Hacker News Reader

Comment by doubleorseven | Hacker News Reader

Since when AWS is offering SNI on their load balancers?

I work at a SaaS company and we were facing the same issue in the cloud and have to implement our own TCP LB's to support SNI. I really hope we will see it in the near future but as i see it, Will I allow my clients to push bytecode into my production machines on demand with the lowest sandboxing possible to provide low execution times? I guess not.

View on HN

As far as I know it doesn't.

I should have been more clear: GCP's Anycast, no-warming-need LB is way cooler than AWS traditional, single-region with totally unreliable DNS "routing" on top (because you always want to rely on client DNS TTLs to handle a service cutover...).

The problem is, if you can't use a TLS proxy for security reasons, then you can't use the HTTP(s) LB, which will make you less happy than if you could use it.

In what scenarios is GCP's load-balancer not trusted but their compute instance is?

When, up until recently, not even Google was willing to cover their own load balancer under their BAA.

The load balancer is a shared resource. Your data is being decrypted and re-encrypted in a shared memory space with all other customer's data. Consider the issue CloudFlare customers faced recently [1].

[1] https://techcrunch.com/2017/02/23/major-cloudflare-bug-leake...

I am not in compliance, but absence of evidence doesn't imply evidence of absence.

Google Cloud has probably industry's highest security standards in place [0] . Getting governing bodies to sign off on their accreditations is a very separate issue.

(work on Google Cloud)

[0] https://cloud.google.com/security/whitepaper

They don't have SNI, but the newer ALB does have path based routing. So you can use a wild card or multidomain cert, if you can segment routes to endpoints by uri path.

Usually this is done with a CDN in front. Cloudfront supports SNI.

Reply on news.ycombinator.com