Monthly Archives: June 2015

Yes, there is a “Kerika Blue”

Technology, Usability

We try to be consistent in our use of colors and shades throughout the application, although it is easy to slip up from version to version, particularly since we do so many releases a year.

One recent diversion we corrected was in the use of the color blue: we have a specific shade we call Kerika Blue (#0099CC) which is used to indicate the concept of “new”:

Kerika Blue
Kerika Blue

Kerika Blue is  more muted than the regular blue that you might find elsewhere: we generally try to keep our color scheme muted, so that the decoration of the Kerika app doesn’t compete with your data — after all, your data are far more important to you than anything we do in terms of decorating your screen ;-)

Security within a Virtual Private Network

Kerika, Technology,

All of Kerika’s servers, which run on Amazon Web Services (AWS), operate within a Virtual Private Network (VPN), so they can be configured to only listen on local ports, e.g. ports like 10.0.0.1, etc.

This means that they cannot be accessed directly from the Internet: instead, all connections are routed through an Elastic Load Balancer (ELB), which is a special kind of AWS server that handles connections from all users.

The ELB is very secure: it implements SSL 2.0, and when vulnerabilities like Heartbleed and POODLE are discovered, it is relatively easy for us, with Amazon’s help, to quickly ensure that the the ELBs are patched.  Patching the ELBs quickly gives us breathing room to patch all the other servers involved, particularly if vulnerabilities are found at the platform level itself.

But, running a VPN isn’t enough: while it blocks people outside the Kerika server environment from directly accessing our database, there is still — at least a theoretical possibility — that an attacker can find his way inside the VPN, and then try to connect to our database server on a local port.

To avoid this scenario, we use SSL within the VPN as well, so that the connections from the load balancers to the database servers are also authenticated and encrypted.