or EULA by replacing parts on your classic car, and when you change your oil (do OS updates) there's no chance of suddenly your transmission refusing to allow you to shift gears until you perform more heroics and disable the artificial limitations. Very few non-classic and/or popular cars receive massive aftermarket support for all parts - often the aftermarket su…

>The difference there is you're not violating some TOS or EULA by replacing parts on your classic car, and when you change your oil (do OS updates) there's no chance of suddenly your transmission refusing to allow you to shift gears until you perform more heroics and disable the artificial limitations.

How long do we have to wait for the early Teslas to be considered "classics", because they're doing worse than this already...

"Self driving? No, that was only licensed to the original purchaser, you need to pay us $8000 now because we just remote disabled it when we worked out you bought this Roadster second hand. Hope that helps, have a nice day - Elon"

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#210

Post by irq »

bigiain wrote: post #203
globular-toast wrote: post #168

Earlier quoted context omitted.

What would you prefer? Having an entire paragraph of text on a single line? Your monitor is the wrong shape.

That's a pretty unhelpful way of thinking about this. Any web designer who doesn't, in 2021, understand and make allowances for 4k/5k ultra wide monitors as well as phone sizes screens in portrait mode - isn't doing their job right. The problem here is not the monitor shape or the user's browser window width, it's the css (and maybe html) and the lack of understanding of how to use it properly (or, more sympathetical…

There are precious few reasons to run a web browser full screen on an ultrawide. Most web sites don't even go that wide, it's just a ton of wasted screen real estate.
Post reply on HN