bloomberg on supermicro: sky is falling

Mon Oct 8 17:31:11 UTC 2018

The risks of VPN aren't in the VPN itself, they are in the continuous 
network connection architecture.

90%+ of VPN interconnects could be handled cleanly, safely, and reliably 
using HTTPS, without having to get internal network administration 
involved at all.
And the risks of key exposure with HTTPS are exactly the same as the 
risks of having one end or the other of your VPN compromised.

As it is, VPN means trusting the network admins at your peer company.

On 10/08/2018 12:15 PM, valdis.kletnieks at vt.edu wrote:
> On Mon, 08 Oct 2018 08:53:55 -0500, Daniel Taylor said:
>> Especially when you have companies out there that consider VPN a
>> reasonable way to handle secure data transfer cross-connects with
>> vendors or clients.
> At some point, you get to balance any inherent security problems with the
> concept of using a VPN against the fact that while most VPN software has a
> reasonably robust point-n-drool interface to configure, most VPN alternatives
> are very much "some assembly required".
>
> Which is more likely?  That some state-level actor finds a hole in your VPN
> software, or that somebody mis-configures your VPN alternative so it leaks keys
> and data all over the place?