4 ms·
> Whitelist all needed IPs for business functionality I really don't like this mentality. The IP I'm serving some service might change. DNS is a useful thing.
by vel0city 2y ago
> Whitelist all needed IPs for business functionality
I really don't like this mentality. The IP I'm serving some service might change. DNS is a useful thing.
- deathanatos 2y agoSecurity types love it. But from a infra eng viewpoint, it's an utter pain in the ass, and the thought of "what if IP changes?" — which inevitably happens — has no process, no plan, and ends up as "manually update O(n) different configurations, of which there does not exist a list of, so you'll never know if you got them all."
- fifteen1506 2y agoYou're of course right. My proposal would fall flat on its face the moment that ocurred. Doesn't mean it couldn't work. See for example, Microsoft's ZeroTrust DNS.