3 ms·
Yes, outbound only is great for client side and for me table stakes. OpenZiti allows you to make the server side outbound only too. Do you care about Log4Shell
by PLG88 4y ago
Yes, outbound only is great for client side and for me table stakes. OpenZiti allows you to make the server side outbound only too. Do you care about Log4Shell or Spring4Shell when your server is dark to the internet? Java Magazine recently did a piece on it as the OpenZiti team 'zitified Springboot' - https://blogs.oracle.com/javamagazine/post/java-zero-trust-openziti https://blogs.oracle.com/javamagazine/post/java-zero-trust-o.... We also recently zitified Prometheus - https://openziti.github.io/articles/zitification/prometheus/part1.html https://openziti.github.io/articles/zitification/prometheus/...... private, outbound-only connectivity natively part of the code.
- GekkePrutser 4y agoOh that's interesting. But how do the server and clients manage to find one another then? Indeed an outbound-only server is a discerning feature and a huge security advantage. I should really read up on it. I know... I will soon!
- PLG88 4y agoOpenZiti has an architecture of 'Edge' and 'fabric'. The Edge is at source and destinatation and outbound connects into the fabric. The fabric is SDN, edge connects and authenticates/authorises to controller based on embedded identity, then based on policy and rules, outbound connects to the data plane using smart routing over the mesh. The fabric only 'listens' for endpoints which have embedded, correct identity based on a process called 'bootstrapping trust' (there is a 5 part blog on this). Clint and Ken did a really good ZitiTV on Friday which covered many of the cool superpowers of OpenZiti - https://www.youtube.com/watch?v=4wOGvZqN6Co&ab_channel=OpenZiti https://www.youtube.com/watch?v=4wOGvZqN6Co&ab_channel=OpenZ...