weavenetwork

Joined 12 years ago

Karma

117

Submissions

Member since

Sep 9

View on Hacker News

Recent submissions

Comment · 11 years ago

Thanks @takeda.

Are you aware that we did not roll our own crypto? Instead we used the NaCl crypto libs[1]. Weave adds about 300 LOC to integrate NaCl.

You can read about it here - http://docs.weave.works/weave/latest_release/how-it-works.ht... You can also read a bit about weave crypto in the comments from mradestock and msackman elsewhere on this page.

I would be extremely grateful if you could provide actionable advice (or help) on which other crypto libraries could fit our requirements for weave. Please note that in addition to functional requirements, any library must be open source, hard to misuse, easy to package, and demonstrably safe.

alexis

[1] http://nacl.cr.yp.to/

Comment · 11 years ago

What about them? Would you recommend one of them over the others?

Comment · 11 years ago

I'll have to stop saying please when in the US then ;-) But seriously, thanks for taking the time to explain your point of view. alexis.

Comment · 11 years ago

cripes.

on each host? what kind of physical network are you using, and how many containers per host? how many hosts? let me know if I should email about this instead.

Comment · 11 years ago

What throughput do you need, on a per-host basis?

Comment · 11 years ago

We are open to recommendations, help and overall insight from expert contributors in security. As many people on this thread have pointed out, it is a big and complex world..

Comment · 11 years ago

We did not roll our own crypto. We used NaCl. The rationale is explained here - http://weaveworks.github.io/weave/how-it-works.html#crypto We agree that other approaches are possible, but this is the one we picked for our first version.

Comment · 11 years ago

No, for example it is 100% uncharitable and unreasonble to assert that "please" is sarcastic. The truth is quite the opposite.

Comment · 11 years ago

Paul, I think our work is good. We thought about our approach very carefully.. And we have built systems like this before. The main difficulty is to combine moving fast with limited resources, with delivering something supportable and improvable, without creating technical debt.

Comment · 11 years ago

Complaining on twitter is not the same as finding an issue! Criticism has value, but not all commentary deserves equal weight or time before it is reasonable to request reciprocal effort.

Comment · 11 years ago

indeed. at the risk of entering tinfoil hat land, note the following http://blog.cryptographyengineering.com/2014/12/on-new-snowd... ..although also the not 100% reassuring https://nohats.ca/wordpress/blog/2014/12/29/dont-stop-using-...

Comment · 11 years ago

although, sometimes not obviously so: https://github.com/GoogleCloudPlatform/kubernetes/pull/4483#...

Comment · 11 years ago

Tony, the team recently updated the crypto docs to clarify the rationale etc etc - http://weaveworks.github.io/weave/how-it-works.html#crypto ... Moreover the entire crypto code for weave is about 300 lines. Please please please if you are an expert then a thorough review would not only be welcome but also acted upon. Thank-you. Alexis.

Comment · 11 years ago

Using an account that I share with other people in the same team is not the same as 'marketing'. I am sorry if this somehow offends, but think of the handle as just one poster.

Comment · 11 years ago

edit:

here is a kubernetes link: https://github.com/GoogleCloudPlatform/kubernetes/pull/4483#...

the author, who was part of the MS Azure team at the time, said: "as of today, this Weave/CoreOS tool and doc is the only way I was able to provision a Kubernetes cluster in Azure"