Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Interview with CEO of rsync.net: “no firewalls and no routers”

console.dev

Post reply on HN
Print view View original

241–250 of 343 posts

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#241

Post by catmanjan »

function_seven wrote: post #231
technion wrote: post #229

Earlier quoted context omitted.

I did a job where I was given access to a server in the form of a set of credentials for an HPE iLO, which was accessible over the Internet. From there, we could use the remote console to logon as root. HPE iLO doesn't support MFA or any form of public key authentication, and its security history is much worse than SSH. It requires several ports open and the old version they had required Java plugins on desktops and…

I don't know... I mean, maybe the security posture is to annoy the hackers into giving up? ("This thing requires a Java applet and is slow as hell. Screw it, let's just pwn the bank across the street") I'll call it Security by Inconvenience.

That's why your security solution should include a mix of every known technology, hackers need to know everything from COBOL to rust

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#242

Post by acdha »

brazzledazzle wrote: post #226
bawolff wrote: post #127

Earlier quoted context omitted.

> In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the particular product/service/vendor in question. And in many cases on the vendor…

Which seems somewhat questionable. It seems like you’d want someone to fill it out that had a less direct interest in a closed sale. Getting hacked is one thing but getting caught lying on a security evaluation could really harm the company’s ability to secure future enterprise customers.

> Getting hacked is one thing but getting caught lying on a security evaluation could really harm the company’s ability to secure future enterprise customers.

“Could” being the key term here: unless it’s epically bad and unequivocal, there are pretty good odds they could skate a long time without anyone asking and even if they did it might end up simply being that they blame long-departed sales guy and patch things up with the CIO over martinis.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#243

Post by tjalfi »

function_seven wrote: post #231
technion wrote: post #229

Earlier quoted context omitted.

I did a job where I was given access to a server in the form of a set of credentials for an HPE iLO, which was accessible over the Internet. From there, we could use the remote console to logon as root. HPE iLO doesn't support MFA or any form of public key authentication, and its security history is much worse than SSH. It requires several ports open and the old version they had required Java plugins on desktops and…

I don't know... I mean, maybe the security posture is to annoy the hackers into giving up? ("This thing requires a Java applet and is slow as hell. Screw it, let's just pwn the bank across the street") I'll call it Security by Inconvenience.

That reminds me of a post[0] on alt.sysadmin.recovery.

The hackers were annoyed by the compromised machine so they installed security updates and did other system administration tasks.

[0] https://groups.google.com/g/alt.sysadmin.recovery/c/ITd7OlMr...

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#244

Post by gautamcgoel »

The pricing model doesn't make sense to me. Their prices start at $0.025/GB/month, so renting 1TB of storage for a year would cost $300 - at that price, I could just buy my own disks and run ZFS myself. I kinda hoped they could offer lower prices using economies of scale. I checked the prices for Tarsnap, expecting it to be cheaper - it's actually 10x more expensive! Maybe someone can explain what I'm missing.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#245

Post by travisgriggs »

> I start the day with a short walk outdoors. I don’t want the first thing my eyes see to be print, and I don’t want the first thing my body does to be sitting. So I walk a bit.

I like that. I like that a lot. That's a very enviable practice. I think I know what I'll be experimenting with this next week.

Did not expect to read that article and have the most stand out thing be a routine change I'd want to copy. You never know.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#247

Post by cat199 »

gautamcgoel wrote: post #244

The pricing model doesn't make sense to me. Their prices start at $0.025/GB/month, so renting 1TB of storage for a year would cost $300 - at that price, I could just buy my own disks and run ZFS myself. I kinda hoped they could offer lower prices using economies of scale. I checked the prices for Tarsnap, expecting it to be cheaper - it's actually 10x more expensive! Maybe someone can explain what I'm missing.

DIY is way cheaper, true. but for comparison, aws is ~$100/tb/month

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#248

Post by humaniania »

darkarmani wrote: post #177
Alupis wrote: post #171

Earlier quoted context omitted.

Well, PCI compliance is different from regular server administration (a lot of it being smoke and mirrors, yes). I do not believe ICMP (ping) is an automatic-fail condition for PCI (at least for certain SAQ levels that I'm familiar with) - however they do show up as warnings, particularly if you can get a timestamp response (to be used in timing-based attacks). PCI prefers systems that handle CHD be "invisible" to th…

PCI compliance is to reduce the chances of legal liability. Better security is sometimes a side-effect of that compliance.

To reduce the liability of the credit card company maybe, by making the process so complex and onerous that it is virtually impossible to complete a survey without some error or omission that would almost assuredly be used as a reason to invalidate any liability for the credit card company should some bad event take place. Source: have had to complete PCI surveys from multiple vendors.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#249

Post by MertsA »

wahern wrote: post #145
touisteur wrote: post #119

Earlier quoted context omitted.

And you can update it at its own rhythm, potentially different from your upgrade path. And you can make them tls-end for you. Your customer might even have 3000 of those and already know how to keep them happy running. Not so bad.

> And you can make them tls-end for you. Nothing says end-to-end security like terminating TLS at a network choke point so intruders can easily snoop all traffic.

Case and point "SSL added and removed here! :)"

https://blog.encrypt.me/2013/11/05/ssl-added-and-removed-her...

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#250

Post by generalizations »

cat199 wrote: post #247
gautamcgoel wrote: post #244

The pricing model doesn't make sense to me. Their prices start at $0.025/GB/month, so renting 1TB of storage for a year would cost $300 - at that price, I could just buy my own disks and run ZFS myself. I kinda hoped they could offer lower prices using economies of scale. I checked the prices for Tarsnap, expecting it to be cheaper - it's actually 10x more expensive! Maybe someone can explain what I'm missing.

DIY is way cheaper, true. but for comparison, aws is ~$100/tb/month

However, also for comparison, Backblaze is ~$5/TB/month.
Post reply on HN