network profile
| bio | website | blog.codingoutloud.com |
|---|---|---|
| location | Boston, MA | |
| age | ||
| visits | member for | 1 year, 3 months |
| seen | Feb 26 at 21:38 | |
| stats | profile views | 2 |
Bill Wilder is a hands-on developer, architect, consultant, trainer, speaker, writer, and community leader focused on helping companies and individuals succeed with the cloud using the Windows Azure Platform. Bill began working with Windows Azure when it was unveiled at the Microsoft PDC in 2008 and subsequently founded Boston Azure, the first/oldest Windows Azure user group in the world in October 2009. Bill is recognized by Microsoft as a Windows Azure MVP and is the author of the book Cloud Architecture Patterns, published by O’Reilly in September 2012. Bill can be found blogging at blog.codingoutloud.com and on Twitter at @codingoutloud. You can also check out the Boston Azure cloud user group at www.bostonazure.org and @bostonazure. If you are interested in Windows Azure consulting services for architecture, development, training, or other expertise, Bill consults through his company Development Partners Software.
|
Dec 4 |
awarded | Student |
|
Feb 25 |
comment |
What are practical risks of http (not https) in server-to-server communications Fair point @ewanm89. I will add also that the cash outlay of a commercial cert ($100?) can be dwarfed anyway by other staff costs (dev, test, ops - depends # machines & complexity of apps & APIs). It is this human cost (perhaps better thought about as "complexity") that I am guessing these high profile sites assumed to be not worth forcing on their customers. |
|
Feb 25 |
comment |
What are practical risks of http (not https) in server-to-server communications Regarding "how much will it cost you if someone steals data from company a or company b - if its more than the cost of buying a cheap SSL cert then it's justified." Respectfully, I do not believe a proper model can be that simple. Is it not also a function of the probability of compromise? This was the thrust of the question "How does one reason about the associated risk?" |
|
Feb 25 |
comment |
What are practical risks of http (not https) in server-to-server communications That is for the consumer site, I assume. My (non-rigorous!) experiment just now with a call to an API endpoint does not appear to redirect to SSL. And the "key" this API wants includes a username and password (!). Anyway, even if it did redirect, the damage would have been done. |
|
Feb 25 |
comment |
What are practical risks of http (not https) in server-to-server communications @Kyle - not sure why asking this question is a facepalm ( which I had to look up: urbandictionary.com/define.php?term=face%20palm ). Care to speculate as to why these high profile sites allow their API keys to travel in the clear? |
|
Feb 25 |
awarded | Supporter |
|
Feb 25 |
comment |
What are practical risks of http (not https) in server-to-server communications Thank you for the response. Why do you think Posterous et al allow their callers to expose a key in the clear? I can only guess they did some cost/risk tradeoff and decided it was okay to allow. Other APIs, such as from Twitter and Twilio, only appear to offer secure endpoints. |
|
Feb 25 |
comment |
What are practical risks of http (not https) in server-to-server communications +1 for PROBABLY comment since security is a trade-off [“Security is always a tradeoff; it must be balanced with the cost.” - Bruce Schneier]. Interestingly, Posterous, et al, do expose a key that can be used to make changes on behalf of user, not just view public data. I appreciate the links. It is not that I don't understand encryption, it is that I am trying to understand the risk. My "How does one reason about the associated risk?" question in my post speaks to my curiosity around how to model it. Modeling requires cost of loss (which I did not specify) + chance of loss (big question). |
|
Feb 24 |
awarded | Editor |
|
Feb 24 |
revised |
What are practical risks of http (not https) in server-to-server communications added add'l context about existing public apis that do this |
|
Feb 24 |
asked | What are practical risks of http (not https) in server-to-server communications |
