7 ms·

I don't know... I don't think there's a strong business case or CSO case for ditching Amazon for ties to yhe US gov't. What are the realistic odds that someone

I don't know... I don't think there's a strong business case or CSO case for ditching Amazon for ties to yhe US gov't. What are the realistic odds that someone internally at Amazon is going to break into your instances to look at your data if you're just a regular business? If you're in a German cloud, those risks are probably higher since your business has local competition, and if you're self-hosting, then your overall security risks are even higher. This seems like a emotional choice, not based on realistic business or security sense.

gigatexal 6y ago
Personally I have 100% confidence that the big clouds are not going to compromise customer data for their own benefit. Perhaps Amazon did this on an abstract level to understand video streaming and the Netflix business to create Amazon Video but I doubt Amazon would have cared for the tiny startup I worked at here in Hamburg. But the hysteria and the “but what if?” thinking is real and it was really codified in bank contracts. So much so that BaFin stipulated that the tech stacks could be audited and there was no way that Amazon was going to allow anyone in to look at it and such. On the whole if it can be afforded my team is so much more productive being able to build on AWS than to spend all that time both building our product and the infrastructure to go with it. I’m just not that smart.
- deleted 6y ago
  [deleted]
- koheripbal 6y ago
  > BaFin stipulated that the tech stacks could be audited It's hard to imagine that this includes the code within a Cloud provider. If you're using a Windows server, are they expecting Microsoft to fork over MS source code? This just sounds like an overly-conservative interpretation of the rules. It basically rules out ANY cloud solutions - which is unreasonable and wouldn't ever hold up under scrutiny even if the Bank or regulators explicitly asked for it.
- LargoLasskhyfv 6y ago
  While AWS is a different operational unit than the shopping one, it is known that they didn't play fair with some vendors. In the end, they cloned some, and ruined some. So the vulture culture exists in parts.
fit2rule 6y ago
Oh, come on. This kind of naïveté is contagious. I'm pretty sure you can think of stronger business cases against Amazon/US-Milspec involvement in a non-American business. Amazon, in the hands of Americas spooks, can do a lot of damage to the world of non-Americans; i.e. anyone the spooks decide to hate/target for usurpation. You think Germany is inured from such attention?
- koheripbal 6y ago
  I think your being overly paranoid. The effort required to covertly break into an AWS instance and not have anyone in the sysadmin teams know is simply not worth it for 99.9% of businesses. I run a simply mid-level business. Amazon doesn't give a crap about my data - that, above all, is what keeps it safe. I'm just not important enough to bother.
  - newen 6y ago
    The whole point about mass data surveillance is that your data is not important enough to bother, until it is.
    - koheripbal 6y ago
      ...unless it never is. ...which is usually the case.
  - fit2rule 6y ago
    >I run a simply mid-level business. Well, you should understand this a little better, then. Okay try this scenario: lets say I work for a German company that is kicking ass in a market that a spook-at-Amazon has heavily invested in - lets just say "personal transportation system X". Because its Germany, the tech is amazing and consequently I'm going to sell this tech to Africa, because I like doing that, and not in America - because fuck America, that's why. Also, maybe China, maybe Kazakhstan. My tech, my choice. Should I succeed in this endeavour, I'm immediately under threat of being NSA'ed by the provider of service I'd rely on, ordinarily, to render my research. This isn't paranoia, it is due diligence. Yeah, no thanks, Amazon. This heralds a watershed moment: a return to local services. Just better to avoid the American spook-o'-sphere entirely, and play a local hand. Maybe even take the data centre guys out for grünkohl and senf some time, whatever. Look - to understand why the hate for all the spook/control paranoia, Americans/Brits/5-eyes/et al., all you have to do is try to see it from the other side of the national identity for a second. Germans are very, very rightly on the side of data protection. The holes in the ground that used to be Gestapo buildings are not all parking lots! Some of them are memorials. Also not paranoia: diligence. (^WThis comment brought to you by the ACME-HNnnn-comment-slowdown-negotiator-system™ .. time wasted, is creativity! Disclaimer: Not German, am applying hypotheticals. Still not paranoia!)
wlesieutre 6y ago
> What are the realistic odds that someone internally at Amazon is going to break into your instances to look at your data if you're just a regular business? I mean, there's this: https://www.wsj.com/articles/amazon-scooped-up-data-from-its-own-sellers-to-launch-competing-products-11587650015 https://www.wsj.com/articles/amazon-scooped-up-data-from-its... > The online retailing giant has long asserted, including to Congress, that when it makes and sells its own products, it doesn’t use information it collects from the site’s individual third-party sellers—data those sellers view as proprietary. > Yet interviews with more than 20 former employees of Amazon’s private-label business and documents reviewed by The Wall Street Journal reveal that employees did just that. Such information can help Amazon decide how to price an item, which features to copy or whether to enter a product segment based on its earning potential, according to people familiar with the practice, including a current employee and some former employees who participated in it. If you're a regular business and Amazon doesn't want to launch a new hosted product competing with you, then maybe you're safe. But if they want your data, why not just take it while repeatedly insisting that they don't?
- koheripbal 6y ago
  That is an apples to oranges comparison. It is wildly different to scoop up data from your own Amazon.com platform vs BREAKING IN to a private AWS instance. They aren't even the same divisions in Amazon Inc, so it would be extremely obvious to everyone, very inappropriate, and most likely get leaked that it was happening.
  - LargoLasskhyfv 6y ago
    Fruit is fruit, both can and do rot :)
nova22033 6y ago
What are the realistic odds that someone internally at Amazon is going to break into your instances to look at your data if you're just a regular business? Going to go out on a limb and say that the NSA is going to have an easier time breaking into your on-prem servers. Hiring a retired General for influence is as old as this town. People are reading too much into this. This doesn't make it more or less likely for Amazon/NSA/CIA/whatever to steal your data.

gigatexal 6y ago

Personally I have 100% confidence that the big clouds are not going to compromise customer data for their own benefit. Perhaps Amazon did this on an abstract level to understand video streaming and the Netflix business to create Amazon Video but I doubt Amazon would have cared for the tiny startup I worked at here in Hamburg. But the hysteria and the “but what if?” thinking is real and it was really codified in bank contracts. So much so that BaFin stipulated that the tech stacks could be audited and there was no way that Amazon was going to allow anyone in to look at it and such. On the whole if it can be afforded my team is so much more productive being able to build on AWS than to spend all that time both building our product and the infrastructure to go with it. I’m just not that smart.

deleted 6y ago
[deleted]
koheripbal 6y ago
> BaFin stipulated that the tech stacks could be audited It's hard to imagine that this includes the code within a Cloud provider. If you're using a Windows server, are they expecting Microsoft to fork over MS source code? This just sounds like an overly-conservative interpretation of the rules. It basically rules out ANY cloud solutions - which is unreasonable and wouldn't ever hold up under scrutiny even if the Bank or regulators explicitly asked for it.
LargoLasskhyfv 6y ago
While AWS is a different operational unit than the shopping one, it is known that they didn't play fair with some vendors. In the end, they cloned some, and ruined some. So the vulture culture exists in parts.

fit2rule 6y ago

Oh, come on. This kind of naïveté is contagious. I'm pretty sure you can think of stronger business cases against Amazon/US-Milspec involvement in a non-American business. Amazon, in the hands of Americas spooks, can do a lot of damage to the world of non-Americans; i.e. anyone the spooks decide to hate/target for usurpation. You think Germany is inured from such attention?

koheripbal 6y ago
I think your being overly paranoid. The effort required to covertly break into an AWS instance and not have anyone in the sysadmin teams know is simply not worth it for 99.9% of businesses. I run a simply mid-level business. Amazon doesn't give a crap about my data - that, above all, is what keeps it safe. I'm just not important enough to bother.
- newen 6y ago
  The whole point about mass data surveillance is that your data is not important enough to bother, until it is.
  - koheripbal 6y ago
    ...unless it never is. ...which is usually the case.
- fit2rule 6y ago
  >I run a simply mid-level business. Well, you should understand this a little better, then. Okay try this scenario: lets say I work for a German company that is kicking ass in a market that a spook-at-Amazon has heavily invested in - lets just say "personal transportation system X". Because its Germany, the tech is amazing and consequently I'm going to sell this tech to Africa, because I like doing that, and not in America - because fuck America, that's why. Also, maybe China, maybe Kazakhstan. My tech, my choice. Should I succeed in this endeavour, I'm immediately under threat of being NSA'ed by the provider of service I'd rely on, ordinarily, to render my research. This isn't paranoia, it is due diligence. Yeah, no thanks, Amazon. This heralds a watershed moment: a return to local services. Just better to avoid the American spook-o'-sphere entirely, and play a local hand. Maybe even take the data centre guys out for grünkohl and senf some time, whatever. Look - to understand why the hate for all the spook/control paranoia, Americans/Brits/5-eyes/et al., all you have to do is try to see it from the other side of the national identity for a second. Germans are very, very rightly on the side of data protection. The holes in the ground that used to be Gestapo buildings are not all parking lots! Some of them are memorials. Also not paranoia: diligence. (^WThis comment brought to you by the ACME-HNnnn-comment-slowdown-negotiator-system™ .. time wasted, is creativity! Disclaimer: Not German, am applying hypotheticals. Still not paranoia!)

wlesieutre 6y ago

> What are the realistic odds that someone internally at Amazon is going to break into your instances to look at your data if you're just a regular business? I mean, there's this: https://www.wsj.com/articles/amazon-scooped-up-data-from-its-own-sellers-to-launch-competing-products-11587650015 https://www.wsj.com/articles/amazon-scooped-up-data-from-its... > The online retailing giant has long asserted, including to Congress, that when it makes and sells its own products, it doesn’t use information it collects from the site’s individual third-party sellers—data those sellers view as proprietary. > Yet interviews with more than 20 former employees of Amazon’s private-label business and documents reviewed by The Wall Street Journal reveal that employees did just that. Such information can help Amazon decide how to price an item, which features to copy or whether to enter a product segment based on its earning potential, according to people familiar with the practice, including a current employee and some former employees who participated in it. If you're a regular business and Amazon doesn't want to launch a new hosted product competing with you, then maybe you're safe. But if they want your data, why not just take it while repeatedly insisting that they don't?

koheripbal 6y ago
That is an apples to oranges comparison. It is wildly different to scoop up data from your own Amazon.com platform vs BREAKING IN to a private AWS instance. They aren't even the same divisions in Amazon Inc, so it would be extremely obvious to everyone, very inappropriate, and most likely get leaked that it was happening.
- LargoLasskhyfv 6y ago
  Fruit is fruit, both can and do rot :)

nova22033 6y ago

What are the realistic odds that someone internally at Amazon is going to break into your instances to look at your data if you're just a regular business? Going to go out on a limb and say that the NSA is going to have an easier time breaking into your on-prem servers. Hiring a retired General for influence is as old as this town. People are reading too much into this. This doesn't make it more or less likely for Amazon/NSA/CIA/whatever to steal your data.