20 ms·
About 10 years ago I met the head of IT for B&H cameras in NYC. Among many things, he was in charge of the hosting for their online store. After he complained a
by nateburke 6y ago
About 10 years ago I met the head of IT for B&H cameras in NYC. Among many things, he was in charge of the hosting for their online store. After he complained about dealing with physical servers, I asked him if he had ever considered using AWS ec2 for the website, and he replied that his boss refused because he believed that Amazon would pull data on B&H products and use it to compete more effectively.
I'm not sure that Amazon would be able to pierce the veil of the hypervisor like that, but his instincts were in the correct direction.
- jhall1468 6y agoThat's absolutely not the same thing lol. What Amazon did is unethical. What you are describing is illegal.
- CobrastanJorji 6y agoI'm honesty curious what crime this would be. If I rent time on someone else's server, and they look at what I'm doing on that server, what illegal thing has happened?
- rickety-gherkin 6y agoAssuming that the information would be behind at least a password entrance that a user had setup, Amazon breaking through that would be considered illegal unless they had a court order or something. They can peer into metadata that your machine creates but I think looking at private information on a server that they lease out would be illegal. Maybe I'm just hopeful?
- bluntfang 6y agoThis could fall under Unlawful Access to Computers.
- eecc 6y agoHuh, WTF?! Your FBI used to railroad random kiddies for messing around with poorly programmed dynamic pages and now you’re arguing there’s nothing wrong if a hosting provider trespasses and mines your private property?!
- sneak 6y agoThe rules the FBI/DoJ applies to kids on irc are not the same rules the FBI/DoJ applies to multibilliondollar infrastructure companies and/or trusted military defense contractors (Amazon is both). Equal protection or application of computer crime law (perhaps, any law) in the USA is a fiction. It would be practically illegal to invent and run a web spider today, for instance, if they didn’t already exist as a concept. (France recently decided this was true for news link aggregation; Google must pay the newspapers for reproducing their headlines. I’m glad hosted RSS readers aren’t outlawed so far, but under these sorts of restrictive legal interpretations you could see how they might be. Google doing AMP, of course, gets a free pass.) If you don’t believe me about the web spider thing, try making a complete download of Twitter for the purpose of making a tweet search index and see if you get to continue owning your house. (My theory is that Clearview is allowed to do it for Instagram because they’re using the database to provide services to law enforcement/military, so those groups want it to continue to exist free of prosecution.) Bummer that actively collaborating with violent types like pigs and military seems to be the only way to avoid jail if you want to build large novel data systems with interesting public datasets today. This sort of freedom to experiment with new/neat algorithms over published documents got us Google; today these same companies will get you raided if you dare download/index their data. (Facebook’s idea famously started out scraping public yearbook photos. Try scraping Facebook now.) one small counterpoint: https://www.eff.org/deeplinks/2019/09/victory-ruling-hiq-v-linkedin-protects-scraping-public-data https://www.eff.org/deeplinks/2019/09/victory-ruling-hiq-v-l... RIP aaronsw
- steffan 6y agoI read the parent comment as less of an argument against it than a question of which laws do we have in place to prevent it.
- snowwrestler 6y agoAmazon owns the computer and grants you limited rights to use it, in exchange for the money you pay them. It's basically the opposite of a script kiddie hacking into someone else's web server. Now, indiscriminate access to your content might violate whatever commitments Amazon made to you in their terms of service; I have not read them for a long time and can't remember what the language is specifically. But that would not be a matter for the FBI.
- ceejayoz 6y agoSeems like a pretty clear violation of https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act.
- kube-system 6y agoI'm not so sure about that. AWS terms do not assign their customers any rights to any physical computer. And the AWS customer agreement gives Amazon the authority to access your data for certain purposes. I'm not sure I've ever heard of anyone prosecuted under the CFAA for accessing a computer that they physically own and physically control. AWS is a service, not a computer rental.
- ceejayoz 6y agohttps://aws.amazon.com/agreement/ https://aws.amazon.com/agreement/ > We will not access or use Your Content except as necessary to maintain or provide the Service Offerings, or as necessary to comply with the law or a binding order of a governmental body. The CFAA uses wording like "exceeds authorized access", which Amazon would absolutely be guilty of if they went into your database to spy on your product listings. If they could go after Aaron Swartz for using authorized access in an unauthorized way, it seems likely it could be applied here.
- SkyBelow 6y ago"One reason we could charge the price we did for the service is that we were treating the data we had access to as an investment. Thus the data we accessed was done so to ensure the service could be maintained." Would a judge accept that argument? From me? No. From the lawyers Amazon can afford? I wouldn't be comfortable betting either way.
- kube-system 6y agoThe CFAA doesn't protect "content", though. It protects "protected computers". In this case, Amazon fully owns, possesses, and operates the "protected computer". You'd have to successfully argue that Amazon fraudulently accessed their own computer. It might be possible, but I'm guessing it'd be a first. The difference in Aaron's case is huge: he didn't own the computers that hosted JSTOR.
- 12xo 6y agoWhy do you feel its unethical?
- deleted 6y ago[deleted]
- motoboi 6y agoThere is absolutely no veil between the hypervisor and the guest virtual machines. Not in the EBS either. If they say they won't read your data, better trust them. If you don't, stay away from their datacenters. EDIT: fix typo.
- TimSchumann 6y ago> The is absolutely no veil between the hypervisor and the guest virtual machines. Not in the EBS either. This is 100% true. To do any useful computation on your data (read, what you're using all AWS for) they have to have 100% visibility into your data. > If they say they won't read your data, better trust them. If you don't, stay away from their datacenters. That's it, right there. All of this is based on Trust in Amazon, not some technology that provides any assurances, much less proof, they're not looking at your data. They can pull the curtain off anything you're running in their cloud, at any time they feel like it. It has to work this way for AWS to be of any use, and by using AWS you're implicitly trusting Amazon with your data.
- xnyan 6y agoFor about half a billion they will build you an aws on site(s) you control: https://cloudcheckr.com/cloud-security/understanding-aws-govcloud-aws-secret-region-and-aws-top-secret-region/ https://cloudcheckr.com/cloud-security/understanding-aws-gov...
- darkerside 6y agoThis is a similar level of trust that you give to banks not to seize your money, or to your bodyguard not to do you physical harm. Stealing data from a customer paying for hosting would be _very_ different, and much more scandalous, than identifying trends on a competitive marketplace and taking advantage of them by launching competing products.
- adrianmonk 6y agoOr your commercial landlord to not send the cleaning staff to rummage around in your filing cabinets. Which, while it could happen, is something that people don't really seem to get concerned about.
- zucker42 6y agoCouldn't they use Azure? Of course there are other reasons to use physical servers.
- deanCommie 6y agoSounds like this head of IT isn't very good at his job if he can't explain the difference between EC2 access, databases, and web requests over TLS There are ways that you can use AWS that Amazon would have no way to access any of your data even if they wanted to.
- jedimastert 6y ago> There are ways that you can use AWS that Amazon would have no way to access any of your data even if they wanted to. Is it worth the extra effort and moving already functional servers to do so?
- beagle3 6y agoThey have 100% hypervisor access. To give them zero knowledge, you need full homomorphic encryption which is impractical at this point (and likely for a while). You may trust them not to abuse hypervisor access, but they still have network “meta” data - it could tell them how many transactions clear against credit processors (though not the actual amounts if encrypted), a good idea general distribution of page views With respect to time and user ip (though not the exact pages), times of day, demographics of users (Geo locations and ISPs, for example) If you don’t trust them not to peek at what they can, don’t use them. He is perfectly right. There are other cloud providers who aren’t competing with B&H and would be a better choice. But amazon is a direct competitor to B&H, even if they do have an IT barrier - they cross subsidize; any $ paid to Amazon helps it against B&H.
- sudosysgen 6y agoEven if homomorphic encryption was practical, you would need hardware to decrypt that would have to be either on the cloud oron premise.
- deleted 6y ago[deleted]
- vageli 6y agoIf any decryption of your data occurs on AWS hardware (i.e. if your software in AWS has access to your unencrypted data), then wouldn't AWS also have access to it if they wanted? Even with encrypted volumes, etc, the decrypted data is present in memory, AWS controls the box with the memory in it.
- swarnie_ 6y agoI love B&H, we planned family holidays from the UK specifically around buying from this shop. When the $/£ exchange was healthier we got some real bargains!
- tegansnyder 6y agoIts my understanding a some of the large bricks and mortar retailers also stray away from hosting on AWS for these same reasons.
- Analemma_ 6y agoI think that’s less about being afraid that Amazon will steal their data, and more that they don’t want to give any money to an entity already steamrolling them
- Kalium 6y agoSome are legitimately afraid that AWS will deprive them of the ability to scale during peak times, like holiday shopping seasons. I've heard claims of this happening to more than one retailer. Personally, I wonder if that isn't an emergent property of a lot of people trying to scale at once.
- jaywalk 6y agoWalmart won't even allow their suppliers to use AWS.
- namelessoracle 6y agoHome Depot refuses to use AWS and partners with Azure for this reason.
- gundmc 6y agoHome Depot uses GCP.
- fma 6y agoWonder if they are on Microsoft's Azure now?
- jaywalk 6y agoJust did a tracert to their website. After hitting b-h-photo-v.ear1.newark1.level3.net it goes through a couple routers on an IP block they own before hitting their IP. Safe to say they are not on Azure.
- pacala 6y agoAt the very least, they own your IP traffic. From there, every single value-add service you use gives them an opportunity to eavesdrop your data. Take, for example, https://aws.amazon.com/elasticloadbalancing https://aws.amazon.com/elasticloadbalancing. All of the sudden your URL traffic is 'fair' game.
- qaq 6y agoThis amazes me it's so much easier at that scale to deal with 6-10 boxes vs all the crap that comes with AWS. Don't want to deal with managing them there are companies that will do it for you and you will have an actual on call people that are accountable to you. Unless you are doing 6+ figures a month in AWS spend have fun trying to have same level of service.
- dfsegoat 6y agoI genuinely want to understand the point you are presumably making here, but I’m honestly having a tough time with understanding what it is.
- CamperBob2 6y ago"If you use their boxes, they own your data. Don't use their boxes."
- AmericanChopper 6y agoI’m a big believer in use cases that fit on-prem solutions like that. But you’re dreaming if you think a 6-10 box operation is going to come close to the same service levels as AWS, and if you want to replicate the developer experiences that you can achieve on AWS, you’re going to have to devote a lot of resource to it. Whether scaling works well on-prem depends entirely on your scaling requirements. If you have bursty loads, or sudden increases in utilization, then scaling is going to be painful, because it will require hardware procurement, which is a slow process. There’s situations where it makes sense, but there’s way more factors than you’re considering in this comment, and you’ve completely misrepresented what the trade offs are.
- qaq 6y agoI am not only not dreaming I've being running workloads like that for a long time. Both in cloud and colo. If it's my money sanity or ass on the line colo is my strong pref. I def. do not want to replicate developer experience of AWS in Colo as AWS has s ton more moving pieces which are black boxes and have arbitrary limits. Scaling is a disingenuous point for most e-commerce apps as you generally have RDBMS that do not scale horizontally so cloud or no cloud your bottleneck is the same. The price point at which say Spanner would outperform a cluster of RDBMS on high end boxes is way south of 100K/month and no of the shelf e-commerce software would support it anyway.
- 3pt14159 6y agoHold up one second. Is this something that they're actually open to doing? Surely part of their ToS isn't about stealing data on their physical infrastructure to enable other aspects of their business. Right? Has any data centre ever done this?
- throwaway_aws 6y agoThrowaway account for obvious reasons. In the past, AWS has used the data from third party hosted services on AWS to build a similar service and in fact start poaching their customers. Source: I used to be at AWS and know the PM & his manager who built a service this way. I was hired on that team.
- deleted 6y ago[deleted]
- gk1 6y agoYou should talk to this guy: https://twitter.com/daiwaka https://twitter.com/daiwaka He wrote this: https://www.nytimes.com/2019/12/15/technology/amazon-aws-cloud-competition.html https://www.nytimes.com/2019/12/15/technology/amazon-aws-clo...
- secretasiandan 6y agoHave you ever been tempted to tell people (journalists, government) about it? If not, are there any particular reasons?
- throwaway_aws 6y agoAs for talking to journalists, I didn't leave with any ill will and don't want to complicate my life. I personally know a friend who got involved with journalists... his past employer came to know about it, sued him... and he became almost unemployable in the valley. Edit: fixed a typo
- movedx 6y ago> ... his past employer came to know about it, sued him... and he became almost unemployable in the valley. You might have a family to protect. A home to maintain, etc. I understand. It's scary. But the world doesn't and cannot change for the better if we let corporations bully us into silence. The world will and does change when brave individuals, with the support of society, stand up and blow the whistle.
- 6y ago
- mr_toad 6y agoIt’s just as likely one of your own administrators could steal it and sell it to a competitor. A lot of espionage is inside jobs.
- RandomBits98765 6y agoImagine if amazon has as much ad presence as google or fb. If they're able to identify you as a business of interest and identify your key employees you're pretty much f'd unless they have adblockers and even that might not be enough
- _bxg1 6y agoChrist, this thought is terrifying. If any company would be this shady it would be Amazon, and they have the greatest market share. And other commenters here make it sound like it's not even clearly illegal. The one point of solace is that there's a lot of competition out there for web hosting.
- deleted 6y ago[deleted]
- softawre 6y agoI know the B&H execs too. All Hasidic Jews, super nice, smart people. They had a big contract with some software I wrote ages ago.