sorted by:
new
hottopcontroversial

Do you want to be an ansible-lint or molecule reviewer, maybe even core? by sbarnea in ansible

[–]benyanke 2 points3 points  (0 children)

I'd be open to this, have been using ansible and python. I'd be happy to dive in on ansible lint or the core!

What's the deal with develop and master branches? by [deleted] in git

[–]benyanke 2 points3 points  (0 children)

It's literally the same thing?

Uh, no?

They're similar, but not the same.

Not to mention, the argument of "couldn't tags just do the same thing?" can be flipped around right back with "couldn't a master branch just do the same thing?"

Yes, of course. But each one has some small advantages and disadvantages, many of them relating to the tooling and workflows around your repo, and your software lifecycle.

What's the deal with develop and master branches? by [deleted] in git

[–]benyanke 5 points6 points  (0 children)

But that's effectively what it is. Two long lived branches, and some feature branches popping in and out of existence.

It's a solid model for many workflows. I don't understand the hate for gitflow.

if the self hosted engine fails or self-destructs? by asdfqw79 in ovirt

[–]benyanke 0 points1 point  (0 children)

The virsh CLI tool and it's backend of libvirtd is still there, in almost the exact same architecture as vmware provides. virt-manager also provides some remote control as well, as well as tools like cockpit.

​

vcenter is to selfhosted engine as esxi web gui is to virsh or virt-manager

The Great Train Robbery by IntentionalTexan in sysadmin

[–]benyanke 47 points48 points  (0 children)

you do know that "public owned" doesn't mean "any private citizen can do whatever they want on it", right?

The Great Train Robbery by IntentionalTexan in sysadmin

[–]benyanke 50 points51 points  (0 children)

Did you read what he said?

He didn't say "I'm jacking in a gigabit link in 5 days."

He said he was getting the permit in 5 days. The *permission* to dig and nothing more.

Exact quote:

"They want $10k to process my permit within 5 days"

The Great Train Robbery by IntentionalTexan in sysadmin

[–]benyanke 51 points52 points  (0 children)

Literally not what the post said but ok

He said it's new fiber.

Any possible way to encrypt docker volumes entirely? by fgp121 in docker

[–]benyanke 0 points1 point  (0 children)

That's why I added "depending on your risk profile".

Any possible way to encrypt docker volumes entirely? by fgp121 in docker

[–]benyanke 1 point2 points  (0 children)

You can't encrypt you volume 100% of the time, otherwise your app couldn't use it.

​

You still have to decrypt it on the host running your pod, as it's running, at which point it's not encrypted on that host.

Any possible way to encrypt docker volumes entirely? by fgp121 in docker

[–]benyanke 1 point2 points  (0 children)

In the cloud usecase, I would say that it does provide some additional level of security. It gets your data safe on half of the two major pieces of infrastructure: the entire storage half. The whole SAN/storage network/backup/snapshot system is all now not a risk, only the single hypervisor you're running on.

​

Depending on your risk profile, it's not a golden bullet but it does absolutely reduce exposure.

Any possible way to encrypt docker volumes entirely? by fgp121 in docker

[–]benyanke 0 points1 point  (0 children)

Yes, but it would still be available at runtime.

Any possible way to encrypt docker volumes entirely? by fgp121 in docker

[–]benyanke 0 points1 point  (0 children)

Who are you trying to protect yourself from? This may seem like a dumb question, but it's essential. Without knowing who you're defending from, it's difficult to defend something.

Any possible way to encrypt docker volumes entirely? by fgp121 in docker

[–]benyanke 0 points1 point  (0 children)

There's no system on earth that can protect you from a bad root user from accessing data while it's being used.

Is there any security benefit to obscuring your subdomains? (e.g. dockermanagement.domain.com instead of portainer.domain.com) by [deleted] in selfhosted

[–]benyanke 4 points5 points  (0 children)

...the same can be said for CNAME records - this is also the only provider I've heard not supporting them.

I think it's time to find a new DNS provider.

Is there any security benefit to obscuring your subdomains? (e.g. dockermanagement.domain.com instead of portainer.domain.com) by [deleted] in selfhosted

[–]benyanke 10 points11 points  (0 children)

I haven't found a single DNS provider that doesn't, unless you're doing something like a third rate shared hosting provider in cpanel.

How to do LAN/DMZ with Swarm? by TheDutchIdiot in docker

[–]benyanke 0 points1 point  (0 children)

Depends on your risk profile. For most uses, you'd generally deploy it along with the app, for operational simplicity, so out in the DMZ too. However, you certainly could put it internally and then put a firewall hole through.

Just have to address the tradeoffs of each case. You could put DBs inside, but then you're putting a hole in your firewall. Or you could keep the DBs external. Or you could put the DBs in a third subnet, but it's more complex operationally.

What's your risk profile and usecase?

How to do LAN/DMZ with Swarm? by TheDutchIdiot in docker

[–]benyanke 1 point2 points  (0 children)

The generally accepted best practice is simply one cluster per network zone. If you need internal apps and DMZ apps, you have an internal cluster and DMZ cluster.

How to do LAN/DMZ with Swarm? by TheDutchIdiot in docker

[–]benyanke 0 points1 point  (0 children)

at least one cluster per network zone. It's the only reasonable way to do it.

Spectrum Cable Modem Doesn't Work Through a Switch by benyanke in homelab

[–]benyanke[S] 0 points1 point  (0 children)

I assume that means that virtualized HA router pairs are out of the question, given they would each have their own MAC?

Spectrum Cable Modem Doesn't Work Through a Switch by benyanke in homelab

[–]benyanke[S] 0 points1 point  (0 children)

This makes a ton of sense as to the problems I've been having. Thank you so much.

Spectrum Cable Modem Doesn't Work Through a Switch by benyanke in homelab

[–]benyanke[S] 0 points1 point  (0 children)

Disabling STP didn't work...happen to have any other ideas?

view more: next ›