Earlier quoted context omitted.
I can top that: I don't have one.
What are you two even talking about?
The three golden rules of computer security: do not own a computer, do not power it on, and do not use it.
Interview with CEO of rsync.net: “no firewalls and no routers”
271–280 of 343 posts
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#272> I start the day with a short walk outdoors. I don’t want the first thing my eyes see to be print, and I don’t want the first thing my body does to be sitting. So I walk a bit. I like that. I like that a lot. That's a very enviable practice. I think I know what I'll be experimenting with this next week. Did not expect to read that article and have the most stand out thing be a routine change I'd want to copy. You ne…
It’s one of the best “lifehacks” , walking, biking and the likes in a traffic free or low environment to just clear the mind. By the end of the walk you’ll be full idea’s, or just ready to start the day. It’s coffee but without stimulants :)
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#273Earlier quoted context omitted.
I once had a someone report responding to ping as a vulnerability. For the public facing firewall. We sent them back a link of prominent servers that respond to ping. Including the web server of the expensive agency that had produced the report. And whose web server had an expired SSL certificate.
Well, PCI compliance is different from regular server administration (a lot of it being smoke and mirrors, yes). I do not believe ICMP (ping) is an automatic-fail condition for PCI (at least for certain SAQ levels that I'm familiar with) - however they do show up as warnings, particularly if you can get a timestamp response (to be used in timing-based attacks). PCI prefers systems that handle CHD be "invisible" to th…
This was not for PCI compliance.
And the system by definition could not be invisible - the ip in question was in DNS and was what you'd connect to the web servers on.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#274I wonder if they have any sales to large enterprises or similar institutions. In my experience, the larger organizations will have a "security" questionnaire required of their vendors, and the person administering it is a droid, incapable of evaluating whether the questions, originally written in the mid-00s and only updated for buzzword compliance since, are applicable to modern security practice today, or to the pa…
> I'm sure it can be done. IIRC, Cloudflare doesn't use any firewalls This is a little disingenuous because their product is a modern firewall. It drops packets and conditionally allows sessions to your backend.
While I agree with your assessment that Cloudflare serves as a modern firewall, I disagree with your assessment of disingenuousness. My lament was mainly at the more robotic and/or malicious "auditors" and "compliance officers" who will mark one or more line items as a critical failure if you don't have one or more Cisco Firepower/Juniper SRX/Fortinet Fortigate/Meraki MX/Barracuda NG/etc in your network such that its position in the network diagram means that it protects you from Evil Hackers. And AFAIK, while cloudflare's service is a sort of firewall, they don't use any traditional layer 4, layer 7, or 'next-generation' firewall appliances to get that result.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#275@rsync If you had to do it all over again, what would you do different (if anything)? E.g. product/positioning/tech-stack/employees/business-decisions
That's a really good question ... In terms of product / tech-stack I don't think I would change anything. In terms of marketing and word of mouth I think we should have given away hundreds of free accounts in the early years (2006-2010) rather than trying to chase them down as paying customers. I believe we had a lot of decent word of mouth but I don't think I appreciated the power of influencers and their ability to…
A Canadian location does solve the regulatory requirements of Canadian customers. Even federal government agencies in Canada no longer have issues using US-based hyperscalers (e.g., AWS, Azure, GCP) that have Canadian datacenters.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#276Earlier quoted context omitted.
Cloudflare not using any firewalls seems like a strange concept, considering they literally sell firewall-as-a-service. https://www.cloudflare.com/waf/
A WAF is not the same thing as a general-purpose firewall. Think of it as a web proxy with filtering capabilities.
Yeah, I find myself kinda annoyed at the term WAF, as it overloads the term "firewall". But your description is quite accurate. Whether you're doing your filtering with an expensive F5 Big-IP with its nifty glowy logo on the front bezel, an haproxy instance from some WAF-as-a-service vendor, or Nginx and some plugins running on a VM, any of those, done right, can serve in a WAF role.
I say that now, but I wish I understood that a few years ago, when faced with the WAF line item on an a WAF, promptly went "WTF is a WAF? googles No, we have a WAF." Could have saved myself some security audit pain.
On the flip side, I did manage to get some upgrade budget out of failing that battery of line items.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#277I think they need to hire someone that is strong on the security side of the business, for two reasons: * he appears not aware of the role of hardware firewalls in mitigating DDoS by handling efficiently a lot of active TCP sessions (they have specialised hardware for this purpose) * he is describing in great detail a lot of information that a phisher or other type of hacker can treasure to target him
You cant protect from a DDoS with a hardware firewall, a DDoS consists of so much bandwidth that your network hardware is not able to simply handle the incoming traffic before any filtering happens. Your expensive hardware firewall can protect from DoS attacks, but they don‘t happen anymore as DDoS attacks are really cheap.
In any situation where you need to create a filter rule that needs to run fast against a lot of TCP sessions a hardware firewall will do it faster than your general purpose server. It's not about protection but mitigation.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#278Why would i buy 1TB for $20 per month here instead of getting 6TB for $8/month from Microsoft?
Technical excellence and out-of-this-world support. I say this as a very happy rsync.net customer for over 10 years.
Though if the descriptions of the service on their web page does not make you salivate, perhaps it's not for you.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#279Earlier quoted context omitted.
I don't know... I mean, maybe the security posture is to annoy the hackers into giving up? ("This thing requires a Java applet and is slow as hell. Screw it, let's just pwn the bank across the street") I'll call it Security by Inconvenience.
Such strategies are remarkably effective, and maybe arguably describes all security in a nutshell. Every time I notice an obscure feature in a Google product or service and go "hm, I wonder if that could be exploited", I then always go "...meh, it'll take too long and require too much concentration to figure it out."
No, not at scale. You may be discouraged, but there's someone who will have lots of fun breaking that specific feature.
See for example @jonasLyk who spent the last half a year (?) trying to abuse almost only the alternative streams and junction folders in windows.
Re: Interview with CEO of rsync.net: “no firewalls and no routers”
#280@rsync If you had to do it all over again, what would you do different (if anything)? E.g. product/positioning/tech-stack/employees/business-decisions
That's a really good question ... In terms of product / tech-stack I don't think I would change anything. In terms of marketing and word of mouth I think we should have given away hundreds of free accounts in the early years (2006-2010) rather than trying to chase them down as paying customers. I believe we had a lot of decent word of mouth but I don't think I appreciated the power of influencers and their ability to…
>but have not pulled the trigger.
Is this a ( lack of ) capital issue or simply an uncertain sustainable revenue stream issue?