3 ms·
It seems to me that would be quite easy for virtualization software to prevent individual VPSs from reading networks packets not meant for them, thus providing
by seunosewa 12y ago
It seems to me that would be quite easy for virtualization software to prevent individual VPSs from reading networks packets not meant for them, thus providing decent privacy. What's the technical hurdle that prevents this in practice?
- wmf 12y agoYes, that's called network virtualization and it's complex to operate at scale. It's built in to Amazon VPC, Google GCE, Azure, etc. but often not found in second-tier providers.
- viraptor 12y agoIt's tricky because the routing is completely dynamic. You also can't use the typical hardware tricks at scale - for example providers will have more customers than available vlan numbers. So you have to have a dedicated solution running something comparable to openvswitch in software, or interface with your hardware really fast and really often. Usually the hardware is not really built to be reconfigured constantly every second (or more often). Once you start adding more than address filtering, you get an explosion of rules. For example in openstack (neutron), it's pretty common to just put a hard limit on the number of entries - otherwise you end up with one vm spawning and suddenly every router has to add another entry for each of the ports to each of the possible 1000s of other vms. And then clean up and keep everything consistent when vms are killed again. It really does get hard beyond the bare basics.