3 ms·
It's gonna depend on your threat model ultimately. Hard to imagine running on AWS if you don't trust them though.
by staticassertion 6y ago
It's gonna depend on your threat model ultimately. Hard to imagine running on AWS if you don't trust them though.
- twoodfin 6y agoIt's not so much about trusting AWS not to pry into your data. More that the attack surface of your data as presented to AWS' other—potentially hostile—customers is (presumably) significantly reduced by not having the bytes flying around AWS' infrastructure in the clear. To put it mildly, Amazon has a lot more folks a lot smarter than me thinking about these tradeoffs, so I assume they had good reason to think it was fine the first time around. I'm just surprised that the state-of-the-art for cloud-hosted services doesn't presume building on TLS from day 1, so I'd love to know what those reasons are.