4 ms·

Not sure why you're being downvoted. Running any kind of financial service I would expect a corp to run their own hardware.

jlgaddis 9y ago
Those who trust Amazon with all of their secrets don't like to be told that they shouldn't be doing it.
Terretta 9y ago
Do you think just “any kind of FS” running things on their own is patched or firmware updated before embargo lifted, etc? Or is even informed pre-disclosure?
- cookiecaper 9y ago
  How is that an issue if they're not multi-tenant anyway? It's not like Amazon will go in and automatically patch your guest image whenever there's a security problem. This is only an "advantage" when you're running on a cloud and the issue affects the underlying host, in which case, there's even more reason not to be in the cloud, because it's just a reminder "any of these thousands of strangers we've stuck you with could've been breaking the isolation this whole time, gee sorry about that". It's not that there are never security issues on non-cloud systems, but the risk of cloud is severely underappreciated. I don't know how anyone can claim otherwise in a post-Specre world. At least on non-cloud, you don't have to worry about the CPU stabbing you in the back. Spectre can read data out of memory at hundreds of kilobytes per second. That's plenty fast to get interesting data out of Coinbase even if they're "rapidly cycling" their instances. And really that just means you just have to camp out and wait for them to come to you, rather than trying really hard to get on the same instance as them, which would probably be harder. You just have to know what region + az they're in (not secret), and you can probably guesstimate some other stuff and end up on a similar hardware class, and then I am sure that after not-too-long they'll join your host. And sure, Spectre is now "mitigated" as far as we know, but it wasn't until recently, so we don't know who could've done this, and it's not like that's the only VM isolation breaker out there. There are certainly more conventional bugs that are readily exploited. There are also other non-technical attack vectors on a provider like AWS, like Amazon employees. I may be more understanding if there was some important reason to take these kinds of risks, but honestly it's ridiculous that people cling to the cloud so desperately. Hardware is not that scary and a lot of hardware jockeys are pretty friendly. Is software really so age-discriminatory that no one remembers a life before cloud servers? It wasn't that bad! Call your local hardware vendor and they'd be ecstatic to set you up with a rack running VMWare or Xen or whatever "private cloud", giving you the convenience of a hypervisor without the risk profile of sharing a CPU with every Tom Dick or Harry on the internet. And the real kicker? It'll be 10x cheaper than the annual AWS bill for comparable resources.
user5994461 9y ago
Truth is, they will outsource to Equinix or specialized datacenters. Noone has been running their own datacenter for a while.
- artimaeis 9y ago
  > Noone has been running their own datacenter for a while. I tend to agree that new businesses are very unlikely to invest in their own metal - because it's not really a path to profitability, but many small-medium businesses run their own data centers. Especially if the business was founded in the 90s and the leadership hasn't chosen to invest in tech. Many businesses choose not to scale (in ways which cloud services would help) - many more just have no need to scale (i.e. regional service providers).
- cookiecaper 9y ago
  Big difference between running on colo'd hardware and running on cloud. It's still "own hardware" in someone else's rack.
  - user5994461 9y ago
    The hardware can be leased. It doesn't have to be yours.
- MandieD 9y ago
  Most very large old-school industrial firms still own and run a lot of iron on-prem, especially in data-privacy focused places like Germany. My employer, one of those old-school German industrial firms, is just starting to dip its little toes into the cloud - everything important is still on-prem. Companies are talking in public about their cool cloud stuff, but talking to my fellow OSGIF engineers, we're all really in the Proof of Concept phase, pretty much.
  - user5994461 9y ago
    on premise has been on the decline for almost two decades. It didn't wait for the buzz around AWS. Try outsourcing a software project to some sweatshops, they will offer you to rent the hardware in their datacenters. Germany is no exception.

jlgaddis 9y ago

Those who trust Amazon with all of their secrets don't like to be told that they shouldn't be doing it.

Terretta 9y ago

Do you think just “any kind of FS” running things on their own is patched or firmware updated before embargo lifted, etc? Or is even informed pre-disclosure?

cookiecaper 9y ago
How is that an issue if they're not multi-tenant anyway? It's not like Amazon will go in and automatically patch your guest image whenever there's a security problem. This is only an "advantage" when you're running on a cloud and the issue affects the underlying host, in which case, there's even more reason not to be in the cloud, because it's just a reminder "any of these thousands of strangers we've stuck you with could've been breaking the isolation this whole time, gee sorry about that". It's not that there are never security issues on non-cloud systems, but the risk of cloud is severely underappreciated. I don't know how anyone can claim otherwise in a post-Specre world. At least on non-cloud, you don't have to worry about the CPU stabbing you in the back. Spectre can read data out of memory at hundreds of kilobytes per second. That's plenty fast to get interesting data out of Coinbase even if they're "rapidly cycling" their instances. And really that just means you just have to camp out and wait for them to come to you, rather than trying really hard to get on the same instance as them, which would probably be harder. You just have to know what region + az they're in (not secret), and you can probably guesstimate some other stuff and end up on a similar hardware class, and then I am sure that after not-too-long they'll join your host. And sure, Spectre is now "mitigated" as far as we know, but it wasn't until recently, so we don't know who could've done this, and it's not like that's the only VM isolation breaker out there. There are certainly more conventional bugs that are readily exploited. There are also other non-technical attack vectors on a provider like AWS, like Amazon employees. I may be more understanding if there was some important reason to take these kinds of risks, but honestly it's ridiculous that people cling to the cloud so desperately. Hardware is not that scary and a lot of hardware jockeys are pretty friendly. Is software really so age-discriminatory that no one remembers a life before cloud servers? It wasn't that bad! Call your local hardware vendor and they'd be ecstatic to set you up with a rack running VMWare or Xen or whatever "private cloud", giving you the convenience of a hypervisor without the risk profile of sharing a CPU with every Tom Dick or Harry on the internet. And the real kicker? It'll be 10x cheaper than the annual AWS bill for comparable resources.

user5994461 9y ago

Truth is, they will outsource to Equinix or specialized datacenters. Noone has been running their own datacenter for a while.

artimaeis 9y ago
> Noone has been running their own datacenter for a while. I tend to agree that new businesses are very unlikely to invest in their own metal - because it's not really a path to profitability, but many small-medium businesses run their own data centers. Especially if the business was founded in the 90s and the leadership hasn't chosen to invest in tech. Many businesses choose not to scale (in ways which cloud services would help) - many more just have no need to scale (i.e. regional service providers).
cookiecaper 9y ago
Big difference between running on colo'd hardware and running on cloud. It's still "own hardware" in someone else's rack.
- user5994461 9y ago
  The hardware can be leased. It doesn't have to be yours.
MandieD 9y ago
Most very large old-school industrial firms still own and run a lot of iron on-prem, especially in data-privacy focused places like Germany. My employer, one of those old-school German industrial firms, is just starting to dip its little toes into the cloud - everything important is still on-prem. Companies are talking in public about their cool cloud stuff, but talking to my fellow OSGIF engineers, we're all really in the Proof of Concept phase, pretty much.
- user5994461 9y ago
  on premise has been on the decline for almost two decades. It didn't wait for the buzz around AWS. Try outsourcing a software project to some sweatshops, they will offer you to rent the hardware in their datacenters. Germany is no exception.