[michaelbuckbee]

Admin'ing a system is hard work requiring a deep understanding of many different application, os and network systems, rigorous attention to detail, good communication skills and being subscribed to a variety of fractured news and alert systems to sort out what inbound patches and mitigations are relevant and what can/should be applied.

Which leads me to the point of FAAS (and other managed services like Heroku, etc). which is to let you put up a web service on the increasingly hostile and dangerous Internet without either:

- Learning all of the above (none of which is taught in a standard CS degree)

- Hiring a Sysadmin for six figures.

Any time FAAS comes up people correctly point out that a sysadmin still needs to do the work of handling the underlying OS updates, etc - which misses the point. It's the difference between flying in a 737 that's been inspected by a certified mechanic who is looking for a hundred things it would never occur for me to even consider and flown by a pilot with thousands of hours in the cockpit versus someone who flies their small aircraft a couple weekends a month and does their own inspections.

In general, I trust that the security and SRE teams at Google, AWS, Microsoft who are the main people deploying building out these FAAS systems have a better handle on these things than whoever is handling sysadmin tasks on random VPS.

[guypod]

I have no doubt the operators of those networks do - on average - a far better job operating the systems. My concern is that FaaS developers would therefore consider FaaS naturally secure, and forget there are still quite a few security risks they have to tackle themselves.