Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security for Elasticsearch is now free

elastic.co

Post reply on HN
Print view View original

41–50 of 64 posts

Re: Security for Elasticsearch is now free

#41

Post by [deleted] »

zaphirplane wrote: post #34
lol768 wrote: post #22

Earlier quoted context omitted.

>Why don’t you want to pay for a feature that you need? It's irresponsible to charge for features such as transport security, in my opinion. Want to charge for enterprise auditing, federation, reporting and granular access control? Fine, go right ahead. But withholding basic security features like transport security and basic access control that should be core leaves a bad taste in my mouth. How many unsecured Elasti…

That is manifestly unfair, the situation is someone doesn’t want to pay for a security feature so they go ahead and expose themselves, all the time they are trying to make money by using a free product. Really unfair to point fingers at ES. And I really don’t get why People feel they should be making money off someone’s work but don’t have to pay them. What significant os or free is your company offering Really and g…

[deleted]

Re: Security for Elasticsearch is now free

#42

Post by Dylan16807 »

zaphirplane wrote: post #34
lol768 wrote: post #22

Earlier quoted context omitted.

>Why don’t you want to pay for a feature that you need? It's irresponsible to charge for features such as transport security, in my opinion. Want to charge for enterprise auditing, federation, reporting and granular access control? Fine, go right ahead. But withholding basic security features like transport security and basic access control that should be core leaves a bad taste in my mouth. How many unsecured Elasti…

That is manifestly unfair, the situation is someone doesn’t want to pay for a security feature so they go ahead and expose themselves, all the time they are trying to make money by using a free product. Really unfair to point fingers at ES. And I really don’t get why People feel they should be making money off someone’s work but don’t have to pay them. What significant os or free is your company offering Really and g…

A service like this is more like someone giving you a ride.

And if they don't have brake pads, and negligently get into a horrible wreck, one where they walk away unharmed while you are injured? You probably have a case there.

Re: Security for Elasticsearch is now free

#43

Post by reilly3000 »

Some of the worst breaches of 2017-19 have been due to open ES clusters, some on AWS. This is a welcome change. I just spun our AWS ES cluster down in favor of BigQuery, but while I was setting it up security for it was a big chore, with defaults that are in no way sane. AWS EC2 does a great job at secure defaults for auth and firewalls, RDS even moreso. Why was ES left to wag in the wind out of the box?

Re: Security for Elasticsearch is now free

#44

Post by jjeaff »

jillesvangurp wrote: post #39
mrkstu wrote: post #2

Free, not open source version. Obviously a reaction to Amazon's fork- not wanting to give them any code to pull into their version. It will be interesting to see if this is enough to retain the majority of the userbase or if we'll still see a majority migrate to the 'Open Distro' fork.

Open distro is definitely creating some pressure on ES. However, there are some misconceptions on what that is. 1) Amazon did not actually fork elasticsearch or maintains any patches against it. 2) Elasticsearch does in fact provide completely OSS distributions and docker images for their products. 3) Amazon has created several OSS plugins for Elasticsearch that they bundle with their open distro that compete directl…

Regarding the docker images elastic provides, I find it odd that they are only hosted from their own servers (rather than docker hub) and I have looked all over the place to find the dockerfile they use to create those images.

It seems that they are hiding that info and it really locks you into only doing customizations that the docker image is directly built for.

I also don't like to pull images blindly. I generally fork the dockerfile source so that I can build the software from source and have a bit more control and knowledge of what I am installing.

Re: Security for Elasticsearch is now free

#45

Post by nickserv »

vorpalhex wrote: post #37
jrockway wrote: post #16

Earlier quoted context omitted.

I use ELK for Kubernetes and network device logs, and I'm very much with you -- full text search is great, but it sure can be slow, even when running on $1000/month of AWS hardware. The conclusion that I've reached is that the whole lucene model for logs is kind of outdated. Why am I tuning Java GC params to run "grep foo /logs". I think computers today can do fine with sharded flat files, a minimal index ("which nod…

ELK stack user here - we actually found logstash to be our bottleneck. Changing it out for fluentd fixed our woes.

Same here, fluentd is much better, performance wise.

But then I had to give ES more RAM because it couldn't take the hammering.

In fact, increasing the throughput to ES was causing some pretty spectacular crashes, with the /var/log partition at 100% because of the verbosity of the dumps.

Re: Security for Elasticsearch is now free

#46

Post by zaphirplane »

Dylan16807 wrote: post #42
zaphirplane wrote: post #34

Earlier quoted context omitted.

That is manifestly unfair, the situation is someone doesn’t want to pay for a security feature so they go ahead and expose themselves, all the time they are trying to make money by using a free product. Really unfair to point fingers at ES. And I really don’t get why People feel they should be making money off someone’s work but don’t have to pay them. What significant os or free is your company offering Really and g…

A service like this is more like someone giving you a ride. And if they don't have brake pads, and negligently get into a horrible wreck, one where they walk away unharmed while you are injured? You probably have a case there.

A case ?

You want to sue an open source sw maker for not providing a feature for free because when you expose your ES to an insecure network without that feature you put yourself at risk ?

How about you don’t put your ES in an insecure network without buying the feature or pay someone to write the feature for you.

Your analogy is misleading and wrong, my mechanic one is better

How about this I offer you a stranger a ride to a location convenient to me for free, you take the ride then demand I drop you off at another location otherwise you will run in the middle of the road and hurt yourself

Re: Security for Elasticsearch is now free

#47

Post by jillesvangurp »

jjeaff wrote: post #44
jillesvangurp wrote: post #39

Earlier quoted context omitted.

Open distro is definitely creating some pressure on ES. However, there are some misconceptions on what that is. 1) Amazon did not actually fork elasticsearch or maintains any patches against it. 2) Elasticsearch does in fact provide completely OSS distributions and docker images for their products. 3) Amazon has created several OSS plugins for Elasticsearch that they bundle with their open distro that compete directl…

Regarding the docker images elastic provides, I find it odd that they are only hosted from their own servers (rather than docker hub) and I have looked all over the place to find the dockerfile they use to create those images. It seems that they are hiding that info and it really locks you into only doing customizations that the docker image is directly built for. I also don't like to pull images blindly. I generally…

After 1 google search: https://www.elastic.co/guide/en/elasticsearch/reference/curr...

It includes a deep link straight into their repository right at the top: https://github.com/elastic/elasticsearch/tree/7.1/distributi...

In short, their Docker build process is part of the elasticsearch repository. So, it's actually part of their normal build process and not something that happens with a separate build in some different repository. Personally, I think this is a good practice.

That's for both the OSS and non OSS images. They produce these with every build. And they probably test them too, which I think is the responsible thing to do and something I'd expect from them.

They use gradle to build their docker images from a Docker file (https://github.com/elastic/elasticsearch/blob/7.1/distributi...) that essentially untars the tar ball produced by their build. This looks pretty straightforward and free of magic steps.

So, read the source. It's all there. You can build from source or do your own thing. A variant of their Docker file where you just wget their tar ball shouldn't be that hard to do.

Re: Security for Elasticsearch is now free

#48

Post by timv »

jjeaff wrote: post #44
jillesvangurp wrote: post #39

Earlier quoted context omitted.

Open distro is definitely creating some pressure on ES. However, there are some misconceptions on what that is. 1) Amazon did not actually fork elasticsearch or maintains any patches against it. 2) Elasticsearch does in fact provide completely OSS distributions and docker images for their products. 3) Amazon has created several OSS plugins for Elasticsearch that they bundle with their open distro that compete directl…

Regarding the docker images elastic provides, I find it odd that they are only hosted from their own servers (rather than docker hub) and I have looked all over the place to find the dockerfile they use to create those images. It seems that they are hiding that info and it really locks you into only doing customizations that the docker image is directly built for. I also don't like to pull images blindly. I generally…

Dockerfiles from v6.6 onwards are available at https://github.com/elastic/dockerfiles

Re: Security for Elasticsearch is now free

#49

Post by Dylan16807 »

zaphirplane wrote: post #46
Dylan16807 wrote: post #42

Earlier quoted context omitted.

A service like this is more like someone giving you a ride. And if they don't have brake pads, and negligently get into a horrible wreck, one where they walk away unharmed while you are injured? You probably have a case there.

A case ? You want to sue an open source sw maker for not providing a feature for free because when you expose your ES to an insecure network without that feature you put yourself at risk ? How about you don’t put your ES in an insecure network without buying the feature or pay someone to write the feature for you. Your analogy is misleading and wrong, my mechanic one is better How about this I offer you a stranger a…

Data security isn't as serious of an issue as loss of limb, so there wouldn't be any legal wrongdoing in normal circumstances.

And no, your analogy doesn't make any sense. You keep talking about doing one thing for free, and refusing to do an entirely separate thing. That's very different from doing a thing for free but in a dangerous way.

And I'm not saying anything should be free anyway. Just that if you offer a service, don't make it pointlessly dangerous as an upsell tactic.

Re: Security for Elasticsearch is now free

#50

Post by mrmondo »

This (while perhaps not perfect) is massive for us, it’s going to be especially useful for Kibana authentication to add readonly and write users, something we’ve wanted for a long time but haven’t been able to afford as a non-profit, charitable organisation.

I know it’s not all 100% open source, but it’s better than a nginx reverse proxy hack or similar.

Thank you Elastic for continuing to create fantastic software.

Post reply on HN