Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Interview with CEO of rsync.net: “no firewalls and no routers”

console.dev

Post reply on HN
Print view View original

291–300 of 343 posts

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#291

Post by krylon »

tjalfi wrote: post #243
function_seven wrote: post #231

Earlier quoted context omitted.

I don't know... I mean, maybe the security posture is to annoy the hackers into giving up? ("This thing requires a Java applet and is slow as hell. Screw it, let's just pwn the bank across the street") I'll call it Security by Inconvenience.

That reminds me of a post[0] on alt.sysadmin.recovery. The hackers were annoyed by the compromised machine so they installed security updates and did other system administration tasks. [0] https://groups.google.com/g/alt.sysadmin.recovery/c/ITd7OlMr...

I vaguely recall some kind of malware that upon infecting a system scanned the system for other malware and removed/disabled it. The motives were far from pure, obviously. (Although there also was a case, I think, of a piece of malware specifically created to ensure "infected" system had up to date AV software and were up to date update-wise. We sure live in strange times.)

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#292

Post by dividedbyzero »

cat199 wrote: post #247
gautamcgoel wrote: post #244

The pricing model doesn't make sense to me. Their prices start at $0.025/GB/month, so renting 1TB of storage for a year would cost $300 - at that price, I could just buy my own disks and run ZFS myself. I kinda hoped they could offer lower prices using economies of scale. I checked the prices for Tarsnap, expecting it to be cheaper - it's actually 10x more expensive! Maybe someone can explain what I'm missing.

DIY is way cheaper, true. but for comparison, aws is ~$100/tb/month

AWS Glacier is ~$4/tb/month. Getting data out of there costs extra, but for backups of last resort you don't expect to ever need, that may be a workable tradeoff.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#294

Post by [deleted] »

sideshowmel wrote: post #56
Jonnax wrote: post #49

Earlier quoted context omitted.

I'm not sure those reasons really apply to their case. Especially since they're running the boxes that it's connected to. They can do resiliency, network segmentation, and monitoring on their platform. What's a Cisco box going to do for them?

Dumb switches will blast packets to all interfaces that are connected. If there's a machine on the switch that's in promiscuous mode, it can see all the packets on the local network (including the backups coming in from customers). Managed switches typically have ACL support. I get the KISS principle, but this setup seems to be trading security for simplicity.

[deleted]

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#295

Post by kubanczyk »

tinco wrote: post #152
rsync wrote: post #53

Earlier quoted context omitted.

"I wonder if they have any sales to large enterprises or similar institutions." Yes, certainly. We frequently fill out very detailed checklists and questionnaires related to our quality policy, standards, internal policies, etc. We're also very honest about how we approach these issues: https://www.rsync.net/resources/regulatory/pci.html ... and they generally appreciate the honesty.

Isn't the nice thing about having an access fortress, that you can monitor the access more simply? Or is it just as simple for you to monitor access to all the identically configured machines? I suppose it might be.

I believe the usual name is a bastion host, not an access fortress.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#296

Post by Crontab »

iamevn wrote: post #285
wwalexander wrote: post #160

Earlier quoted context omitted.

It’s worth reading the rest of the interview, I find Rob Pike has a very interesting/unique take on the current landscape given his involvement with Plan 9: > Now everything isn't connected, just connected to the cloud, which isn't the same thing. And uniform? Far from it, except in mediocrity. This is 2012 and we're still stitching together little microcomputers with HTTPS and ssh and calling it revolutionary.

If you want to see more on this theme, the Upspin docs[1] are a really interesting read. This 2017 talk[2] that Rob Pike gave on it is also really good. [1] https://upspin.io/ [2] https://youtu.be/ENLWEfi0Tkg

Thank you! I hadn't seen this.

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#297

Post by kubanczyk »

ev1 wrote: post #97
deadlyllama wrote: post #75

Earlier quoted context omitted.

I used to (late 2000s) work for a tiny, tiny company that was courting a customer in the mobile banking space. They wanted us to tick boxes. So we bought a box (some sort of Fortinet) that said it was a firewall and IDS. Plugged it in, used it as our new router. "Cost of doing business." Could we have argued with them during the sales process? Only if we wanted to lose the sale. The Fortinet was cheap compared to the…

Cost of doing business, or ... introducing new Fortinet vulnerabilities into your infrastructure? I know you mentioned 2000s, but it's funny that these contractually obligated boxes might introduce more worry: https://www.bleepingcomputer.com/news/security/fortinet-fixe...

Exactly. My first thought was: did they install Solarwinds as well?

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#299

Post by nix23 »

function_seven wrote: post #231
technion wrote: post #229

Earlier quoted context omitted.

I did a job where I was given access to a server in the form of a set of credentials for an HPE iLO, which was accessible over the Internet. From there, we could use the remote console to logon as root. HPE iLO doesn't support MFA or any form of public key authentication, and its security history is much worse than SSH. It requires several ports open and the old version they had required Java plugins on desktops and…

I don't know... I mean, maybe the security posture is to annoy the hackers into giving up? ("This thing requires a Java applet and is slow as hell. Screw it, let's just pwn the bank across the street") I'll call it Security by Inconvenience.

The new Ilo has a "HTML5" and Java console. But 3 wrong passwords and your blocked for 10 minutes (by default).

Re: Interview with CEO of rsync.net: “no firewalls and no routers”

#300

Post by Aachen »

anderiv wrote: post #259
gautamcgoel wrote: post #244

The pricing model doesn't make sense to me. Their prices start at $0.025/GB/month, so renting 1TB of storage for a year would cost $300 - at that price, I could just buy my own disks and run ZFS myself. I kinda hoped they could offer lower prices using economies of scale. I checked the prices for Tarsnap, expecting it to be cheaper - it's actually 10x more expensive! Maybe someone can explain what I'm missing.

Sure, you could purchase your own drives. But then it wouldn’t be offsite. And it probably wouldn’t be on a redundant internet connection. And most likely not have redundant power and cooling. And, and, and. Self-hosting at home (or in the office) is a great option for some if you’re not worried about needing an offsite backup. For those that do care about this sort of thing, though, the extra you pay to have someone…

It can be off-site if you have a friend with Internet where you can stash that disk attached to a raspberry pi. Quite a few people do that and it means you're storing terabytes not at the steep $300/year but at $30/year for every terabyte. I can eat healthily for a month from that difference, that's worth a few minutes of effort setting up port forwarding and installing zfs if that's your thing (personally I'd leave it plain ext4 and dump something encrypted like Restic on it, taking all of 5 minutes to setup from downloading the OS to Pi Reporting for Duty).

Calculation: pi 40eur, 1TB external disk 50eur, typical lifespan of a disk 5 years (when excluding including infant mortality which falls under the mandatory 2-year warranty for new electronics), ~8W power draw is ~€15/year. Let's say you also need to replace the pi after 5 years just for good measure. That's 15+(90/5)=€33/year for 1TB, which gets cheaper per terabyte with bigger or multiple drives.

Post reply on HN