5 ms·

Why are internally hosted instances even available on the public internet?

Closi 5y ago
So that users can be at home or on a mobile device without requiring them to have VPN. But so that you still can ensure data-locality or run a customised instance e.t.c. if you have requirements around that. Plus licensing is approx. 40% of the full SaaS cost at scale so may be cheaper to deploy that way.
- CodeGlitch 5y ago
  But why are they not using VPN?
  - hanselot 5y ago
    For the same reason docker exists. Convenience and lack of understanding.
  - ianai 5y ago
    Probably because they’re on a mobile device or essentially monitoring 24/7 would be my guess.
  - raesene9 5y ago
    common reasons could be :- - Cost, VPNs and the hardware to run them can be expensive - Single point of failure. If you run all your remote access through a VPN gateway then you run the risk of disruption if it goes down. Of course you can implement redundnt/multiple gateways but that increases cost. - Complexity for B2B setups. If you're exposing an API and you want third party services to access it, it can be more complex if there's a VPN involved. All that said, I still wouldn't run something like this (or indeed most services) directly on the Internet as it's a single vuln. away from problems, however I've seen plenty of services directly visible on the Internet for these reasons. You can spelunk around one of the search engines like Shodan or Censys to get an idea of how many people run application services directly on the Internet.
    - deadbunny 5y ago
      A pair of openvpn servers will run you about $100/month in AWS. Sure there is some overhead in running them but not anything more than any other server. Maybe I'm just a jaded Sysop but this stuff is networking 101.
      - raesene9 5y ago
        Sure and if you're on AWS you can use their managed offerings. There's a variety of ways of solving it, but it depends on people seeing it as an issue to be solved. I think, unfortunately, what a lot of people take away from "zero trust networks" as a concept is get rid of all bastions/VPNs and firewalls, but that ultimately leads to the topic of this article...
    - mbesto 5y ago
      If all of these are reasons, then you should use the cloud version. In other words, if your project management solution needs to be hosted for some business reason and you can't afford all of the maintenance required to host it properly, then you aren't charging enough for your product.
  - fnord77 5y ago
    our VPN is a PITA to connect to. being connected all the time sucks for zoom meetings as the vpn server is on the other side of the continent. I love having access to most of my work tools outside the vpn - github, confluence, jira, aws console.
  - chrisseaton 5y ago
    Some people think VPNs are harmful - see the Google BeyondCorp model.
  - Closi 5y ago
    As well as all the other great reasons listed, you might not want users to have a VPN if for instance they are an external user (e.g. if your client's documentation is on your confluence instance and you want to give them access, it might be a giant pain and bad customer experience to force them to sign into your VPN in order to get access to their documentation).
PaulWaldman 5y ago
For those that believe in the zero trust model, don't all apps and services become exposed to the public internet?
- ev1 5y ago
  They are generally exposed through a proxy that sits in between. If you don't authenticate, you can't send a request to it at all. (This is opposed to the lazy model, where your aplication is fully exposed to the web and you click log in and it redirects to SSO - if there is a vulnerability that doesn't require authentication you're already compromised) The proxy will handle sign in and passes traffic to/from the webserver backend, and you should not be able to send a single HTTP request to the underlying application without the proxy capturing authentication and who the user that sent the request was.
  - PaulWaldman 5y ago
    Do these proxies encrypt the traffic? Since they would handle authentication, I am guessing encryption is used. We may be getting into semantics, but at that point, is there much of a difference between a proxy and a VPN? I had the impression that in a zero trust environment all apps are required to be hardened to the point that they are deemed safe to be exposed to the publc internet.
    - cheschire 5y ago
      VPNs are a very different technology. The amount of network traffic alone is a huge difference. You may be confusing inbound and outbound proxies. If an inbound proxy is put in front of a server, it is able to be extremely hardened without exposing the webserver, and only allows traffic in extremely limited ways. This frees up the webserver to be more open to the internal network, obfuscates information about the webserver to outsiders, etc. You may be thinking of an outbound proxy where all of your web requests travel through it in order to provide web filtering, protected DNS, and other protective services to internal endpoints and clients that are already on your network. A VPN is a much deeper connection than an inbound proxy. It typically requires the external endpoint to be trusted, which is the complete opposite state of an endpoint connecting through an inbound proxy. It then allows the endpoint to operate from a position of trust within the whole internal network. Patches can be updated, endpoints can communicate with each other, and the full network traffic of the endpoint routes through the network. With a VPN you even wind up going through the outbound proxy typically! YMMV though, not every org is setup exactly like this. I’m making gross generalizations about things. Definitely do some web searches on the differences.
mrweasel 5y ago
Because you might need it to share documentation with customers. Confluence isn't just for external documentation. Confluence, at it's core, is just a wiki. Sometimes it needs to be available online, sometimes it really doesn't.
- chrisseaton 5y ago
  If you’re ok sharing things externally why self-host at all?
  - JumpCrisscross 5y ago
    > If you’re ok sharing things externally why self-host at all? You're theoretically more in control of the data, which may be a legal requirement in certain jurisdictions and/or industries.
    - draugadrotten 5y ago
      Due to the "TOLA" Australian law, all Atlassian products should be avoided if you care about being in control of the data. https://www.zdnet.com/article/whats-actually-in-australias-encryption-laws-everything-you-need-to-know/ https://www.zdnet.com/article/whats-actually-in-australias-e...
    - millerm 5y ago
      Atlassian is not HIPAA compliant, so many are forced to install their tools on on-prem.
      - mrweasel 5y ago
        Which is one of the reasons why Atlassians discontinuation of their server offering is so problematic. There's a number of smaller businesses which could use Atlassian Cloud, but between HIPAA, Schrems II and GDPR that's currently not possible, and the datacenter license is simply too expensive.
    - mrweasel 5y ago
Aachen 5y ago
Same reason as why Wikipedia or Wikia or other wikis are public?

So that users can be at home or on a mobile device without requiring them to have VPN. But so that you still can ensure data-locality or run a customised instance e.t.c. if you have requirements around that. Plus licensing is approx. 40% of the full SaaS cost at scale so may be cheaper to deploy that way.

CodeGlitch 5y ago
But why are they not using VPN?
- hanselot 5y ago
  For the same reason docker exists. Convenience and lack of understanding.
- ianai 5y ago
  Probably because they’re on a mobile device or essentially monitoring 24/7 would be my guess.
- raesene9 5y ago
  common reasons could be :- - Cost, VPNs and the hardware to run them can be expensive - Single point of failure. If you run all your remote access through a VPN gateway then you run the risk of disruption if it goes down. Of course you can implement redundnt/multiple gateways but that increases cost. - Complexity for B2B setups. If you're exposing an API and you want third party services to access it, it can be more complex if there's a VPN involved. All that said, I still wouldn't run something like this (or indeed most services) directly on the Internet as it's a single vuln. away from problems, however I've seen plenty of services directly visible on the Internet for these reasons. You can spelunk around one of the search engines like Shodan or Censys to get an idea of how many people run application services directly on the Internet.
  - deadbunny 5y ago
    A pair of openvpn servers will run you about $100/month in AWS. Sure there is some overhead in running them but not anything more than any other server. Maybe I'm just a jaded Sysop but this stuff is networking 101.
    - raesene9 5y ago
      Sure and if you're on AWS you can use their managed offerings. There's a variety of ways of solving it, but it depends on people seeing it as an issue to be solved. I think, unfortunately, what a lot of people take away from "zero trust networks" as a concept is get rid of all bastions/VPNs and firewalls, but that ultimately leads to the topic of this article...
  - mbesto 5y ago
    If all of these are reasons, then you should use the cloud version. In other words, if your project management solution needs to be hosted for some business reason and you can't afford all of the maintenance required to host it properly, then you aren't charging enough for your product.
- fnord77 5y ago
  our VPN is a PITA to connect to. being connected all the time sucks for zoom meetings as the vpn server is on the other side of the continent. I love having access to most of my work tools outside the vpn - github, confluence, jira, aws console.
- chrisseaton 5y ago
  Some people think VPNs are harmful - see the Google BeyondCorp model.
- Closi 5y ago
  As well as all the other great reasons listed, you might not want users to have a VPN if for instance they are an external user (e.g. if your client's documentation is on your confluence instance and you want to give them access, it might be a giant pain and bad customer experience to force them to sign into your VPN in order to get access to their documentation).

PaulWaldman 5y ago

For those that believe in the zero trust model, don't all apps and services become exposed to the public internet?

ev1 5y ago
They are generally exposed through a proxy that sits in between. If you don't authenticate, you can't send a request to it at all. (This is opposed to the lazy model, where your aplication is fully exposed to the web and you click log in and it redirects to SSO - if there is a vulnerability that doesn't require authentication you're already compromised) The proxy will handle sign in and passes traffic to/from the webserver backend, and you should not be able to send a single HTTP request to the underlying application without the proxy capturing authentication and who the user that sent the request was.
- PaulWaldman 5y ago
  Do these proxies encrypt the traffic? Since they would handle authentication, I am guessing encryption is used. We may be getting into semantics, but at that point, is there much of a difference between a proxy and a VPN? I had the impression that in a zero trust environment all apps are required to be hardened to the point that they are deemed safe to be exposed to the publc internet.
  - cheschire 5y ago
    VPNs are a very different technology. The amount of network traffic alone is a huge difference. You may be confusing inbound and outbound proxies. If an inbound proxy is put in front of a server, it is able to be extremely hardened without exposing the webserver, and only allows traffic in extremely limited ways. This frees up the webserver to be more open to the internal network, obfuscates information about the webserver to outsiders, etc. You may be thinking of an outbound proxy where all of your web requests travel through it in order to provide web filtering, protected DNS, and other protective services to internal endpoints and clients that are already on your network. A VPN is a much deeper connection than an inbound proxy. It typically requires the external endpoint to be trusted, which is the complete opposite state of an endpoint connecting through an inbound proxy. It then allows the endpoint to operate from a position of trust within the whole internal network. Patches can be updated, endpoints can communicate with each other, and the full network traffic of the endpoint routes through the network. With a VPN you even wind up going through the outbound proxy typically! YMMV though, not every org is setup exactly like this. I’m making gross generalizations about things. Definitely do some web searches on the differences.

mrweasel 5y ago

Because you might need it to share documentation with customers. Confluence isn't just for external documentation. Confluence, at it's core, is just a wiki. Sometimes it needs to be available online, sometimes it really doesn't.

chrisseaton 5y ago
If you’re ok sharing things externally why self-host at all?
- JumpCrisscross 5y ago
  > If you’re ok sharing things externally why self-host at all? You're theoretically more in control of the data, which may be a legal requirement in certain jurisdictions and/or industries.
  - draugadrotten 5y ago
    Due to the "TOLA" Australian law, all Atlassian products should be avoided if you care about being in control of the data. https://www.zdnet.com/article/whats-actually-in-australias-encryption-laws-everything-you-need-to-know/ https://www.zdnet.com/article/whats-actually-in-australias-e...
  - millerm 5y ago
    Atlassian is not HIPAA compliant, so many are forced to install their tools on on-prem.
    - mrweasel 5y ago
      Which is one of the reasons why Atlassians discontinuation of their server offering is so problematic. There's a number of smaller businesses which could use Atlassian Cloud, but between HIPAA, Schrems II and GDPR that's currently not possible, and the datacenter license is simply too expensive.
  - mrweasel 5y ago

Aachen 5y ago

Same reason as why Wikipedia or Wikia or other wikis are public?