colmmacc

33 ms·

331.
by colmmacc 9y ago
Amazon on-call engineer here! I'm on-call for three rotations. Two are "Call leader" rotations where a call leader like me is engaged if there's any kind of large event (e.g. Amazon.com orders aren't working, or an
332.
by colmmacc 9y ago
TLS 1.3 still has problems with STEKs. If you use STEKs with 0-RTT mode, then you lose forward secrecy and that's where the most sensitive data is likely to be: your request, password, credit card number, etc ... 0-RTT doesn't hav
333.
by colmmacc 9y ago
Those are like hipster reasons to not like DNSSEC! DNSSEC is just dumb and doesn't work. [ User ] <-----> [ Resolver ] <-----> [ Auth DNS ] ^ ^ Most attacks work here DNSSEC protec
334.
by colmmacc 9y ago
I know I'll sound like a cultist, and I am, but I earnestly pitch to people that working at Amazon is an opportunity to get a free MBA. People now realize that Amazon has been doing dev-ops for a long long time, but we've also bee
335.
by colmmacc 9y ago
Amazon engineer here! I love our culture of strong ownership and autonomy, and that we'll take risks, tolerate failures and give things around 7 years to mature and pay off. It's super rewarding to be able to own things and see th
336.
by colmmacc 9y ago
This is what ELB Classic did for a long time - but we're experimenting with new algorithms. The problem with this approach is that it's not cache friendly. When you bring in a new server to a busy workload, it gets all of the new
337.
by colmmacc 9y ago
Wow that sounds awful - but thankfully this isn't typical. I'm going to go digging for a case-id/issue and see what's going on myself (please e-mail the case if you have one). Re-configurations are routine and graceful.
338.
by colmmacc 9y ago
The default answer includes multiple A records, so if clients can't reach one of the IPs, they try another. There's no need for anything to propagate for that to kick in, it's just ordinary client retry behavior. We do also w
339.
by colmmacc 9y ago
One way to think of NLB is that it's an Elastic IP address that happens to go to multiple instances or containers, instead of just one. Everything else stays the same.
340.
by colmmacc 9y ago
For now here's a work-around that I use: create multiple listeners/ports on the larger instances and add them as targets. Containers is a great approach here too; load up the bigger instances with more containers and register each
341.
by colmmacc 9y ago
CloudFormation, CodeDeploy, and ECS all support NLB today :) I used the console to create the simple demo though, so I don't have a template to recreate it. Sorry!
342.
by colmmacc 9y ago
It was definitely un-AWS-ey, and there's an almost visceral pain response on our faces when we don't have a self-service API for something. This is improving all of the time and I think is already much better, with some big specif
343.
by colmmacc 9y ago
Yes, all packets from a TCP connection will keep going to the backend that was chosen when the connection first came in. This is preserved even if other backends are added and removed to the set of eligible targets. It's also preserved
344.
by colmmacc 9y ago
ELB's Application Load Balancer (ALB) supports HTTP/2 termination. More in the original launch announcement: https://aws.amazon.com/blogs/aws/new-aws-application-load-ba... and https://aws.ama
345.
by colmmacc 9y ago
Each NLB starts out with several gigabits of capacity per availability zone, and it scales horizontally from there (theoretically to Terabits). That's more capacity than many of the busiest web-sites and web-services in the world need.
346.
by colmmacc 9y ago
If you're curious to see NLB in action, here's a live demo: http://nlb-34dc3b430638dc3e.elb.us-west-2.amazonaws.com/ , it took about 5 minutes in the console to set it up and no changes on the targets/backend
347.
by colmmacc 9y ago
Unfortunately layering is not as simple as "defense in depth". Each layer may have its own vulnerabilities, and so the attack surface is increased. There is also a history of issues in mis-matches and side-channels arising in how
348.
by colmmacc 9y ago
It's not really a "vs" thing. EtM is implementation of AEAD.
349.
by colmmacc 9y ago
Switches use L4 ports to implement flow-switching. When multiple paths for a packet are available, it is convenient (it leads to less re-ordering) if the related packets from the same flow all choose the same path.
350.
by colmmacc 9y ago
TLS1.3 does speed up non-0RTT handshakes too, at least the ones that use forward secrecy; which is nearly all these days. It reduces them to 1RTT instead of the 2RTT we have today.
351.
by colmmacc 9y ago
I work at AWS and I think there's definitely some similarities and differences. We do share our backbone with CloudFront, and hence our video traffic, of which there's quite a lot these days. We also advertise our network ranges b
352.
by colmmacc 9y ago
A friend of mine is director of business for https://www.franschocolates.com/ , which is a great local Seattle family business that has grown up to be big thanks to a great product (Seriously good chocolate!). They moved to
353.
by colmmacc 9y ago
Random padding wouldn't really help; an active attacker can force retries, so the random distribution can be mapped (and then subtracted). To defeat TA you need to pad to a fixed length for all cases, or for a very large amount of case
354.
by colmmacc 9y ago
TLS1.2 doesn't have an effective padding scheme, and with most sites (including Wikipedia) moving to AES-GCM and ChaCha20, it is actually less effective than the primitive CBC padding, which provided some protection. TLS1.3, which is s
355.
by colmmacc 9y ago
FWIW (and we're hiring) ... several AWS services are already written in Scala.
356.
by colmmacc 10y ago
Related story: I own stdlib.net, and have been using it for some e-mail and stuff for more than ten years. The original reason for getting it was that we were playing around with using the net.stdlib Java namespace for Apache commons. But t
357.
by colmmacc 10y ago
"Amazon never participated in the NSA’s PRISM program." - Stephen Schmidt, CISO @ AWS https://aws.amazon.com/blogs/security/privacy-and-data-secur... (Full disclosure: I work on AWS}.
358.
by colmmacc 10y ago
This is a good write up, and it's awesome to see on-line rotation of certificates. But (there was always a but coming) ... the word "rotation" is over-used here and very dangerous, because it doesn't emphasize what'
359.
by colmmacc 10y ago
My real plan with NeverSSL.com is to use the access logs to publish an up-to-date database of broken networks and what the rough popularity of each broken network is. I'm hopeful that these kinds of public analytics could lead to solut
360.
by colmmacc 10y ago
Will do, thanks! Feel free to send me any specifics colm AT allcosts.net. Update: I've added Cache-Control and Expire HTTP headers to the HTTP responses for neverssl.com

More ›