3 ms·

Talking technology, VMware NSX is the best SDN out there. You can do all the things the competition does but with zero programing.

by ewams 10y ago

bluejekyll 10y ago
SDN's are an artifact of classic networking mindsets. There is no air gap, pretending one exists by creating a virtual one is just being blind to the realities of network gear. We need to move beyond SDN and embrace a point-to-point world where trust is established through pki or similar means. SDNs give a false sense of security, add a ridiculous amount of complexity to routing, and create confusion when it's unclear if there is a hardware problem or a software problem. SDNs are only there because people aren't innovating enough in other layers.
- hueving 10y ago
  Your comment makes no sense. SDN just provides the same barriers as regular network hardware in an automated and more flexible nature. It has nothing to do with data plane confidentiality.
  - vog 10y ago
    > SDN just provides the same barriers as regular network hardware in an automated and more flexible nature Unless the implementation has bugs. Then, the sensitive area is just a single zeroday away. Airgaps don't have that attack surface.
    - vidarh 10y ago
      But it's not a replacement for air gaps. It's a replacement for things like logging into your switch to manually set up vlans. I agree with your previous point that we should encrypt point to point, but that's one layer up from the problems SDN is solving.
      - vog 10y ago
        > I agree with your previous point that we should encrypt point to point ... Just for clarification: That was written by bluejekyll, not by me.
  - bluejekyll 10y ago
    SDNs add complexity, and are only necessary because of limitations in the networking protocols. They add extra failure modes and reduce throughput by decreasing MTU. This is almost all because people want virtual networks with their VMs, rather than just embracing IPv6.
- gsmethells 10y ago
  Yep. This the classic end-to-end argument, a white paper all CS grads must read https://en.m.wikipedia.org/wiki/End-to-end_principle https://en.m.wikipedia.org/wiki/End-to-end_principle

Talking technology, VMware NSX is the best SDN out there. You can do all the things the competition does but with zero programing.

by ewams 10y ago

Talking technology, VMware NSX is the best SDN out there. You can do all the things the competition does but with zero programing.

bluejekyll 10y ago

SDN's are an artifact of classic networking mindsets. There is no air gap, pretending one exists by creating a virtual one is just being blind to the realities of network gear. We need to move beyond SDN and embrace a point-to-point world where trust is established through pki or similar means. SDNs give a false sense of security, add a ridiculous amount of complexity to routing, and create confusion when it's unclear if there is a hardware problem or a software problem. SDNs are only there because people aren't innovating enough in other layers.

hueving 10y ago
Your comment makes no sense. SDN just provides the same barriers as regular network hardware in an automated and more flexible nature. It has nothing to do with data plane confidentiality.
- vog 10y ago
  > SDN just provides the same barriers as regular network hardware in an automated and more flexible nature Unless the implementation has bugs. Then, the sensitive area is just a single zeroday away. Airgaps don't have that attack surface.
  - vidarh 10y ago
    But it's not a replacement for air gaps. It's a replacement for things like logging into your switch to manually set up vlans. I agree with your previous point that we should encrypt point to point, but that's one layer up from the problems SDN is solving.
    - vog 10y ago
      > I agree with your previous point that we should encrypt point to point ... Just for clarification: That was written by bluejekyll, not by me.
- bluejekyll 10y ago
  SDNs add complexity, and are only necessary because of limitations in the networking protocols. They add extra failure modes and reduce throughput by decreasing MTU. This is almost all because people want virtual networks with their VMs, rather than just embracing IPv6.
gsmethells 10y ago
Yep. This the classic end-to-end argument, a white paper all CS grads must read https://en.m.wikipedia.org/wiki/End-to-end_principle https://en.m.wikipedia.org/wiki/End-to-end_principle