6 ms·

If they offered just normal global addressing + firewalling, most of this complexity would just go away. We easily forget what the internet at the IP level is

If they offered just normal global addressing + firewalling, most of this complexity would just go away. We easily forget what the internet at the IP level is about and what problems its end-to-end architecture solves. AWS instructed "Well-Architected (TM)" networking is really just profitable cargo cult thinking leading to complexity, mazes of 10.x networks all alike peppered by address conflicts, kludgey proxies etc when you try to get them to talk to each other, less actual security (complexity is the enemy of security), and vendor lock-in.

znpy 3y ago
If they offered those solutions, knowing aws, it means that most likely customers requested them at some point.
- devonkim 3y ago
  And that’s part of the problem IME from the customer side. Many of the largest pockets come from those with the worst technical debt and cultural issues of past mistakes and trends all done precisely while trying to avoid said mistakes. While part of the point of many different vendors is for resiliency as an enterprise much of the complexity is frankly various forms of proprietary vendor lock-in tactics trying to entrench themselves in some way to these high value, low churn accounts which starts to become more of a politicking or spear phishing exercise to the C-suite than anything about the solution itself. Essentially, every other bad technology decision in hindsight comes from many of the underlying problems that cause people to develop rather poorly thought out, shallow opinions unrelated to technology - confirmation bias. As such, sales to me is one of the ultimately lucrative forms of social engineering attacks that oftentimes leaves the victim feeling like they got something when they really are just paying to feel like someone’s solving something for them.
bob1029 3y ago
> is really just profitable cargo cult thinking leading to complexity This neatly describes most things I see in tech.
- saiya-jin 3y ago
  Can't agree more, if decision makers would more often ask themselves 'should we do it' instead of 'how we can do it'. But engineers gotta engineer and managers gotta manage or they are obsolete. But then we would have fraction of projects and work and just evolved systems created decade or two ago, with much lower IT costs. A total nightmare I say.
cj 3y ago
Isn't this sort of what Amazon Lightsail is? (Haven't actually used it, but am under the impression it abstracts away networking config). I'll probably get downvoted, but isn't global addressing + firewalling basically available by creating a VPC with only public subnets, and using security groups as your firewall? (Best practice is public/private subnets with NAT gateways, but it's probably not impossible to rely only on security groups)
- joeig 3y ago
  Either Lightsail, or just the default VPC that all AWS accounts come with. If you think your use case needs private/public subnets, NAT, complex routing tables, etc. you can still add that to the default VPC later. A few years ago, when what we now call EC2 classic was a thing, there were no sophisticated networking options at all. I assume VPC and its services were introduced because customers asked for something that feels like traditional datacenter networking.
  - steveBK123 3y ago
    This stuff is obviously so hard to use that even the experts don't know wtf they are doing. At a prev shop, they undersized the VPC had sporadic failures of burst compute like spot instances that got spun up by other AWS services (Batch) to work through job queues. Neither the cloud architect or CloudOps lead could resolve this for months, or even temporarily prevent the breaches, until a big VPC resize / reshuffle / migration over a weekend. Probably $1M/year TC between these two guys. Incredible stuff. Felt like on-prem kind of stuff that I was reliably told the cloud solved.
    - pid-1 3y ago
      You totally could undersize an on-prem private network, I don't get how that's an AWS specific issue.
      - steveBK123 3y ago
        Note “ Felt like on-prem kind of stuff that I was reliably told the cloud solved.” That is - why did cloud just give you the foot guns to produce the same bad outcome that took a similarly long time to resolve? Why wasn’t this a click button change with zero interrupt ?
steveBK123 3y ago
It's also nuts to me that we take senior engineers who have domain expertise in solving business problems, and thanks to "the cloud", I'm supposed to become DevOps/NetworkOps/SecOps and terraform my way to the perfect networking/firewall/cybersecurity/etc solution for my application. It's not like the old sysadmins made 1/2 or 1/4 of my comp, and usually 1 of them managed enough hardware to cover 100 devs. So we are talking what, a 0.5% overhead for the rest of us to avoid mission creep & brain damage of this stuff? Literal "Death of Expertise" here with AWS yet again.
holografix 3y ago
You mean like Google Cloud where a VPC is global and subnets can be default created for each region? And that’s behind a global anycast IP.
- nostrebored 3y ago
  And the network failures happen more with wider impact?
ec109685 3y ago
With IPv6, Shared VPC’s and VPC peering, a lot of this cost and complexity can be eliminated.
2-718-281-828 3y ago
it's basically embrace (use accepted concepts like ip, network interface, subnet etc), then extend (make it easier to work with those concepts at least for simple use cases), then extinguish (network services only look like the real thing).
DiffEq 3y ago
There is more to it; many companies have security organizations that insist on bringing the same security concepts as they have on prem to the cloud; many regulators do as well, so this requires a lot of what we see in terms of the unnecessary complexity in the cloud in terms of networking.
znpy 3y ago
10.x subnets conflicting around is kinda the norm outside if the cloud too. I’ve seen that myself while configuring a vpn between two companies, and ultimately we had to do some kind of nat trickery to get the thing going. The solution would be ipv6 and ula prefixes, but that’s another can of worms. I’d love to see it implemeted, but stay assured it’ll come with its own set of issues, complexities and difficulties.
- fulafel 3y ago
  Just use normal routable v6 space.
  - znpy 3y ago
    You might not want to expose stuff on the public internet, you know
    - mdaniel 3y ago
      Well, then thank goodness IPv6 also still supports firewall rules. It is a whole different discussion when one wishes to conditionally allow Office Building 1 of a company to connect to Office Building 2 of that same company by updating some ingress rules versus the "well, site-to-site VPN sometimes works and stays up the whole workday"

znpy 3y ago

If they offered those solutions, knowing aws, it means that most likely customers requested them at some point.

devonkim 3y ago
And that’s part of the problem IME from the customer side. Many of the largest pockets come from those with the worst technical debt and cultural issues of past mistakes and trends all done precisely while trying to avoid said mistakes. While part of the point of many different vendors is for resiliency as an enterprise much of the complexity is frankly various forms of proprietary vendor lock-in tactics trying to entrench themselves in some way to these high value, low churn accounts which starts to become more of a politicking or spear phishing exercise to the C-suite than anything about the solution itself. Essentially, every other bad technology decision in hindsight comes from many of the underlying problems that cause people to develop rather poorly thought out, shallow opinions unrelated to technology - confirmation bias. As such, sales to me is one of the ultimately lucrative forms of social engineering attacks that oftentimes leaves the victim feeling like they got something when they really are just paying to feel like someone’s solving something for them.

bob1029 3y ago

> is really just profitable cargo cult thinking leading to complexity This neatly describes most things I see in tech.

saiya-jin 3y ago
Can't agree more, if decision makers would more often ask themselves 'should we do it' instead of 'how we can do it'. But engineers gotta engineer and managers gotta manage or they are obsolete. But then we would have fraction of projects and work and just evolved systems created decade or two ago, with much lower IT costs. A total nightmare I say.

cj 3y ago

Isn't this sort of what Amazon Lightsail is? (Haven't actually used it, but am under the impression it abstracts away networking config). I'll probably get downvoted, but isn't global addressing + firewalling basically available by creating a VPC with only public subnets, and using security groups as your firewall? (Best practice is public/private subnets with NAT gateways, but it's probably not impossible to rely only on security groups)

joeig 3y ago
Either Lightsail, or just the default VPC that all AWS accounts come with. If you think your use case needs private/public subnets, NAT, complex routing tables, etc. you can still add that to the default VPC later. A few years ago, when what we now call EC2 classic was a thing, there were no sophisticated networking options at all. I assume VPC and its services were introduced because customers asked for something that feels like traditional datacenter networking.
- steveBK123 3y ago
  This stuff is obviously so hard to use that even the experts don't know wtf they are doing. At a prev shop, they undersized the VPC had sporadic failures of burst compute like spot instances that got spun up by other AWS services (Batch) to work through job queues. Neither the cloud architect or CloudOps lead could resolve this for months, or even temporarily prevent the breaches, until a big VPC resize / reshuffle / migration over a weekend. Probably $1M/year TC between these two guys. Incredible stuff. Felt like on-prem kind of stuff that I was reliably told the cloud solved.
  - pid-1 3y ago
    You totally could undersize an on-prem private network, I don't get how that's an AWS specific issue.
    - steveBK123 3y ago
      Note “ Felt like on-prem kind of stuff that I was reliably told the cloud solved.” That is - why did cloud just give you the foot guns to produce the same bad outcome that took a similarly long time to resolve? Why wasn’t this a click button change with zero interrupt ?

steveBK123 3y ago

It's also nuts to me that we take senior engineers who have domain expertise in solving business problems, and thanks to "the cloud", I'm supposed to become DevOps/NetworkOps/SecOps and terraform my way to the perfect networking/firewall/cybersecurity/etc solution for my application. It's not like the old sysadmins made 1/2 or 1/4 of my comp, and usually 1 of them managed enough hardware to cover 100 devs. So we are talking what, a 0.5% overhead for the rest of us to avoid mission creep & brain damage of this stuff? Literal "Death of Expertise" here with AWS yet again.

holografix 3y ago

You mean like Google Cloud where a VPC is global and subnets can be default created for each region? And that’s behind a global anycast IP.

nostrebored 3y ago
And the network failures happen more with wider impact?

ec109685 3y ago

With IPv6, Shared VPC’s and VPC peering, a lot of this cost and complexity can be eliminated.

2-718-281-828 3y ago

it's basically embrace (use accepted concepts like ip, network interface, subnet etc), then extend (make it easier to work with those concepts at least for simple use cases), then extinguish (network services only look like the real thing).

DiffEq 3y ago

There is more to it; many companies have security organizations that insist on bringing the same security concepts as they have on prem to the cloud; many regulators do as well, so this requires a lot of what we see in terms of the unnecessary complexity in the cloud in terms of networking.

znpy 3y ago

10.x subnets conflicting around is kinda the norm outside if the cloud too. I’ve seen that myself while configuring a vpn between two companies, and ultimately we had to do some kind of nat trickery to get the thing going. The solution would be ipv6 and ula prefixes, but that’s another can of worms. I’d love to see it implemeted, but stay assured it’ll come with its own set of issues, complexities and difficulties.

fulafel 3y ago
Just use normal routable v6 space.
- znpy 3y ago
  You might not want to expose stuff on the public internet, you know
  - mdaniel 3y ago
    Well, then thank goodness IPv6 also still supports firewall rules. It is a whole different discussion when one wishes to conditionally allow Office Building 1 of a company to connect to Office Building 2 of that same company by updating some ingress rules versus the "well, site-to-site VPN sometimes works and stays up the whole workday"