In this bumper feedback episode we talk about line endings in files, OpenStack, secrets management, and protecting your network.

• Iain asks:

  Hello all,

  I hear a lot about Openstack but whenever I try to find out stuff about it, I get vague buzzword-laden and vague comments from “evangelists”. Could any of you guys explain to an IT-literate but not a sysadmin end user, what the hell Openstack is?

  Stu explains what OpenStack is built for, where it’s often deployed these days, and some of the issues he’s seen with it.

  Jon talks about some of the components inside OpenStack, and how OpenStack upgrades can have issues.

  Jon and Stu talk about companies who were selling OpenStack distributions, and comparisons to Kubernetes.

  Jerry mentions that many of the problems OpenStack was created to solve are now mostly solved by Kubernetes. He also mentions that we discussed Kubernetes in Episode 51.

  Jon mentions Eucalyptus, nominally as an alternative to using AWS S3 or OpenStack Swift (the object storage module), but also mentions it could be used to virtualize some of the other services provided by AWS.

• Al asked about “Dark Matter Engineering” which he’s heard about on Coder Radio. We presume it’s code that isn’t released into the public, or never gets any traction. We also discuss Linode and compare it to Digital Ocean as a result of the adverts run on Coder Radio.

• Jay provides some feedback:

  Hi, in your last podcast someone mentioned having an issue with VSCode in windows always saying that files were all edited.

  What’s probably going on is a wrong setting for the core.autocrlf setting.

  You can fix it by opening powershell in windows and running

  git config --global core.autocrlf input

  https://git-scm.com/book/en/v2/Customizing-Git-Git-Configuration#_formatting_and_whitespace

  There are 3 settings, but I always recommend the ‘input’ one, as it converts everything to LF endings on commit, and checks out without modification.

  Also, you may be interested in a recent networking video series I made: https://jaytuckey.name/2020/10/18/how-websites-load-a-deep-dive-into-the-ip-network-stack-and-how-it-is-used-to-connect-to-a-site/

  Jon talks about how he’s got Microsoft’s Windows Subsystem for Linux (WSL) setup and how he organizes his “My Documents” directory structure. He mentions “Symbolic Links” to easily find Windows directories in his WSL environment.

  We also talk about Line Endings (CR – Carriage Return, LF – Line Feed, CR+LF). Jon incorrectly recalls CR as ASCII character 10 (it should be 13) and LF as ASCII character 13 (it should be 10).

• WIE E asks for help with Secrets Management in a Continuous Integration (CI)/Continuous Delivery (CD)/Continuous Deployment (CD) environment.

  Stu talks about Gitlab, HashiCorp Vault, and AWS IAM roles, which Jerry extends to include Azure System Assigned Identities. Jerry mentions that you can use your provisioning system to create a per-system key during a build, which never commit to your version control system.

  Jon mentions about protecting CI/CD/CD systems and references the exploit of a CI/CD system on the Matrix.org project.

• Yannick asks:

  VPN: always on or not?

  How to protect the target network – i.e. does my machine becomes the weakest link in the network and what can/should I do to protect the network ?

  Jon talks about his views on always-on Client-to-Server Virtual Private Network (VPN) connections.

  Al mentions that he thought the question was talking about Site-to-Site VPNs, and Jon suggests that VPNs typically now auto-establish themselves when traffic is initiated from the “Encryption Domain” on one side of the network to the “Encryption Domain” on the other side of the network. Jon refers to IPsec Phase 1 and Phase 2 which are two stages of a VPN tunnel, dealing with the initial connection between the “left” and “right” sides of a VPN tunnel, and the connections between two encryption domains (subnets or hosts at either end of the tunnel). Jon also mentions about various encryption algorithms like DES, Triple DES, AES, and hashing algorithms like SHA1.

  Jerry quotes “Clarke’s Third Law“: Any sufficiently advanced technology is indistinguishable from magic.

  Jon mentions about the Diffie Hellman Key Exchange video, and then talks about browse-down management environments and references the National Cyber Security Centre (NCSC) End User Device security guidance for hardening machines. He also talks about segregating network segments for protecting trusted and untrusted networks, and then goes into “Zero Trust” networks, mentions “CASB“. Jon and Stu both talk about broadcast domains in a network, and how you can work around that.

  Jerry mentions about Bastion Hosts, and Jon explains why they’re not really a good idea.

  Jon butchers talking about User Behaviour Analytics (UBA) systems. He also mentions about a protocol break.

Wrap up

We’re a member of the Other Side Podcast Network. The lovely Dave Lee does our Audio Production.

We want to remind our listeners that we have a Telegram channel and email address if you want to contact the hosts. We also have Patreon, if you’re interested in supporting the show. Details can all be found on our Contact Us page.