3 ms·

Can you please explain what you meant ? Are you saying we need to create a cloud service that is completely secure ( which we know is impossible ). My understa

Can you please explain what you meant ? Are you saying we need to create a cloud service that is completely secure ( which we know is impossible ). My understanding is that CloudFlare is already tackling the security aspects of hosted services and seem to be doing well.

donavanm 13y ago
> My understanding is that CloudFlare is already tackling the security aspects of hosted services Im curious; which aspects are they tackling, specifically? Authn, authz, byte validation... Or ?
ChuckMcM 13y ago
Can you please explain what you meant ? Sure, and note that my background has included secure systems design work. Secure systems operate under a couple of constraints. It is as you posit, impossible to make a 'completely secure' system, just as it is impossible to make a 'completely safe' airplane (and the 'impossible' here means that such a system continues to be usable or commercially viable). But generally if you can make a 'secure enough' or 'safe enough' system, then you can still make a business out of it. Using a fairly simple example, general residences in the US are not secured against experienced thieves, but in general experienced thieves aren't trying to steal things out of random houses, they go for specific houses. So the system "works" because you aren't getting broken into every day. And if the house next door is burglarized your house is no less secure than it was the day before. But in a cloud system the thieves get tremendous economy of scale, rather than breaking into one house they can break into every house in the city. In that way even if you don't have 'much' if you have anything they can steal it. Cloud computing both ties together high value and low value targets on the same system, and makes the total return of compromising the system higher in proportion to the number of users of that system. That is a real challenge because now everyone needs really really good locks on their houses, the costs go up and the usefulness goes down.

donavanm 13y ago

> My understanding is that CloudFlare is already tackling the security aspects of hosted services Im curious; which aspects are they tackling, specifically? Authn, authz, byte validation... Or ?

ChuckMcM 13y ago

Can you please explain what you meant ? Sure, and note that my background has included secure systems design work. Secure systems operate under a couple of constraints. It is as you posit, impossible to make a 'completely secure' system, just as it is impossible to make a 'completely safe' airplane (and the 'impossible' here means that such a system continues to be usable or commercially viable). But generally if you can make a 'secure enough' or 'safe enough' system, then you can still make a business out of it. Using a fairly simple example, general residences in the US are not secured against experienced thieves, but in general experienced thieves aren't trying to steal things out of random houses, they go for specific houses. So the system "works" because you aren't getting broken into every day. And if the house next door is burglarized your house is no less secure than it was the day before. But in a cloud system the thieves get tremendous economy of scale, rather than breaking into one house they can break into every house in the city. In that way even if you don't have 'much' if you have anything they can steal it. Cloud computing both ties together high value and low value targets on the same system, and makes the total return of compromising the system higher in proportion to the number of users of that system. That is a real challenge because now everyone needs really really good locks on their houses, the costs go up and the usefulness goes down.