4 ms·
> Now we have SSL (do people really expose Redis on the internet??) There are no secure networks. Your options are vpn, third party ssl, or ssl in the service.
by e12e 7y ago
> Now we have SSL (do people really expose Redis on the internet??)
There are no secure networks. Your options are vpn, third party ssl, or ssl in the service. Sometimes, your datacenter/cloud will guarantee "secure" network (ie: manage vpn for you).
But in many instances having ssl "inside" can be simpler.
Postgres also offers secure transport.
- coleifer 7y agoI suppose I shouldn't be surprised at this level of pedantic cherry-picking, but yet... I still find myself bristling.
- justinclift 7y agoIt's a bit unclear what you're meaning? Reading over the comment you replied to, I was thinking similar myself. :/
- gregoriol 7y agoWhy not simply use wireguard instead of each tool implementing its own ssl support?
- paulryanrogers 7y agoWG is young, it probably didn't exist in a stable form when TLS took hold in most projects. It's possible it may dethrone TLS in the future
- d4mi3n 7y agoI think this could be workable, but it probably depends a lot on context. One reason off the top of my head would be regulatory/compliance issues around how things are encrypted. wireguard is relatively new, and some certifications required to do business in specific industries (finance, healthcare, etc) mandate protocols with a minimum level of maturity. wireguard may be good, but many regulators would probably not find it acceptable without a longer track record. On a more concrete note, I'd consider any system that handles authentication to be inherently broken if it had no way to keep those credentials safe out of the box. TLS has long been a cheap-ish way to do this, as it's widely available and well understood by both implements and regulators.
- contravariant 7y agoWhy virtualize the entire network layer when all you want is transport layer security?
- zymhan 7y agoExactly, far too much overhead. Also doesn't allow clients to easily connect.
- gregoriol 7y agoIt's much easier to configure once wireguard than configure on each application the ssl mecanism. Redis for example is very easy to use normally, but adding ssl makes it quite harder to setup/use.
- gregoriol 7y agoI'd feel more safe as an admin by knowing I only have 1 port and 1 app (ie wireguard) being public than 10 with their own ports and security (ie redis and others).
- contravariant 7y agoThis isn't about making things public, just resistant to tampering and sniffing. Yes if you want to connect networks together then wireguard is a good choice. If your devices are already on the same network and instead you close down the firewall and you move everything into wireguard you've just moved your problem.
- jkire 7y agoIt's worth noting that VPN / SSL proxies provide box to box (or process to box) encryption, whereas native SSL support provides process to process encryption. The difference being that if an attacker manages to get access to the box then it becomes easier to capture traffic due to it going unencrypted between the app and the VPN/SSL proxies. Fundamentally, native SSL support provides strictly better protection than just VPNs or SSL proxies. Now, given the context this may or may not be a distinction that you care about, but there certainly are times where you really do care. (Besides, if I'm running a tcpdump on a box to try and figure out why the network is going wibbly I'm a lot happier knowing all traffic is encrypted and I'm not going to accidentally capture some PII. I've had to tcpdump within docker containers before too, so putting everything in containers doesn't necessarily solve this.)
- e12e 7y agoThis is the "vpn" option. It's a valid option. I don't think tightly coupling ssl is always a good idea - I just don't think it's a bad idea as an option/feature. I don't use haproxy to secure my telnet sessions - I use ssh.
- ngrilly 7y agoWireGuard is amazing, but I don't want one network interface per service. We have TCP/UDP ports for this.
- jamsb 7y ago>> do people really expose Redis on the internet?? The same logic could be applied to exposed MongoDB and we know there's been a plethora of leaked data in recent years.
- nogabebop23 7y agohow is this comparable? SSL is secure transport - if you leave you mongoDB wide open people will just as happily steal your data over SSL. The problem was never MITM attacks on in-flight data.
- crest 7y agoWhat about cross datacenter replication.
- jiofih 7y agoIs nobody using containers? SSL termination through a local proxy sidecar? That gives you the best of both worlds.
- eropple 7y agoI don't run Redis, or anything else that has data storage, in a containerized environment. Those are dedicated machines to a dedicated purpose and I already have resource slicing and prioritization in place. They're called "virtual machines".
- NightlyDev 7y agoYou might be fully aware, but containers doesn't have to be docker/kubernetes. Previously OpenVZ, and now LXC/LXD is great for replacing full VMs in a lot of scenarios. The isolation is great and it's way less resource intensive than full containers.
- eropple 7y agoQuite aware, though others probably aren’t so it’s worth mentioning. But in my case, I press a button and I get an AWS or DigitalOcean or GCP instance. I like containers for my stuff. It’s silly, IMO, to doubly encapsulate my datastores.
- fgonzag 7y agoAdding SSL to redis is feature creep so you recommend instead running it as a container with a proxy sidecar.
- jiofih 7y agoWhich will look exactly the same for absolutely any Server you put behind it.