5 ms·

> per-customer VLANs I am looking forward to that! Linode is my go-to hosting service, but it's a little troubling that anyone in the datacenter can hit your p

> per-customer VLANs I am looking forward to that! Linode is my go-to hosting service, but it's a little troubling that anyone in the datacenter can hit your private IPs [1]. On the other hand, maybe it shouldn't matter, and you should always act like the network is compromised. Isn't trusting their private network how Google leaked traffic to the NSA? Still, it seems like a nice improvement that would make compromises less likely. [1] https://blog.linode.com/2008/03/14/private-back-end-network-support/ https://blog.linode.com/2008/03/14/private-back-end-network-...

dimfeld 10y ago
Agreed. Back when I was using Linode I had a crazy setup that used iptables on each server to accept traffic only from my other servers. With benefit of hindsight I might have maintained it differently, but needless to say, it was a bit fragile.
misframer 10y ago
> On the other hand, maybe it shouldn't matter, and you should always act like the network is compromised. What about cases like AWS's VPCs?
- vgt 10y ago
  To add color to both your comment and parent's. Everything at Google Cloud is encrypted at rest and in transit [0]. Any GCE project is essentially a VPC by default, and a global one at that [1] (aka no need to VPN between regions). Traffic between GCE zones/regions never hits public wire by default ,and Google will carry your packet to the nearest Google POP around the world on its private backbone [2]. (work at Google Cloud, but not on networking/GCE) [0] https://cloud.google.com/security/encryption-at-rest/ https://cloud.google.com/security/encryption-at-rest/ [1] https://cloud.google.com/docs/compare/aws/ https://cloud.google.com/docs/compare/aws/ [2] http://peering.google.com/#/infrastructure http://peering.google.com/#/infrastructure
  - nodesocket 10y ago
    Nice, great information. Google Cloud has the networking model right.
  - bogomipz 10y ago
    Whats the data at rest model? LUKs? Edit. Never mind I see the link.

dimfeld 10y ago

Agreed. Back when I was using Linode I had a crazy setup that used iptables on each server to accept traffic only from my other servers. With benefit of hindsight I might have maintained it differently, but needless to say, it was a bit fragile.

misframer 10y ago

> On the other hand, maybe it shouldn't matter, and you should always act like the network is compromised. What about cases like AWS's VPCs?

vgt 10y ago
To add color to both your comment and parent's. Everything at Google Cloud is encrypted at rest and in transit [0]. Any GCE project is essentially a VPC by default, and a global one at that [1] (aka no need to VPN between regions). Traffic between GCE zones/regions never hits public wire by default ,and Google will carry your packet to the nearest Google POP around the world on its private backbone [2]. (work at Google Cloud, but not on networking/GCE) [0] https://cloud.google.com/security/encryption-at-rest/ https://cloud.google.com/security/encryption-at-rest/ [1] https://cloud.google.com/docs/compare/aws/ https://cloud.google.com/docs/compare/aws/ [2] http://peering.google.com/#/infrastructure http://peering.google.com/#/infrastructure
- nodesocket 10y ago
  Nice, great information. Google Cloud has the networking model right.
- bogomipz 10y ago
  Whats the data at rest model? LUKs? Edit. Never mind I see the link.