Hacker News Reader

Comment by captainkrtek | Hacker News Reader

Depends on the nature of the breach, if its a flaw in the software itself, then perhaps exploitable both in the hosted offering and BYOC offering, though perhaps the BYOC aspect gives a bit of "security-through-obscurity" and less discoverable as a target.

View on HN

Good point, there are of course different levels.

I was thinking of a fully private deployed within the customers cloud account connected to the software provider via Private Service Connect or PrivateLink and then either only available inside the customers private network or only via their own firewall. The point being that it's not publicly exposed.

What they refer to BYOC is bring your own cloud account for the cluster, while it still connects out to the same shared control plane (and that also connects into your cloud account) that is used for their PaaS offering. At least for BYOC with AWS the connections to the control plane all go over the internet and not via PrivateLink etc.

Since all your metadata and env vars live on the control plane, any issues there could affect the BYOC cluster.

There are some other options for a separate control plane, e.g. now they seem to have the term "forward-deployed control plane" which might be fairly close to what you're thinking of, but their BYOC by itself does not get what you want.

I was thinking the same thing on security-through-obscurity.

a hacker might know how to hack your service, but they'd have to find it first.

Reply on news.ycombinator.com