11 ms·
Azure is now bigger, faster, more open, and more secure
- higherpurpose 12y agoI assume Microsoft itself has access to the keys in the Key Vault?
- lstamour 12y agoSure, you can make that assumption. Even with an HSM protecting things, they still own and manage the HSM, not you. But then the same can be said for everything else you run in Microsoft's cloud or any other service provider, really. Once I read that the NSA would sometimes take computers from transport and modify them, I realized the NSA is the type of persistent threat you simply can't avoid. It can't be helped in this day and age. For more on the HSM service and how it works: http://blogs.technet.com/b/kv/ http://blogs.technet.com/b/kv/
- smacktoward 12y agoCan't be helped technically. The way you solve problems like this is with strong laws and vigorous enforcement, not more/different/better tech.
- mc808 12y agoThat's completely backwards when people break the laws with impunity and/or the threat to security is law enforcement and the rest of the legal system. At best, laws are a temporary stop-gap measure until the technology is capable and verifiable.
- higherpurpose 12y agoWhy can't the keys be managed in an end-to-end fashion? Wasn't it Cloudflare announcing something like that a few months ago, with clients having their own key-servers that Cloudflare itself can't access?
- lstamour 12y agoThey can be, but this avoids the round-trip time entirely. Microsoft's not forcing you to keep your secrets in the cloud if you don't want to, what they're saying is, "you don't have to run it all yourself if you don't want to" or for those already in the cloud, "it's more secure (or audit-able, at least) to store and share secrets using an HSM than to use plain-text on a hard drive". Of course, nothing's perfect, and even your secrets will eventually end up in RAM, but that's why they call it "defense-in-depth" right? Plus, it means if you're encrypting something, you can use the HSM to do it and know that only the HSM box has the keys to what you're encrypting, and it's dedicated and designed for that task. I personally like HSMs as a concept and look forward to lower cost options as we rely more on encryption in the cloud.
- higherpurpose 12y agoI realize the "it's easier" part. That's why most of us use email over TLS/STARTTLS instead of PGP. However, I don't think Microsoft is going to address the "trust" issue foreign governments and companies have with American clouds right now. Granted, I'm only picking on Microsoft because they are announcing this now, and I think they could've done better. But I assume Amazon and Google's encryption also relies on "trusting them" (+ the US gov). They all need to adopt more end-to-end solutions from end-user services to enterprise cloud services. Perhaps especially for enterprise cloud services, since I think they have more to lose by putting their trust in the cloud providers instead of building their own clouds, and they could be more reluctant to adopt their services because of that. Maybe the cloud companies aren't feeling this as much now since there seems to be "growth" coming in anyway, but when the market will stabilize a bit, they will probably start feeling it. It's kind of how Blackberry didn't feel the they are banking on a bad strategy in the post-iPhone years, because they were still seeing "growth" during that time, mostly from other markets, hiding the fact they were using a bad strategy, and they were only growing because of brand inertia from previous years.
- anonymousDan 12y ago"and even your secrets will eventually end up in RAM" Maybe not necessarily in future: https://www.usenix.org/conference/osdi14/technical-sessions/presentation/baumann https://www.usenix.org/conference/osdi14/technical-sessions/...
- tracker1 12y agoI have a handful of issues with this... * MS is managing said Key Vault, meaning they may well be under pressure from the NSA to provide access, without a warrant, and without a target knowing said access was requested. * The local SSD storage can really only be used for temporary or cache based workloads... if your image ships to another machine in the case of failover, you'll lose that data. It's not a bad thing, but the High Performance (SSD backed) disk storage is still waiting for general availability, been on the wait list for preview for a while. * The ready ubuntu+docker VM is cool, but I think it's more cool that CoreOS is generally available in the box now.
- helper 12y agoWe run all our ec2 instances on ephemeral disk instances. Historically running on ebs was a great way to ensure application downtime. Ephemeral drives mean you need to change the design of your application to be able to withstand full loss of machines. But it's really not that hard. A good replicated database (riak, cassandra) spanning multiple availability zones gets you 95% of the way there.
- tracker1 12y agoI wouldn't really trust doing so with less than say 40-50 servers, which C* can do quite well, but this is very much overkill as an expense for most people.
- helper 12y agoI'm not really sure what you mean. The number of nodes you need depends on the capacity you need and your replication factor. Most C* deployments are in the 9-15 node range. You could safely deploy with 6 nodes and RF3 if 6 nodes gives you enough capacity in terms of both disk space and IOPS.
- tracker1 12y agoTrue... but given that you can't control how many nodes come down at once, (up to a third typically in azure's case), or what data is on which node, it's less predictable. If I have 24 nodes each across 2 data centers, with a replication factor of 10, then I would consider the data relatively safe... short of that, you have a significant chance of down time should an outage occur. Let alone in the case of a more significant issue, and again, if the server goes down, that data is effectively lost, since the individual node will no longer be there. You have to have multiple sites and higher replication factors and a good backup system. That said, Azure storage actually works very well, aside from the relatively recent azure outage.
- api 12y ago... and the Microsoft perestroika continues. :)
- martco 12y agoWhat do you mean? Do you mean this: perestroika: ORIGIN Russian, literally ‘restructuring.’
- danko 12y agoPerestroika is the era in Soviet history when the USSR began to 'thaw' in its relationship to the West and reform its economic policy to be less collectivized and more capitalistic. In this case, Microsoft would be the USSR and its policy of closed-source Windows/.NET domination would be the old Communist Party hegemonic philosophy. That would make Satya Nadella Microsoft's Mikhail Gorbachev.
- panarky 12y agoGlasnost? http://en.wikipedia.org/wiki/Glasnost http://en.wikipedia.org/wiki/Glasnost
- mark_l_watson 12y agoI think Microsoft is doing a good job of reinventing themselves. Azure and Office 365 really are good products. The Linux support on Azure is great and Office 365 runs well on my Android and iOS devices, support on OS X is OK, and the web version of Office 365 is sometimes handy on my Linux laptop. As far as privacy on their key store goes, I tend to trust Microsoft and Google more than average corporations.
- alttab 12y agoEspecially considering Microsoft is providing you $150 a month in Azure services for 3 years as part of your participation in their BizSpark program.
- mark_l_watson 12y agoYes, BizApark is pretty nice. Years ago, when Amazon rolled out EC2s, one of their marketing people gave me a $1000 credit to play with AWS. Microsoft BizSpark is even more generous.
- freehunter 12y agoI'm paying for Microsoft Office for the first time ever (when I've used it in the past it has been provided by school or work) because I can use Office on non-Microsoft platforms now. I can start an Excel document on Windows 8, edit it later on RHEL, and view it on the go on my iPhone. It's the era of the cloud. That's how things should be. It doesn't matter what system I'm running.
- semi-extrinsic 12y agoUnless you're doing something extremely complicated, linking to data outside the Excel file or abusing Excel for a purpose where some other tool would be far better, this interoperability has been provided by open/libre-office and the various mobile office suites (read-only) for many years. Microsoft's attempts at vendor lock-in notwithstanding. This cloudiness is the wrong solution, the right one would be for MS to stop actively sabotaging interoperability.
- panarky 12y agoBigger, faster, more open, more secure ... what's missing from this list? Oh, that's right, how about more uptime? Provider Outages Total Downtime ---------------------- -------- -------------- Amazon EC2 12 2.01 hours Google Compute Engine 65 3.27 hours Microsoft Azure VMs 102 42.80 hours Source: https://cloudharmony.com/status-1year-of-compute-group-by-regions-and-provider https://cloudharmony.com/status-1year-of-compute-group-by-re... And this doesn't show the other Microsoft cloud services that have even worse reliability. At my company we invested a lot of time trying to make Azure Service Bus and Visual Studio Online work. Both were so dreadfully unreliable as to be unusable.
- mindstab 12y agoHey, at least it's not Veriozon cloud which just told users to power down everything today in preparation for a scheduled 48 hour outage. http://www.computerworld.com/article/2865802/verizon-warns-enterprise-cloud-users-of-48-hour-shutdown.html http://www.computerworld.com/article/2865802/verizon-warns-e...
- Avitas 12y agoWhen a company trumpets some bold statements for marketing purposes, I immediately think about the worst or most far-fetched interpretation of their language. I wonder if their marketing people are being coy and the honest truth is, in some ways, the opposite or far less than what they are saying.
- 12y ago
- venaoy 12y agoA very important issue with Key Vault is: what to do when the Hardware Security Module dies? All electronics fail or stop working at some point. How do you make backups of keys that were on the HSM?
- helper 12y agoThe AWS HSM service supports backing to your own HSM: http://aws.amazon.com/cloudhsm/faqs/ http://aws.amazon.com/cloudhsm/faqs/
- lstamour 12y agoYou don't. Keys on an HSM never leave the HSM, is how I think it should work. But your keys in the HSM can encrypt secrets, separate from the HSM's keys, but stored with the same service. You could potentially distribute secrets to multiple HSM-backed services. It's equally possible that the service itself distributes your secrets amongst multiple HSMs. YubiHSM back in the day, I recall reading, was designed so that you'd want two HSMs, one generates random secrets, the other stores the secrets using keys that never leave the device, if I recall correctly. And the reason it needed two is that the generator would leak parts of its keys with the random data it produced, I think, and so to securely store them, you needed a second device with key generating turned off. I could be out to lunch here, never bought a YubiHSM nor do I have experience with corporate ones. My point, is that there are different uses for HSMs, and it's easy enough to have an insecure use of HSMs, even as simple as generating secrets and storing secrets on the same device. As to what to do if the key is lost, I suppose it's time to re-issue. :) The goal is to not make too many backups: keeping a key secret is more important than ensuring the key is widely available, right? So it's a balance....
- Spooky23 12y agoI don't know about a device operating at the scale that Azure is using, but the key stores on smaller Thales HSMs can absolutely be backed up to smart cards. Security of key material is all about procedures. With a private CA I helped to setup, we used a quorum based authorization scheme, and the collection of smart cards was distributed among different reporting lines to make collusion between employees difficult.
- deleted 12y ago[deleted]
- at-fates-hands 12y agoI'm pretty sure they haven't addressed the old issue of having keeping your FTP credentials in plain text. To me, that's not very secure at all. Source: http://weblogs.asp.net/bleroy/azure-web-sites-ftp-credentials http://weblogs.asp.net/bleroy/azure-web-sites-ftp-credential... "Notice how the password looks encrypted. Well, it’s not really encrypted in fact. This is your password in clear text. It’s just crypto-random gibberish, which is the best kind of password." What exactly is "crypto-gibberish"?
- biot 12y ago> What exactly is "crypto-gibberish"? You generate a random password from the set of inputs that the system allows, usually printable ASCII characters. So instead of a non-gibberish password like "correcthorsebatterystaple" you end up with a gibberish password like "]'gf2~B;](0EnxW>/n%+b*q4{". > I'm pretty sure they haven't addressed the old issue of > having keeping your FTP credentials in plain text. Would you complain if it were an API key that was provided to you in plain text?
- ghuntley 12y agoYes, because FTP by design is unencrypted and can be easily sniffed.
- biot 12y agoYou're addressing a different issue; at-fates-hands was addressing the issue of "keeping your FTP credentials in plain text" whereas you are discussing that plain FTP is an insecure protocol (a point I fully agree with). The site does say: "The Azure dashboard doesn’t seem to give easy access to your FTP credentials, and they are not the login and password you use everywhere else." Likely the difficulty of finding FTP credentials is because FTP isn't the preferred method of publishing your site.
- steven2012 12y agoDoes anyone have any opinions on Google Cloud? We are investigating moving to Google Cloud but I personally am a bit skeptical because they appear to be a distinct #4 behind AWS, Azure and Rackspace. I'm worried that Google Cloud will not get the revenues they want and they will close up shop, like they've done with their other products that were wildly successful. I don't see Google having the same level of commitment as Bezos, who will believe in something and then see it through come hell or high water. Does Google Cloud have the same functionality and flexibility that AWS or Azure have?
- 23david 12y agoWhy not build your system out to be cloud agnostic and test out different providers?
- deleted 12y ago[deleted]
- nl 12y agoThis has never been the case.
- travem 12y agohttps://cloud.google.com/terms/ https://cloud.google.com/terms/ "5.1 Intellectual Property Rights. Except as expressly set forth in this Agreement, this Agreement does not grant either party any rights, implied or otherwise, to the other’s content or any of the other’s intellectual property. As between the parties, Customer owns all Intellectual Property Rights in Customer Data and the Application or Project (if applicable), and Google owns all Intellectual Property Rights in the Services and Software."
- higherpurpose 12y agoI really don't see how Google would exit the cloud service business. It's a core competence of theirs. People have been saying "I'd rather stick with Evernote than Keep" as well. And less than 2 years later, Keep is still there and being updated (with not that many users I think), while Evernote had just laid off 20 people. I also think most of Google's "spring cleaning" projects have been small projects that made no money - as in they didn't even have a business model (such as Reader). The cloud business seems to be pretty straightforward - we give you this, you pay us that.
- Aoyagi 12y agoI'm not sure I like what MS is doing. They're innovating (or at least fixing things) almost exclusively only in cloud/online services/products.
- wmf 12y agoWindows Server will let you run your own Azure, but you can't run your own EC2 or GCE.
- _delirium 12y agoAmazon themselves don't provide a way to run your own EC2, but Eucalyptus [1] is an open-source implementation that works for some use-cases. I believe OpenStack and CloudStack also implement a good portion of the AWS APIs. [1] https://www.eucalyptus.com/ https://www.eucalyptus.com/
- derekdb 12y agoLast I checked, Eucalyptus is missing an number of the APIs that customers really use once they are doing more than just hosting a few VMs. Access control, security, VPN... The service providers are actually quite different and any attempt to standardize is just doing to be the least-common-denominator, which is going to be missing a great number of useful features.
- walterbell 12y agoBoard-level changes at Microsoft over the last year or two have placed a higher priority on platform-agnostic cloud services, vs. Windows. Hence new versions of Windows that are free, but collect usage data from bundled services, like Google does.
- davexunit 12y agoA good example of openwashing. You can call anything open these days, even proprietary software!
- Someone1234 12y agoThe term "open" only appears once in the article on this line (aside from the title): > Building on our openness with the availability of the first Docker Image in the Microsoft Azure Marketplace What the hell does "building on our openness" even mean in that context? I've read it several times and it makes no sense. It is great that they added Docker images (really) but maybe someone technical at Microsoft should start to proofread what nonsense that the marketing department spews out.
- higherpurpose 12y agoYou mean aside from the title that every other news site will reproduce and which will be everything most people remember?
- MichaelGG 12y agoAzure needs to provide SSD backed options for all blobs. As is, they encourage you to use local SSD storage, which gets wiped on reboot.
- egsec 12y agoAm I comparing the right things for the pricing on AWS Cloud HSM vs Azure Key Vault? ASW Cloud HSM - http://aws.amazon.com/cloudhsm/pricing/ http://aws.amazon.com/cloudhsm/pricing/ Azure Key Vault - http://azure.microsoft.com/en-us/pricing/details/key-vault/ http://azure.microsoft.com/en-us/pricing/details/key-vault/ The metrics they use are not the same, so I am not sure if the AWS option is something dedicated vs the MSFT one is something you share? Is there something different from AWS that is more comparable?
- count 12y agoI think the AWS Cloud HSM is dedicated, but not sure. They look to be about the same. If you don't need FIPS, AWS also has the new KMS service which is way cheaper than Cloud HSM.
- egsec 12y agoThe pricing model looks much more similar for KMS: http://aws.amazon.com/kms/ http://aws.amazon.com/kms/
- erazor42 12y agoWe run 50+ linux server on azure (west europe) and it's a nightmare, vm reboot unplanned,VHD diseappear. Timeout or unreachable blob files on HDInsight (with PIG)... Slow load balancer not really configurable. Website slow++. I won't recommand it... Very hard for us to keep a professional SLA. Maybe it's because we run linux server ? One good point is cheap blob, slow but cheap.
- clebio 12y agoIs it feasible for you to evaluate an AWS deployment? I'd be very interested in the numbers you mention if we could compare them to something directly.
- erazor42 12y agoNop we don't want to deploy on AWS for contract issue. But we are moving on full dedicated OVH. I cannot provide numbers for OVH but for now we are SLA 100% on those server.
- mrmondo 12y agoIt's really unreliable though, it seems they're battling outages every few days.
- vvoyer 12y agoI recently had to use the Azure various APIS like ServiceBus. It's a complete failure once you get lost in bugs, missing or hard to find API documentation or examples like `var serviceBusService = azure.createServiceBusService();` WELL Mister API Designer you failed!
- wondenderboy 12y agoHa ha ha... Is this Microsofts way to say "Je suis Charlie"? Is anyone actually really using Azure?
- aarisa 12y agoBigger, fast, more open, more secure. Where does that leave Azure, given where it started? It means it's still small, slow, closed, and insecure.
- ktavera 12y agoI've been using Azure Websites to host 10 web apps monitoring with nodeping and have not had noticeable downtime in 2014. Maybe it's just their IaaS and not the PaaS
- StudyAnimal 12y ago"It IS faster! Over five million..."
- Morphling 12y agoI actually think Azure is nice platform, but they've effectively priced me out. What I mean is that if I want a basic VPS on Azure it costs ~10€/mo to run the server for the month, but there are many VPS providers who offer a lot better hardware for same price. I guess Azure is meant for bigger needs than mine where you can run 100-200€/mo by default and then scale up when needed, but since my little blog + test/dev server won't need to be scaled it just seems too expensive.
- mobiplayer 12y agoIf you plan on building something, but your needs are not there yet you may want to apply for a BizSpark account that covers $150/mo if I'm not wrong. OTOH for a blog you may want to check the PaaS offerings (e.g. Azure Websites).
- sudioStudio64 12y agoThe truth is that a lot of you refuse to learn how windows works at a deep level, at least as deep as you know UNIX. Then it doesn't work like UNIX... and then you're angry. I have seen similar horror stories from AWS customers. They probably weren't early adopters like people on HN...who now have the kinks worked out. MS should stop trying to impress the HN crowd. And unless you own stock in these companies you need to stop investing so much personal emotion in how they are doing compared to each other. AWS isn't some scrappy upstart from a Horatio Alger novel. MS isn't the Empire from Star Wars. And none of them give a damn about you.
- toddkaufmann 12y agoWhenever I hear about Microsoft, I just think irrelevant. Am I bad? Sometimes I think I might have missed out on something, but in 30+ years of programming I've never done any real development on it (unless you count java), and I often go months without encountering it (except for remote desktop occasionally). I think it was good to have competition Apple/Linux/Google, but it doesn't seem like they've kept up.