How Heroku is using Redis in distributed Erlang systems | Hacker News Reader

How Heroku is using Redis in distributed Erlang systems

erlang-factory.herokuapp.com

46 pointsnivertech20 comments

This is a great deck, but I'd love to see one on how we can use Redis at Heroku; it looks like the options are (a) Redis To Go, which is unreasonably expensive, and (b) an insecure connection to an m.large at EC2.

Insecure? Why not use ssh port forwarding?

I'm not in love with the idea of using SSH for this, but, can you do that on Heroku?

sure, why not

Communications are secure among EC2 instances within us-east, which is where Heroku is.

I think the issue is that of you open up your EC2 instance's security group to your Heroku app, you're opening it up to any Heroku app.

Use authentication - communication inside us-east can't be sniffed even by instances you control.

It is not a reasonable security decision to make any part of your backend depend on Redis authentication.

Secure meaning there is a private back-end network or there is some form of tunneling/encryption end-points available and enabled by default for instances?

Here's the current AWS security guide that I was able to find:

http://awsmedia.s3.amazonaws.com/pdf/AWS_Security_Whitepaper...

Read the section entitled "Packet sniffing by other tenants" - the hypervisor won't permit you to put an interface into promiscuous mode.

Thank you. So the Xen dom0s are using IP Routing and not bridging.

Do we know the details of Heroku's LXC configurations for dynos on their Amazon Domu instances?

http://devcenter.heroku.com/articles/dyno-isolation

"On the Heroku dyno manifold, each and every process has full isolation from all other processes, including those of the underlying operating system and other processes from the same application. This provides complete protection from either of the circumstances above, and many others."

Based on that, do we presume they are also using routes and not bridges?

I'm unwilling to trust IP access control for anything in 2011.

If I could do SSH port forwarding, that'd probably be my first choice. I have a AES-128-CTR+HMAC-SHA256 encrypted sleeve for the Redis protocol with an attendant Redis::Connection driver, but this is exactly the kind of thing I'm always telling people not to do.

It's not ip access control - it's hypervisor control.

I'm a lot more worried about allowing arbitrary EC2 hosts to connect to my Redis port than I am about people sniffing the traffic.

This motivated me to play around with Net::SSH port forwarding this afternoon and evening. What I ended up with was a tiny patch that allows you to forward a local UNIX domain socket to a remote TCP port over an SSH connection. It's a fun hack if nothing else:

https://gist.github.com/1144486 https://github.com/imbriaco/net-ssh/commit/aa453511f546cd524...

Closing the loop and replying to myself, I got carried away and wound up with a full Sinatra demo app that does this:

https://github.com/imbriaco/heroku-redis-sshtunnel

A little bit off topic, how did this individual create the presentation in HTML5?

He used Scott Chacon's excellent ShowOff:

https://github.com/schacon/showoff

PDFkit is not installed:

http://erlang-factory.herokuapp.com/pdf

Reply on news.ycombinator.com