4 ms·

The part on VCs being risk averse when it comes to innovation is quite common: One company I worked with had an innovative idea for a firewall: build it with p

The part on VCs being risk averse when it comes to innovation is quite common: One company I worked with had an innovative idea for a firewall: build it with programmable logic and it works at wire speed. Wire speed meant no buffering, no data storage, and therefore no need for a microprocessor or for an IP (Internet Protocol) address. Simple installation, simple management, but so different that experts--even those from programmable logic companies--didn't understand it. To them, proposing a firewall without a microprocessor and an IP address was like proposing a car without an engine. No funding. Back to work at a big company. Worse for them; worse for us. The industry loses. Progress is delayed.

h2odragon 5y ago
For a while there some folks (cant recall the name) had a IPv4 firewall system based on DOS, with a similar idea of being an "out of band" filter that was not part of the network being filtered. Fact is, it's simple enough to do that with any OS and equally as hard to certify that the separations are actual and have no leaks. Now they're writing whole server/response chains in eBPF and stuff same idea but inverted, perhaps.
buro9 5y ago
> One company I worked with had an innovative idea for a firewall: build it with programmable logic and it works at wire speed Ah, that's the idea I had at Cloudflare and we then built it as Firewall Rules. Externally it looks like it's a HTTP feature only and just a WAF type tool, but internally it's an extremely fast matcher that can work on any traffic and at different OSI layers so it forms part of the DDoS protection, bot protection, magic transit, etc. It's also in things like the URI rewrite... because fundamentally it's all just "match things" and associate actions with the matched things, usually the actions are deny, rate limit, allow, challenge... but no reason the actions can't be to transform, duplicate, log, etc too. Just wireshark like matching at the equivalent of wire speed (for what that means at whatever layer you're working on) without having to have buffering or that pcap phase normally associated with firewalls or wireshark. The same wireshark-like rules can also be translated into SQL easily enough, so it's possible to run a firewall rule over the logs and see what would've matched (it isn't perfect, logging isn't that complete... but for the most common scenarios it works well enough). This work is OSS, the language syntax and a table matcher (used for the HTTP part) is all here https://github.com/cloudflare/wirefilter/tree/cloudflare https://github.com/cloudflare/wirefilter/tree/cloudflare and it's in Rust. For other systems the rule may be translated to eBPF for the matching part, etc. A blog post with an overview is here https://blog.cloudflare.com/how-we-made-firewall-rules/ https://blog.cloudflare.com/how-we-made-firewall-rules/ .
- yjftsjthsd-h 5y ago
  I'm pretty sure they're suggesting doing it all in hardware, not more clever software
  - melony 5y ago
    Microsoft and many other big data centers are now doing exactly this via FPGA NICs.
buescher 5y ago
Didn't Netscreen (acquired by Juniper) do basically that? I think they had an ASIC but I definitely remember their claim to fame was doing packet filtering in hardware.
woah 5y ago
Having dealt with VCs, I'm kind of confused by this comment. In my experience, they do not delve deeply into the tech. I'm guessing this is because most of their portfolio companies fail for non-technical reasons. They mostly assume that if you're pitching it, you can build it. To me it sounds like they were not convinced that the product would have any selling points over existing tech. Would this type of device save any money? Another thing that may have happened is that perhaps the pitch was heavily focused on the tech and it made their eyes glaze over.
- sangnoir 5y ago
  VCs tend to have an easier time funding already-validated ideas: having an established competitor, or seeing other VCs fund similar companies. It's lazy, but they can afford to be lazy - if they miss their chance on your revolutionary tech and you somehow succeed, they'll fund the next startup that copies you. The other day I saw a commenter who worked at a wind power startup that failed to get subsequent funding because Alphabet shutdown Makani, and their take away was the idea no longer seemed viable.
- gumby 5y ago
  > In my experience, they do not delve deeply into the tech. I suppose it depends on how deep the technology is. If you’re building a site using react, fine. If you’re developing a new semiconductor process or new pharmaceutical agent, they’ll want more info. My companies have all been of the latter sort, and so had serious technical DD. I’ve also done deep dive like that on behalf of investors.
  - woah 5y ago
    It sounds like their tech was somewhere in between these two extremes. I would expect that some engineers with relevant experience in networking and programmable logic could get it done. It's also not particularly novel- lots of networking stuff is offloaded to custom chips. My guess is that they didn't make a good business case for it, in which case I would have to dispute OP's idea that "progress was delayed".
nickdothutton 5y ago
Reminds me of the Sunscreen SPF-200 Firewall from the mid 90s. Interfaces has no IP address nor even an IP stack on them. It was effectively a secure bridge when operating in “stealth” mode. https://docs.oracle.com/cd/E19047-01/sunscreen31.sec/806-4128/6jd7s9o0d/index.html https://docs.oracle.com/cd/E19047-01/sunscreen31.sec/806-412...
repomies69 5y ago
The fact that VC's didn't invest in that single idea doesn't tell anything about them being risk averse or not.

h2odragon 5y ago

For a while there some folks (cant recall the name) had a IPv4 firewall system based on DOS, with a similar idea of being an "out of band" filter that was not part of the network being filtered. Fact is, it's simple enough to do that with any OS and equally as hard to certify that the separations are actual and have no leaks. Now they're writing whole server/response chains in eBPF and stuff same idea but inverted, perhaps.

buro9 5y ago

> One company I worked with had an innovative idea for a firewall: build it with programmable logic and it works at wire speed Ah, that's the idea I had at Cloudflare and we then built it as Firewall Rules. Externally it looks like it's a HTTP feature only and just a WAF type tool, but internally it's an extremely fast matcher that can work on any traffic and at different OSI layers so it forms part of the DDoS protection, bot protection, magic transit, etc. It's also in things like the URI rewrite... because fundamentally it's all just "match things" and associate actions with the matched things, usually the actions are deny, rate limit, allow, challenge... but no reason the actions can't be to transform, duplicate, log, etc too. Just wireshark like matching at the equivalent of wire speed (for what that means at whatever layer you're working on) without having to have buffering or that pcap phase normally associated with firewalls or wireshark. The same wireshark-like rules can also be translated into SQL easily enough, so it's possible to run a firewall rule over the logs and see what would've matched (it isn't perfect, logging isn't that complete... but for the most common scenarios it works well enough). This work is OSS, the language syntax and a table matcher (used for the HTTP part) is all here https://github.com/cloudflare/wirefilter/tree/cloudflare https://github.com/cloudflare/wirefilter/tree/cloudflare and it's in Rust. For other systems the rule may be translated to eBPF for the matching part, etc. A blog post with an overview is here https://blog.cloudflare.com/how-we-made-firewall-rules/ https://blog.cloudflare.com/how-we-made-firewall-rules/ .

yjftsjthsd-h 5y ago
I'm pretty sure they're suggesting doing it all in hardware, not more clever software
- melony 5y ago
  Microsoft and many other big data centers are now doing exactly this via FPGA NICs.

buescher 5y ago

Didn't Netscreen (acquired by Juniper) do basically that? I think they had an ASIC but I definitely remember their claim to fame was doing packet filtering in hardware.

woah 5y ago

Having dealt with VCs, I'm kind of confused by this comment. In my experience, they do not delve deeply into the tech. I'm guessing this is because most of their portfolio companies fail for non-technical reasons. They mostly assume that if you're pitching it, you can build it. To me it sounds like they were not convinced that the product would have any selling points over existing tech. Would this type of device save any money? Another thing that may have happened is that perhaps the pitch was heavily focused on the tech and it made their eyes glaze over.

sangnoir 5y ago
VCs tend to have an easier time funding already-validated ideas: having an established competitor, or seeing other VCs fund similar companies. It's lazy, but they can afford to be lazy - if they miss their chance on your revolutionary tech and you somehow succeed, they'll fund the next startup that copies you. The other day I saw a commenter who worked at a wind power startup that failed to get subsequent funding because Alphabet shutdown Makani, and their take away was the idea no longer seemed viable.
gumby 5y ago
> In my experience, they do not delve deeply into the tech. I suppose it depends on how deep the technology is. If you’re building a site using react, fine. If you’re developing a new semiconductor process or new pharmaceutical agent, they’ll want more info. My companies have all been of the latter sort, and so had serious technical DD. I’ve also done deep dive like that on behalf of investors.
- woah 5y ago
  It sounds like their tech was somewhere in between these two extremes. I would expect that some engineers with relevant experience in networking and programmable logic could get it done. It's also not particularly novel- lots of networking stuff is offloaded to custom chips. My guess is that they didn't make a good business case for it, in which case I would have to dispute OP's idea that "progress was delayed".

nickdothutton 5y ago

Reminds me of the Sunscreen SPF-200 Firewall from the mid 90s. Interfaces has no IP address nor even an IP stack on them. It was effectively a secure bridge when operating in “stealth” mode. https://docs.oracle.com/cd/E19047-01/sunscreen31.sec/806-4128/6jd7s9o0d/index.html https://docs.oracle.com/cd/E19047-01/sunscreen31.sec/806-412...

repomies69 5y ago

The fact that VC's didn't invest in that single idea doesn't tell anything about them being risk averse or not.