5 ms·

Since when AWS is offering SNI on their load balancers? I work at a SaaS company and we were facing the same issue in the cloud and have to implement our own T

Since when AWS is offering SNI on their load balancers? I work at a SaaS company and we were facing the same issue in the cloud and have to implement our own TCP LB's to support SNI. I really hope we will see it in the near future but as i see it, Will I allow my clients to push bytecode into my production machines on demand with the lowest sandboxing possible to provide low execution times? I guess not.

tyingq 9y ago
They don't have SNI, but the newer ALB does have path based routing. So you can use a wild card or multidomain cert, if you can segment routes to endpoints by uri path.
manigandham 9y ago
Usually this is done with a CDN in front. Cloudfront supports SNI.
numbsafari 9y ago
As far as I know it doesn't. I should have been more clear: GCP's Anycast, no-warming-need LB is way cooler than AWS traditional, single-region with totally unreliable DNS "routing" on top (because you always want to rely on client DNS TTLs to handle a service cutover...). The problem is, if you can't use a TLS proxy for security reasons, then you can't use the HTTP(s) LB, which will make you less happy than if you could use it.
- zimbatm 9y ago
  In what scenarios is GCP's load-balancer not trusted but their compute instance is?
  - numbsafari 9y ago
    When, up until recently, not even Google was willing to cover their own load balancer under their BAA. The load balancer is a shared resource. Your data is being decrypted and re-encrypted in a shared memory space with all other customer's data. Consider the issue CloudFlare customers faced recently [1]. [1] https://techcrunch.com/2017/02/23/major-cloudflare-bug-leaked-sensitive-data-from-customers-websites/ https://techcrunch.com/2017/02/23/major-cloudflare-bug-leake...
    - vgt 9y ago
      I am not in compliance, but absence of evidence doesn't imply evidence of absence. Google Cloud has probably industry's highest security standards in place [0] . Getting governing bodies to sign off on their accreditations is a very separate issue. (work on Google Cloud) [0] https://cloud.google.com/security/whitepaper https://cloud.google.com/security/whitepaper

tyingq 9y ago

They don't have SNI, but the newer ALB does have path based routing. So you can use a wild card or multidomain cert, if you can segment routes to endpoints by uri path.

manigandham 9y ago

Usually this is done with a CDN in front. Cloudfront supports SNI.

numbsafari 9y ago

As far as I know it doesn't. I should have been more clear: GCP's Anycast, no-warming-need LB is way cooler than AWS traditional, single-region with totally unreliable DNS "routing" on top (because you always want to rely on client DNS TTLs to handle a service cutover...). The problem is, if you can't use a TLS proxy for security reasons, then you can't use the HTTP(s) LB, which will make you less happy than if you could use it.

zimbatm 9y ago
In what scenarios is GCP's load-balancer not trusted but their compute instance is?
- numbsafari 9y ago
  When, up until recently, not even Google was willing to cover their own load balancer under their BAA. The load balancer is a shared resource. Your data is being decrypted and re-encrypted in a shared memory space with all other customer's data. Consider the issue CloudFlare customers faced recently [1]. [1] https://techcrunch.com/2017/02/23/major-cloudflare-bug-leaked-sensitive-data-from-customers-websites/ https://techcrunch.com/2017/02/23/major-cloudflare-bug-leake...
  - vgt 9y ago
    I am not in compliance, but absence of evidence doesn't imply evidence of absence. Google Cloud has probably industry's highest security standards in place [0] . Getting governing bodies to sign off on their accreditations is a very separate issue. (work on Google Cloud) [0] https://cloud.google.com/security/whitepaper https://cloud.google.com/security/whitepaper