Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Interview with CEO of rsync.net: “no firewalls and no routers”

console.dev

Post reply on HN
Print view View original

251–260 of 343 posts

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#251

Post by Spooky23 »

technion wrote: post #229
navaati wrote: post #102

Earlier quoted context omitted.

It’s hilarious that the first "vulnerability" in the example report[0] linked in this page is basically "SSH is accessible". Well… Duh ! [0] https://www.rsync.net/resources/regulatory/PCI_usw-s005_repo... EDIT: It’s marked as "PASS" though, so it’s all fine, just funny.

I did a job where I was given access to a server in the form of a set of credentials for an HPE iLO, which was accessible over the Internet. From there, we could use the remote console to logon as root. HPE iLO doesn't support MFA or any form of public key authentication, and its security history is much worse than SSH. It requires several ports open and the old version they had required Java plugins on desktops and…

PCI QSAs are notorious for being complete jackasses. You have to be very careful about vetting them. That isn’t the dumbest thing I’ve heard like that!

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#252

Post by JeremyNT »

rsync wrote: post #30
Alupis wrote: post #13

Earlier quoted context omitted.

I have trouble understanding why people go through these hoops. Yeah, I get it, people love their Mac's... but the company that produces them actively undermines your ability to continue using perfectly good hardware past what they feel is "profitable". This leads to huge efforts to hack/reverse the updaters, or alter newer OS versions to trick them into installing, etc. I'd personally jump over to some system that d…

I agree with this. It's why a hackintosh has never appealed to me. However, in this case , the tweak I needed to do to the mac pro was so trivial as to be (essentially) cost-free. No need to alter the installer, etc. It pleases me to be (re)using this machine for over 12 years now - especially given what a triumph of workstation design these mac pros were ...

My wife's MB Pro faced an upcoming support reckoning with Apple, and I just tossed Linux on it. Problem solved ;)

I've also used FreeBSD on (non-Apple) laptops in the past. It actually worked ok, I even had wireless working (this is very hardware dependent though, and things may have gotten worse over the years for all I know).

Based on the rest of your profile I think you might enjoy switching that workstation away from OS X to FreeBSD. Of course, it means some tinkering and looking for new tools to replace the ones you use now, but the tinkering is half the fun... :)

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#253

Post by cvwright »

rsync wrote: post #5
ttsiodras wrote: post #4

Interesting interview - thanks John! Didn't know there was a UFS2 "phase" before ZFS... I wonder how much time those fscks took! :-)

They took forever ... and then they bombed out due to lack of memory. Not lack of physical memory, but lack of ability to address it as the UFS2 tools, like fsck, were not written to handle billions of inodes ... We really can't thank Kirk M.[1] enough - he wrote custom patches to ufs and fsck just for our (dirty) filesystems and, as I mention in the article, eventually gave us the push to migrate to ZFS. [1] https:/…

Wow, what a cool story. Having Kirk McKusick write patches for you is almost like that old Weird Al song:

> I’m down with Bill Gates

> I call him “money” for short

> I phone him up at home

> And I make him do my tech support

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#255

Post by xarope »

stavros wrote: post #197
high_byte wrote: post #101

Earlier quoted context omitted.

> Our platform only answers on port 22 with OpenSSH. I do security and I title this "Most secured platform in the world."

Oh yeah? Well I run one where no ports are open. In fact, I haven't even connected it to the network.

Wasn't that the joke about how the original windows NT server got it's C2/ITSEC rating?

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#256

Post by rincebrain »

centimeter wrote: post #116
nicolaslem wrote: post #70

Earlier quoted context omitted.

I would love to use this simple setup as well. It's too bad ZFS snapshots cannot be sent and stored encrypted. I would love to use rsync.net but the idea to have my data sitting in someone else's computer in plain text feels wrong. So instead I have to use restic, which re-implements many features of ZFS and this also feels wrong.

I have a local ZFS backup server which sends encrypted incremental snapshots to my rsync.net account, no problem. You can't mount the encrypted snapshots since freebsd ZFS doesn't support that yet, but I don't need that (and it would defeat the security point anyway).

This seems strange to me - any version of ZFS recent enough to support receiving encrypted snapshots should support mounting them (which, AFAIK, means "OpenZFS-running FreeBSD implementations" - I don't believe the non-OpenZFS, integrated implementation ever got encryption support of any kind).

I've seen several people report using OpenZFS encryption on FBSD on various mailing lists, so I'm 95% sure it's not secretly broken on there.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#257

Post by 867-5309 »

technion wrote: post #229
navaati wrote: post #102

Earlier quoted context omitted.

It’s hilarious that the first "vulnerability" in the example report[0] linked in this page is basically "SSH is accessible". Well… Duh ! [0] https://www.rsync.net/resources/regulatory/PCI_usw-s005_repo... EDIT: It’s marked as "PASS" though, so it’s all fine, just funny.

I did a job where I was given access to a server in the form of a set of credentials for an HPE iLO, which was accessible over the Internet. From there, we could use the remote console to logon as root. HPE iLO doesn't support MFA or any form of public key authentication, and its security history is much worse than SSH. It requires several ports open and the old version they had required Java plugins on desktops and…

SSH doesn't have to be on port 22. you can leave an empty honeypot on port 22 and run SSH on whichever port you like

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#258

Post by a012 »

navaati wrote: post #102
rsync wrote: post #53

Earlier quoted context omitted.

"I wonder if they have any sales to large enterprises or similar institutions." Yes, certainly. We frequently fill out very detailed checklists and questionnaires related to our quality policy, standards, internal policies, etc. We're also very honest about how we approach these issues: https://www.rsync.net/resources/regulatory/pci.html ... and they generally appreciate the honesty.

It’s hilarious that the first "vulnerability" in the example report[0] linked in this page is basically "SSH is accessible". Well… Duh ! [0] https://www.rsync.net/resources/regulatory/PCI_usw-s005_repo... EDIT: It’s marked as "PASS" though, so it’s all fine, just funny.

It irks me a lot that GCP always put "SSH port opens" in Security Command Center as HIGH Vuln. while I'm running private subnets, FFS.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#259

Post by anderiv »

gautamcgoel wrote: post #244

The pricing model doesn't make sense to me. Their prices start at $0.025/GB/month, so renting 1TB of storage for a year would cost $300 - at that price, I could just buy my own disks and run ZFS myself. I kinda hoped they could offer lower prices using economies of scale. I checked the prices for Tarsnap, expecting it to be cheaper - it's actually 10x more expensive! Maybe someone can explain what I'm missing.

Sure, you could purchase your own drives. But then it wouldn’t be offsite. And it probably wouldn’t be on a redundant internet connection. And most likely not have redundant power and cooling. And, and, and.

Self-hosting at home (or in the office) is a great option for some if you’re not worried about needing an offsite backup. For those that do care about this sort of thing, though, the extra you pay to have someone else manage the thing is well worth it.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#260

Post by TheTaytay »

rsync wrote: post #53
korethr wrote: post #48

I wonder if they have any sales to large enterprises or similar institutions. In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the pa…

"I wonder if they have any sales to large enterprises or similar institutions." Yes, certainly. We frequently fill out very detailed checklists and questionnaires related to our quality policy, standards, internal policies, etc. We're also very honest about how we approach these issues: https://www.rsync.net/resources/regulatory/pci.html ... and they generally appreciate the honesty.

I was just lamenting the state of these forms today. I feel like many of the questions are variations on the theme of “what antivirus software do you use to protect your basement mainframe from your corporate network traffic?” “N/A” isn’t a long enough answer, so it feels like you need to keep explaining “the Internet”, LLC of a centralized corporate network, SaaS, etc.

Is there a modern, no-nonsense guide to filling these out honestly without telling the person doing the checkbox checking that their form is dumb?

I realize there’s a lot of rent seeking and money to be made by consultants in this space - I’m looking for the GitHub published guide or wiki to help smaller no-nonsense shops navigate the phrasing and map these vendor security questionnaires to “modern” technology.

Post reply on HN