stephen barncard wrote:
> jbv wrote:
>> My remark is probably OT, but I'm still reluctant in putting my
>> clients' data in the cloud, and prefer to keep them on our own
>> servers... Just curious : what is your approach to the problem
>> all of you guys ?
>
> I would trust somebody like Amazon more than my own security team.
>
> But I think I would rather wait until we hear from Richard Gaskin.
Thank you for the kind words, Stephen, but I usually just do whatever
Pierre suggests. :)
JBV: is the client data a LiveCode project, or something else?
There's a wide range of options for both, with tons of cloud stuff
available for free.
For team management of LiveCode projects I have a system in progress I
mentioned here an embarrassingly long time ago, back then I was
referring to it as RevCloud:
<http://lists.runrev.com/pipermail/use-livecode/2010-June/142386.html>
It turns out that the backend for that has been useful in other
scenarios, from student records to custom CMS solutions. So the upside
is that those client projects have moved the platform along well, but
the downside is that they've kept me too busy to complete the front-end
for the original scenario, LiveCode project management. Hopefully time
will free up later this year to finish that.
But it's not too hard to ad hoc your way into a simple solution to get a
specific job done. With what I used to call RevCloud I spent a lot of
time making a custom data store because I have other needs for it down
the road that will have some unusually tight memory and CPU limits I
need to accommodate. But if instead you take a saner path and use MySQL
or even SQLite you can snap together something useful in a few days.
And if your needs are more general there are tools like OwnCloud where
you can build custom cloud solutions while still leveraging lots of
excellent work from really smart devs.
For security, maybe I'm lax but I feel that if SSL certs are good enough
for banking and medical records they're more than sufficient for any
industrial espionage that might be a risk with client projects. :)
And libURL makes it easy to use both custom and shared certs, the latter
being a fairly cheap option with most hosting companies.
There are other aspects to security beyond encrypting the data stream,
and Stephen is wise to suggest letting others who specialize in that
handle as much as you can offload to them.
But like everything else in computing (and perhaps all of life), it's
all about tradeoffs. With cloud solutions the tradeoffs often involve
cost, flexibility, security, and more. You can choose a solution that
optimizes for two or more, but not likely all.
If flexibility is critical and the nature of the client data doesn't
involve nuclear secrets, you may be pleasantly surprised how nice it is
to work with Ubuntu Server on a VPS, or even on a small box in your
office if you connection will allow it.
Right out of the box Ubuntu's firewall is locked down pretty tight (in
the default configuration it doesn't even allow SSH until you turn it
on). And if you take the five minutes needed to set up a shared key for
password-free login, it's not only more secure but oh so convenient to
access.
On any server your auth.log will show hundreds of attempt to break in
every day, and when you're just getting started it can be pretty
alarming. But with my fairly stock Ubuntu/LAMP/LiveCode test system
here in my office, on a fixed IP and outside my hardware firewall where
it's easy for bots to find, so far no attempts have been successful.
I'm not a security expert, and if a system is critical it's probably a
good idea to hire one, even if you use an outside vendor for your cloud
services. Penetration testing services are often well worth the
investment when the stakes are high.
There are many potential points of failure in online systems, from
injection attacks (relatively easy to avoid with modest effort) to
buffer overruns (to which I'm told LiveCode is almost entirely immune),
and more.
Many of these risks are inherent to the app you're building, even when
you're configuring something off-the-shelf, so even with an external
service like Amazon we can't get lax about security.
But on balance, everything is hackable and most of our work doesn't
involve nuclear secrets. Take reasonable precautions, remain willing to
learn, and stay on top of updates to all aspects of the system, and
chances are your system will survive at least as well as Target's. :)
And if you just want to share files, I've been enjoying Ubuntu One with
its native clients for OS X, Windows, iOS, Android, and of course Linux
- here's some tips on setting it up for folder sharing:
<http://www.howtogeek.com/117064/how-to-share-files-online-with-ubuntu-one/>
Ubuntu One offers 5GB for free, and if you decide to explore it you can
sign up with this link and you and I both will get an additional free
500 MB:
<https://one.ubuntu.com/referrals/referee/3401205/>
--
Richard Gaskin
Fourth World
LiveCode training and consulting: http://www.fourthworld.com
Webzine for LiveCode developers: http://www.LiveCodeJournal.com
Follow me on Twitter: http://twitter.com/FourthWorldSys
_______________________________________________
use-livecode mailing list
use-livecode@lists.runrev.com
Please visit this url to subscribe, unsubscribe and manage your subscription
preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode
