111 reputation
5
bio website blog.codingoutloud.com
location Boston, MA
age
visits member for 2 years, 6 months
seen yesterday

Bill Wilder is a hands-on developer, architect, consultant, trainer, speaker, writer, and community leader focused on helping companies and individuals succeed with the cloud using the Windows Azure Platform. Bill began working with Windows Azure when it was unveiled at the Microsoft PDC in 2008 and subsequently founded Boston Azure, the first/oldest Windows Azure user group in the world in October 2009. Bill is recognized by Microsoft as a Windows Azure MVP and is the author of the book Cloud Architecture Patterns, published by O’Reilly in September 2012. Bill can be found blogging at blog.codingoutloud.com and on Twitter at @codingoutloud. You can also check out the Boston Azure cloud user group at www.bostonazure.org and @bostonazure. If you are interested in Windows Azure consulting services for architecture, development, training, or other expertise, Bill consults through his company Development Partners Software.


Mar
17
answered How to react when under attack
Mar
17
revised What are practical risks of http (not https) in server-to-server communications
edit 2
Mar
17
awarded  Citizen Patrol
Feb
12
awarded  Popular Question
Dec
4
awarded  Student
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
Regarding "how much will it cost you if someone steals data from company a or company b - if its more than the cost of buying a cheap SSL cert then it's justified." Respectfully, I do not believe a proper model can be that simple. Is it not also a function of the probability of compromise? This was the thrust of the question "How does one reason about the associated risk?"
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
That is for the consumer site, I assume. My (non-rigorous!) experiment just now with a call to an API endpoint does not appear to redirect to SSL. And the "key" this API wants includes a username and password (!). Anyway, even if it did redirect, the damage would have been done.
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
@Kyle - not sure why asking this question is a facepalm ( which I had to look up: urbandictionary.com/define.php?term=face%20palm ). Care to speculate as to why these high profile sites allow their API keys to travel in the clear?
Feb
25
awarded  Supporter
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
Thank you for the response. Why do you think Posterous et al allow their callers to expose a key in the clear? I can only guess they did some cost/risk tradeoff and decided it was okay to allow. Other APIs, such as from Twitter and Twilio, only appear to offer secure endpoints.
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
+1 for PROBABLY comment since security is a trade-off [“Security is always a tradeoff; it must be balanced with the cost.” - Bruce Schneier]. Interestingly, Posterous, et al, do expose a key that can be used to make changes on behalf of user, not just view public data. I appreciate the links. It is not that I don't understand encryption, it is that I am trying to understand the risk. My "How does one reason about the associated risk?" question in my post speaks to my curiosity around how to model it. Modeling requires cost of loss (which I did not specify) + chance of loss (big question).
Feb
24
awarded  Editor
Feb
24
revised What are practical risks of http (not https) in server-to-server communications
added add'l context about existing public apis that do this
Feb
24
asked What are practical risks of http (not https) in server-to-server communications