3 ms·
What's the risk you're trying to protect against, that a "better" (which one?) way would mitigate that this one wouldn't? > IPA Do you mean https://en.wikiped
by noprocrasted 2y ago
What's the risk you're trying to protect against, that a "better" (which one?) way would mitigate that this one wouldn't?
> IPA
Do you mean https://en.wikipedia.org/wiki/FreeIPA https://en.wikipedia.org/wiki/FreeIPA ? That seems like a huge amalgamation of complexity in a non-memory-safe language that I feel like would introduce a much bigger security liability than the problem it's trying to solve.
I'd rather pony up the money and use Teleport at that point.
- dpe82 2y agoIt's basically Kerberos and an LDAP server, which are technologies old and reliable as dirt. This sort of FUD is why people needlessly spend so much money on cloud.
- noprocrasted 2y ago> which are technologies old and reliable as dirt. Technologies, sure. Implementations? Not so much. I can trust OpenSSH because it's deployed everywhere and I can be confident all the low-hanging fruits are gone by now, and if not, its widespreadness means I'm unlikely to be the most interesting target, so I am more likely to escape a potential zero-day unscathed. What't the marketshare of IPA in comparison? Has it seen any meaningful action in the last decade years, and the same attention, from both white-hats (audits, pentesting, etc) as well as black-hats (trying to break into every exposed service)? I very much doubt it, so the safe thing to assume is that it's nowhere as bulletproof as OpenSSH and that it's more likely for a dedicated attacker to find a vuln there.
- dpe82 2y agoMIT's Kerberos 5 implementation is 30 years old and has been very widely deployed.