5 ms·

I've been doing a lot of research on enterprise search products lately and one of the biggest issues is security. Unleashing search on corporate systems where

by rsobers 13y ago

I've been doing a lot of research on enterprise search products lately and one of the biggest issues is security. Unleashing search on corporate systems where permissions aren't managed really well is a big risk.

tedjdziuba 13y ago
[front matter: I worked on the Google Search Appliance and also administered Google's internal cluster of GSAs] The GSA is actually pretty good when it comes to security. There are a range of options (this was circa 2007, so the technology may have changed). You can configure the GSA to not show "snippets" in the search results. It's fairly easy to write a script that harvests an entire document from the index via snippets, so the GSA gives you the option to disable them. At a higher level, even though it takes some amount of configuration to pull off, you can get a GSA to proxy a client's credentials to the top N search results, to determine whether or not the client would have access to that document. If the client would not have access, then the result would not show up in the search results. Yes, this has a big performance impact, but it's the paranoid-level. Again, this was how it worked in ~2007, so it may have changed since.
MrBuddyCasino 13y ago
That has traditionally been the main objection to the google search appliance, or so I have been told - but the site now says the thing supports ACLs. Anyone has experience with that?
geerlingguy 13y ago
For some of our systems, we use Alfresco and/or Drupal, both which have Apache Solr as an easily-configurable search backend, and which works basically plug-and-play with the respective systems' content permissions. Using the free versions of all three (Solr + Drupal + Alfresco), search is fast and access-controlled very easily. I worked for a company that had a Google Search Appliance about 6 years ago, and, like others have said, it basically sat in a rack somewhere and collected dust once we started using some form of integrated search. The GSA was fast and relatively easy to use, but required an expensive initial purchase + ongoing licensing/update fees.

by rsobers 13y ago

tedjdziuba 13y ago

[front matter: I worked on the Google Search Appliance and also administered Google's internal cluster of GSAs] The GSA is actually pretty good when it comes to security. There are a range of options (this was circa 2007, so the technology may have changed). You can configure the GSA to not show "snippets" in the search results. It's fairly easy to write a script that harvests an entire document from the index via snippets, so the GSA gives you the option to disable them. At a higher level, even though it takes some amount of configuration to pull off, you can get a GSA to proxy a client's credentials to the top N search results, to determine whether or not the client would have access to that document. If the client would not have access, then the result would not show up in the search results. Yes, this has a big performance impact, but it's the paranoid-level. Again, this was how it worked in ~2007, so it may have changed since.

MrBuddyCasino 13y ago

That has traditionally been the main objection to the google search appliance, or so I have been told - but the site now says the thing supports ACLs. Anyone has experience with that?

geerlingguy 13y ago

For some of our systems, we use Alfresco and/or Drupal, both which have Apache Solr as an easily-configurable search backend, and which works basically plug-and-play with the respective systems' content permissions. Using the free versions of all three (Solr + Drupal + Alfresco), search is fast and access-controlled very easily. I worked for a company that had a Google Search Appliance about 6 years ago, and, like others have said, it basically sat in a rack somewhere and collected dust once we started using some form of integrated search. The GSA was fast and relatively easy to use, but required an expensive initial purchase + ongoing licensing/update fees.