4 ms·

> "Locked down racks" is complete FUD. That was my point. I'd much rather have them Amazon boys or Google boys take care of my data than my own sysadmin team -

> "Locked down racks" is complete FUD. That was my point. I'd much rather have them Amazon boys or Google boys take care of my data than my own sysadmin team - the Amazon/Google sysadmins are sharp, they apply all patches, and they have procedures in place to make sure they don't do anything incredibly stupid. The fact they don't mention how they store any of this information that could have potential career altering affects bothers the heck out of me. I'd much rather they just say that they stored everything in AWS, than run their own bare metal.

TheDong 10y ago
What you're saying is even more FUD though. Using AWS EC2 or GCE's compute doesn't mean you aren't responsible for sysadmining. You still have to patch your boxes, you still have not do incredibly stupid things. The actual security difference between servers on a rack and virtual machines in a cloud is roughly a dozen ip-tables rules (security groups).
- jimmywanger 10y ago
  There are two levels, IaaS and PaaS. For IaaS, I agree that you're responsible for some sysadmining, but you start from a known good point in that bare VM OS images (for CentOS, Ubuntu, Windows, etc) will probably have all the appropriate patches applied and up to date. Of course you're on your own when it comes to spinning up your programs to make sure SQL injection doesn't work, etc etc. PaaS is another thing. In that case, if you're using AppEngine or ElasticBeanstalk or Heroku, you don't have to worry about the base infrastructure or the datastore at all. They should have all the relevant security patches applied at all times, which really cuts down the attack area to just your app, not the web server, datastore, or OS vulnerabilities.
byuu 10y ago
> the Amazon/Google sysadmins are sharp, they apply all patches, and they have procedures in place to make sure they don't do anything incredibly stupid. I shared that viewpoint when I was hosting my forum on InMotion Hosting. Until they first applied an update that resulted in Apache returning all PHP files as plaintext files, revealing my SQL login credentials from the phpBB config file (thankfully I had remote DB login disabled.) And then a few weeks later, badly corrupting my entire SQL database and not being able to restore it after. I doubt Amazon/Google could be as incompetent as InMotion was, but all the same, don't trust that just because it's a company that specializes in something that you're safe from abject stupidity.

TheDong 10y ago

What you're saying is even more FUD though. Using AWS EC2 or GCE's compute doesn't mean you aren't responsible for sysadmining. You still have to patch your boxes, you still have not do incredibly stupid things. The actual security difference between servers on a rack and virtual machines in a cloud is roughly a dozen ip-tables rules (security groups).

jimmywanger 10y ago
There are two levels, IaaS and PaaS. For IaaS, I agree that you're responsible for some sysadmining, but you start from a known good point in that bare VM OS images (for CentOS, Ubuntu, Windows, etc) will probably have all the appropriate patches applied and up to date. Of course you're on your own when it comes to spinning up your programs to make sure SQL injection doesn't work, etc etc. PaaS is another thing. In that case, if you're using AppEngine or ElasticBeanstalk or Heroku, you don't have to worry about the base infrastructure or the datastore at all. They should have all the relevant security patches applied at all times, which really cuts down the attack area to just your app, not the web server, datastore, or OS vulnerabilities.

byuu 10y ago

> the Amazon/Google sysadmins are sharp, they apply all patches, and they have procedures in place to make sure they don't do anything incredibly stupid. I shared that viewpoint when I was hosting my forum on InMotion Hosting. Until they first applied an update that resulted in Apache returning all PHP files as plaintext files, revealing my SQL login credentials from the phpBB config file (thankfully I had remote DB login disabled.) And then a few weeks later, badly corrupting my entire SQL database and not being able to restore it after. I doubt Amazon/Google could be as incompetent as InMotion was, but all the same, don't trust that just because it's a company that specializes in something that you're safe from abject stupidity.