Comment by flumpcakes | Hacker News Reader

Comment by flumpcakes | Hacker News Reader

Parent Full thread

The solution _is_ running HTTPS internally. But as an application developer, do you want to manage certificates? Do you want to make sure you're using the "correct" TLS versions and that your app can talk to other TLS versions? What happens when team Z deploys their legacy Java app that doesn't? Where are you getting your certificates from?

All of these go away with a service mesh and sidecar model where the everything is encrypted for you and certificates are completely managed by the service mesh. No need to roll your own PKI. Your app only needs to speak plain HTTP and from it's perspective every other app is also just speaking plain HTTP, no TLS in sight. It makes developers' jobs a lot easier, only concentrating on shipping features vs. wrangling with TLS.

Saying all of that, you could just roll your own fine. Depending on the competency of your company.

The first thing developer does implementing HTTPS is chatgpting "how do I disable certificate validation".

There's no way I'd trust random developer to implement mTLS properly.

You can trust that the same way you trust any other part of your product. Code review, automated test.

If adding basic mTLS security to every service is that much of a pain, maybe you have too many of those?

To set up an open-source service mesh, the infra team anyway has to configure a private certificate authority and cert-manager to create k8s secrets for the service mesh components. From there, it's straightforward to extend the common deployment template (hopefully there is one) to mount a volume with an auto-rotated certificate. All an application developer has to do is to use that certificate, which is much less effort than what you are implying.

It’s not less effort. I’ve done both ways in production for large teams. What you described is literally entirely automated by the mesh in a more secure and maintainable way than a bespoke hand rolled solution.

"Large teams" is the key, there has to be enough services and/or language diversity to justify the extra complexity.

> But as an application developer, do you want to manage certificates?

It might take years of trying to avoid TLS to learn that all the alternatives are far worse. So—yes, just bite the bullet, it's not that bad once you internalize the model, and you really only need to solve this once per organization.

Reply on news.ycombinator.com