23 ms·

Seems as if this is a reasonable request, which is being framed as an unreasonable one. WalMart has asked a Data-Warehousing service (via its customer) to plea

Seems as if this is a reasonable request, which is being framed as an unreasonable one. WalMart has asked a Data-Warehousing service (via its customer) to please not do what it does - data-warehouse internal information about sales, revenue, etc - on their retail-competitor's servers. Data which could give Amazon sensitive inside information on WalMart's operations and financials.. I dono if they've made other less-reasonable requests, but the example provided in the article is completely reasonable. I always find it a ironic when I've interacted with startups which have a plan to bring some disruptive thing to market that potentially competes with Amazon or Google, and yet route all their data and communication through these platforms. :)

kakarot 9y ago
I don't use AWS, but it's not against their ToS to encrypt data at all stages, right? How does that not that solve this problem? I would hope that anyone using a cloud provider follows that practice.
- gshulegaard 9y ago
  Honest question, I apologize if it's stupid... But how do you guarantee encryption at all stages such that Amazon cannot snoop it when you have to do final mile encryption on hardware controlled by Amazon? I mean encryption for messenger services where each end is not controlled by a third-party is one thing...but how do you guarantee the third-party in control of the hardware responsible for performing the encryption isn't snooping? The only thing I can think of (and again this isn't my strongest area) is to not handle any data on an Amazon server that isn't already encrypted...but how does that work if you are using a service like RDS or Redshift? And even if you could work out a super complicated security-conscious solution...is it unreasonable for Walmart to not trust all it's vendors to take such extreme measures and therefore just create a general policy against the use of AWS?
  - FmrAMZN_TA 9y ago
    You can't (and they don't promise) encryption such that AWS can't see everything, if they were in fact malicious. This is true of every cloud. That said, it's not illegal for them to see that xxx vendor increased their storage costs/bandwidth costs by $yyy every month, and that you could look into it - without using one piece of encrypted data. Disclosure: Former AWS
    - gshulegaard 9y ago
      Thanks for the reply! Pretty much what I thought...just wasn't sure if the original comment knew of some process I wasn't familiar with that obviated my belief.
    - kakarot 9y ago
      I was thinking client-side encryption and decryption, and if you need to run operations on the server, utilizing homomorphic encryption practices. Is this not feasible or just naive?
      - cobookman 9y ago
        How do you stop the cloud provider from accessing ram or cpu cache. At some point the data has to be decrypted for it to be used. And if decrypted on Amazon equipment, then Amazon could in theory gain access to it.
        kakarot 9y ago
        I did some googling and came to the conclusion that homomorphic encryption is not quite as supported in consumer hardware as I had believed. I didn't even think about the CPU cache. I guess this remains an unsolved problem. If Walmart's motivations are truly that Amazon might peek into vendor data, then it's a reasonable request after all.
        x1798DE 9y ago
        They were saying all decryption would happen client side and the only operations done by the server would be ones where the server can operate on encrypted data and yield encrypted results. I suspect that the main sticking point in that plan would be that the current state of homomorphic encryption is fairly limited/slow, so if you need AWS for computation as opposed to storage, it's not a practical plan.

kakarot 9y ago

I don't use AWS, but it's not against their ToS to encrypt data at all stages, right? How does that not that solve this problem? I would hope that anyone using a cloud provider follows that practice.

gshulegaard 9y ago
Honest question, I apologize if it's stupid... But how do you guarantee encryption at all stages such that Amazon cannot snoop it when you have to do final mile encryption on hardware controlled by Amazon? I mean encryption for messenger services where each end is not controlled by a third-party is one thing...but how do you guarantee the third-party in control of the hardware responsible for performing the encryption isn't snooping? The only thing I can think of (and again this isn't my strongest area) is to not handle any data on an Amazon server that isn't already encrypted...but how does that work if you are using a service like RDS or Redshift? And even if you could work out a super complicated security-conscious solution...is it unreasonable for Walmart to not trust all it's vendors to take such extreme measures and therefore just create a general policy against the use of AWS?
- FmrAMZN_TA 9y ago
  You can't (and they don't promise) encryption such that AWS can't see everything, if they were in fact malicious. This is true of every cloud. That said, it's not illegal for them to see that xxx vendor increased their storage costs/bandwidth costs by $yyy every month, and that you could look into it - without using one piece of encrypted data. Disclosure: Former AWS
  - gshulegaard 9y ago
    Thanks for the reply! Pretty much what I thought...just wasn't sure if the original comment knew of some process I wasn't familiar with that obviated my belief.
  - kakarot 9y ago
    I was thinking client-side encryption and decryption, and if you need to run operations on the server, utilizing homomorphic encryption practices. Is this not feasible or just naive?
    - cobookman 9y ago
      How do you stop the cloud provider from accessing ram or cpu cache. At some point the data has to be decrypted for it to be used. And if decrypted on Amazon equipment, then Amazon could in theory gain access to it.
      - kakarot 9y ago
        I did some googling and came to the conclusion that homomorphic encryption is not quite as supported in consumer hardware as I had believed. I didn't even think about the CPU cache. I guess this remains an unsolved problem. If Walmart's motivations are truly that Amazon might peek into vendor data, then it's a reasonable request after all.
      - x1798DE 9y ago
        They were saying all decryption would happen client side and the only operations done by the server would be ones where the server can operate on encrypted data and yield encrypted results. I suspect that the main sticking point in that plan would be that the current state of homomorphic encryption is fairly limited/slow, so if you need AWS for computation as opposed to storage, it's not a practical plan.