Hacker News Reader

Comment by lbotos | Hacker News Reader

This is the same way Linode's works as well. I'm curious, how many people here thought that Private networks were walled to only droplets/nodes on the same account?

View on HN

Amazon's private network is private by default, I believe Google's is as well, and I believe Azure's is. Digital Ocean is acting much more like a traditional VPS company than a modern cloud computing company here.

Well what you are describing is VPC (which for new accounts for a while now is enabled by default), but VPC is software isolation which creates private networks, but EC2 Classic is technically shared private IP space between all customers. There is a big difference between the two.

Even with EC2 classic, every machine is locked down from every other. The typical way around this is to modify the default security group, which is limited to your account and your instances. It's a different approach than VPC, but everyone had effectively private networks with EC2 Classic, unless they really went out of their way to open up everything to everyone.

Granted we're probably now distinguishing between being able to see unencrypted traffic and being able to access ports on a machine. They're both bad, but I'd argue having your DB port exposed to the world is probably worse.

EC2 (and OpenStack) uses security groups to give you the best of both worlds: shared address space so you _can_ route to other customers; but the firewall means you have to explicitly allow the traffic.

Yup EC2 security groups are great for ease of management. Group to Group communication for something like load balancers to auto scaling back-end app servers is great as you don't have to worry at all about tracking IP addresses.

EC2 Classic hasn't been a thing that exists for a couple of years now (aside from for accounts that were grandfathered in).

But the fact it it does exist, and I'd venture to guess most major customers who have been using EC2 for a long time now still use it currently and it is still available to many people and is not going away anytime soon.

While this has been down voted, it is correct.

maybe because digital ocean has and will always be a VPS company, they are not cloud.

What do you think makes the separation between a "cloud" provider and a VPS company?

The glib answer is that a cloud provider understands the need for a private network.

But, in that is a deeper truth: a VPS is a cheaper machine. It becomes "cloud" when you use many machines together. If you're using many machines, you really want intercommunication between those machines to be easy, fast and - yes - reasonably secure.

They claim to be a "cloud hosting" platform, though, which is the confusing bit.

I believe people are comparing it to AWS VPC, under the assumption that Digital Ocean is a parallel to AWS.

Most cloud providers gce, aws (vpc), azure, rackspace, etc. provide multi-tenant networking, where private network addresses are specific to an account. So there is legitimate reason for confusion.. that said i did read the release notes on DO's announce when i started using this feature and it was pretty clear that's not what they offered.

Reply on news.ycombinator.com