kube-system

> Almost no companies farm their security out to third parties.

They do it all the time, piecemeal, that's part of what anything-as-a-service delivers. If you don't want to secure an app, buy a SaaS one. Don't want to secure infrastructure?, buy an IaaS.

> Most places have combined them at some boundary, for ease of access, but there is no case in which an authenticated application endpoint (even /login) has to allow unauthenticated network access to it.

> And in all seriousness, name a service that is not a public website, but cannot use mTLS or IP allowlisting.

Literally any SaaS software where the customer does not or cannot practically install a certificate for you or provide a list of IPs in advance? mTLS is almost never used in a browser unless you are connecting to a government website with a pre-shared smartcard. IP whitelisting is great if the end users only work from behind a VPN or in an office. But there's a whole big world of people who cannot or will not do that.

Yeah, nobody is doubting that people want to consume tokens. We're doubting that that Google, OpenAI, or Anthropic has a significant enough moat to keep people buying their tokens there. Over the past couple years the moat has been the model. As open models are getting better, that moat is drying up. Eventually the market for "tokens" will converge with the market for compute, which is a commodity with little to no moat.

And despite all of that ... Chewy is successful.

1. that's what this thread is about?:

> I think people will move back to their own hardware

> self-hosted pieces of software

2. arguably -- but lets set aside what you think the word means and respond to the obvious meaning of the comment you're replying to.

The point is -- doing shit yourself makes it your problem to do correctly and requires sufficient resource allocation

The reason we were talking about on-prem is because we're talking about the effort of doing these things yourself vs farming it out to a third party.

If you're a security engineer responsible for securing only:

1. a public website

2. stuff that can be ip whitelisted and/or use mTLS

Consider yourself very lucky. Most orgs need to expose a lot more than that.

You would inherently be rolling your own configuration when deploying something on-prem.

Yeah, most organizations need to expose something to the internet as a matter of normal operations -- at least some sort of a web app if not dozens. It would be great if we could all just have udp 56820 listening silently for a key, but that isn't reasonable for most organizations that have normal users expecting normal applications.

Yes, everyone is rushing to implement zero-trust principles for real now. It's getting harder to trust that your public facing endpoints don't have vulnerabilities, and it's getting harder to trust that your internal software and endpoints haven't been compromised from within your pre-existing trust boundaries. A lot of the increased workload is due to patching up the existing security infrastructure, and on top of that, building out new solutions to better fit today's threat landscape.

They aren't immune, but they almost universally have better security posture than any alternatives.

Unquestionably. They have top tier security operations that are well funded. They follow (or set) security best practices, they are audited, and they fix them quicker than you can. They have inside industry knowledge that is only shared among top organizations in this space, including government cyber ops. This gives them the ability to fix things before they are even publicly known.

You can get close if you have either:

1. the ability to spend hundreds of millions on security operations yourself

or 2. the ability to airgap the systems you are securing

There have been a lot of exploits for a lot of software on-prem tech stacks rely on just over the past month - proxmox, php, nodejs, palo alto, eMudhra, etc come to mind.

> But then, you're unlikely to be the top target of anything.

That would have protected you 3 years ago when a human had to bother to attack you. Today it doesn't protect you because it's trivial to deploy an LLM to act like an APT against any random target that shows up in shodan.

It takes more effort to secure on-prem software today than it did just a couple of years ago. Updates are more frequent, zero days are more frequent, attacks are more common, more persistent, and more automated.

I think most people responsible for securing production systems today will share the experience that their workload has increased.

Or there's some exploit in an endpoint device, and the problem moves laterally from inside your firewall.

LLM discovers exploit -- you don't realize it in time because you don't have a security team as big as the PaaS you used to use -- you get pwned anyway.

This has happened to many high-profile self-hosted pieces of software just this past month.

This is misguided thinking. You are less likely to hear about on-prem breaches in the news just because they are less likely to be newsworthy incidents, but they are even more likely to happen. Part of the reason people moved to the cloud is because it is much easier to have a team manage updates and security at scale.

Being a small target is not helpful these days, attacks on on-prem software today simply scans the internet, or uses databases by people who have already scanned it, and is automated.

On-prem software has not been spared from the recent spat of security incidents.

It's a lot cheaper than ipv4, for the most part.

I'm not saying that parents can't contribute, or help guide their children -- they should.

But the cultural problem we have today is exactly that parents feel that they are responsible to provide a college education for their kids. Doing well in higher education is something that cannot be handed to someone. A student needs to be invested in their education, they need to have some real skin in the game, they need to feel real-world consequences for their actions.

Young adulthood is a time of transition -- they should be transitioning fully away from accountability to their teachers and their parents, to an accountability to themselves and the realities of adult life. They need to learn to be responsible for real world things, not just a report card. Part of that responsibility is having some urgency, desire, and ambition to do something with your life.

Giving a undecided kid a mandate to go to school is the exact opposite of what they need. They don't need someone to tell them what to do. They need to learn how to tell themselves what to do. Parents instinctually want to "help", but doing this for them does not help.

It is nice for parents to help. But there are way too many parents who think that if they just enroll their kids in a good college, that college will magically give them direction in life, ambition, and life skills. But if they didn't have a good grasp on these things before enrolling, they're already set up their children for failure.

I know people who work in higher ed, and they thank god for FERPA, because they are inundated with more calls than ever from helicopter parents asking what their grades are, asking where they were on the weekends, why they won't call their parents back, etc. "I am paying for this education and I demand to know [x] about my child", etc.

Any student who is actually prepared for college should already have a pretty reasonable idea what direction they want to go with their studies, what it is going to cost, how it is going to be paid for, and generally what they're going to do with their education. If they don't have a clue, blowing $100k is not going to fix that problem -- it's going to make it worse.

In my opinion, undecided kids would be much better off dabbling in college at a 2 year alternative. There are fewer distractions and less impactful consequences for "figuring it out".