2 ms·
Do you have analogous search terms for Microsoft, Alphabet, Google, and Amazon's approaches? Your comment makes me curious on how guarantee-to-guarantee looks
by ethbr1 2y ago
Do you have analogous search terms for Microsoft, Alphabet, Google, and Amazon's approaches?
Your comment makes me curious on how guarantee-to-guarantee looks (and associated architectures).
- candiddevmike 2y agoMost of the stuff in the blog post reads like common security precautions: don't run as root, stateless immutable nodes, use secure boot, etc. All wrapped up in some Apple marketing pizzazz.
- ignoramous 2y ago> common security precautions ... marketing pizzazz. If it were this common, Meta, Google, and others would have announced or launched something similar for its consumer apps/services; I can't seem to recall anything of note.
- bowmessage 2y agohttps://cloud.google.com/docs/security/binary-authorization-for-borg https://cloud.google.com/docs/security/binary-authorization-... is one example
- threeseed 2y agoApple's system goes further by having incoming requests choose and verify a server and then encrypt itself using the public key of the node to prevent MITM attacks. And a one-time credential to prevent replay attacks. As well as minor things like obfuscating IP addresses, metadata etc.
- aaomidi 2y agoApples system is also the entire pipeline. Borg SREs can still change behavior here. It’s a lot better than what most places have but does not go far enough.
- sodality2 2y agoNone for consumer-facing products, though
- wmf 2y agohttps://cloud.google.com/blog/products/identity-security/confidential-vms-on-intel-cpus-your-datas-new-intelligent-defense https://cloud.google.com/blog/products/identity-security/con... https://cloud.google.com/blog/products/identity-security/expanding-confidential-computing-for-ai-workloads-next24 https://cloud.google.com/blog/products/identity-security/exp...