News for hackers. Stuff that matters.

A comment on Setting Up HTTP(S) Load Balancing – WebSocket proxy support. Parent comment

Re:Setting Up HTTP(S) Load Balancing – WebSocket proxy support by doubleorseven on Tuesday April 25, 2017 @12:08AM (#14190692)
Since when AWS is offering SNI on their load balancers?

I work at a SaaS company and we were facing the same issue in the cloud and have to implement our own TCP LB's to support SNI. I really hope we will see it in the near future but as i see it, Will I allow my clients to push bytecode into my production machines on demand with the lowest sandboxing possible to provide low execution times? I guess not.

[ Parent | on HN ]
Re:Setting Up HTTP(S) Load Balancing – WebSocket proxy support by numbsafari on Tuesday April 25, 2017 @06:35AM (#14192251)
As far as I know it doesn't.

I should have been more clear: GCP's Anycast, no-warming-need LB is way cooler than AWS traditional, single-region with totally unreliable DNS "routing" on top (because you always want to rely on client DNS TTLs to handle a service cutover...).

The problem is, if you can't use a TLS proxy for security reasons, then you can't use the HTTP(s) LB, which will make you less happy than if you could use it.

[ Parent | on HN ]
Re:Setting Up HTTP(S) Load Balancing – WebSocket proxy support by zimbatm on Tuesday April 25, 2017 @09:21AM (#14193228)
In what scenarios is GCP's load-balancer not trusted but their compute instance is?
[ Parent | on HN ]
Re:Setting Up HTTP(S) Load Balancing – WebSocket proxy support by numbsafari on Tuesday April 25, 2017 @09:33AM (#14193324)
When, up until recently, not even Google was willing to cover their own load balancer under their BAA.

The load balancer is a shared resource. Your data is being decrypted and re-encrypted in a shared memory space with all other customer's data. Consider the issue CloudFlare customers faced recently [1].

[1] https://techcrunch.com/2017/02/23/major-cloudflare-bug-leake...

[ Parent | on HN ]
Re:Setting Up HTTP(S) Load Balancing – WebSocket proxy support by vgt on Tuesday April 25, 2017 @02:29PM (#14196598)
I am not in compliance, but absence of evidence doesn't imply evidence of absence.

Google Cloud has probably industry's highest security standards in place [0] . Getting governing bodies to sign off on their accreditations is a very separate issue.

(work on Google Cloud)

[0] https://cloud.google.com/security/whitepaper

[ Parent | on HN ]
Re:Setting Up HTTP(S) Load Balancing – WebSocket proxy support by tyingq on Tuesday April 25, 2017 @12:51AM (#14190860)
They don't have SNI, but the newer ALB does have path based routing. So you can use a wild card or multidomain cert, if you can segment routes to endpoints by uri path.
[ Parent | on HN ]
Re:Setting Up HTTP(S) Load Balancing – WebSocket proxy support by manigandham on Tuesday April 25, 2017 @12:51AM (#14190862)
Usually this is done with a CDN in front. Cloudfront supports SNI.
[ Parent | on HN ]