6 ms·

It feels like this is more a result of Amazon not being able to connect you with the right escalation path to verify & act on these claims than a considered dec

It feels like this is more a result of Amazon not being able to connect you with the right escalation path to verify & act on these claims than a considered decision to ignore them. Does anyone here know what an individual reporter should do? Is there an escalation ramp that exists but was so poorly marked that neither sloshnmosh nor Amazon support was able to find it? Does the ramp go through other organizations (e.g. report to CERT or some other org first and come back with a case ID)? Does the ramp not exist and need to be built?

LoveLeadAcid 5y ago
Nah, Amazon has a cozy relationship with intelligence agencies (CIA, for instance, uses Amazon for cloud services) and they probably don’t want to step on any dangerous toes or lose money and business.
bbarnett 5y ago
It feels like this is more a result of Amazon not being able to connect you with the right escalation path to verify & act on these claims than a considered decision to ignore them. Those two things are actually the same thing, both are wilfully ignoring situations like this.
- seanmcdirmid 5y ago
  Never assume malice where ignorance and incompetence would suffice instead. Those two things are actually not the same thing at all, depending on how you define “willful.”
  - csharptwdec19 5y ago
    It's malice but from a different aspect; willful malice in the name of 'cost cutting'.
    - deleted 5y ago
      [deleted]
    - xyzzy123 5y ago
      How many FTEs should they have dedicated to triaging security complaints from (relatively speaking) randos on the Internet about their customers? Also, would you take that job? Some poor support person probably got this and punted because they couldn't pattern match to something in their handbook. For every thoughtful, detailed security report there are about 500 others that involve voices from appliances, self-xss, csrf on logout and 5G coronavirus. It is extremely difficult for L1 support to make sense of these. Having a support contract or attracting attention on the forums are decent ways to pop out from the background noise.
      - blacksmith_tb 5y ago
        Not to worry, they'll replace their overworked human staff with sentiment analysis bots which will do an equally uneven job of sorting the wheat from the chaff, with even less hope of appeal.
    - Nasrudith 5y ago
      Malice is the wrong term for it even if we accept the premise. (I do not but that is another can of worms.) Malice implies a desire to hurt people. It would be utilitarian callousness if anything, negligence if there were legal obligations shirked. There is no law against just poor customer service like being a jerk isn't illegal.
  - toss1 5y ago
    Yes, that is a good summary of Hanlon's Razor, a sort of corollary to Occam's Razor about mot creating unnecessary entities in your conceptual models. Hanlon's Razor is a good first approximation or initial approach to a situation, not the end of the discussion. There are many situations where incompetence may appear to be an explanation, but is in fact not the root cause, and may even be being actively used as a cover for malicious actions. The point of the razor is that it is up to us to sort out the difference, not to just jump to a conclusion that it is malice, or that it is incompetence. In this case, Amazon has had plenty of time, resources, and skilled people to see the need and implement an escalation & resolution pathway. That they have so persistently failed to do so for so long indicates a cause beyond mere incompetence. Even if they are not being as actively malicious as the malware distributors, they clearly and actively DGAF.
    - seanmcdirmid 5y ago
      > That they have so persistently failed to do so for so long indicates a cause beyond mere incompetence. So you are claiming that they have had so many opportunities to do the right thing, that they aren't merely incompetent, but are in bed with the evil doers? That would be a huge claim, to say the least.
      - toss1 5y ago
        There are many options between incompetence and being actually 'in bed with', which I read to mean 'knowingly cooperating with', the criminals. The first example is that it's simply more profitable for them to turn a blind eye unless one of the relationships becomes a public problem. They wouldn't be actively aiding and abetting the crime, but neither are they stepping up to ensure that it isn't happening on their systems. It's being complicit several steps beyond incompetence, but not the same level as active cooperation. And, considering that Amazon has no shortage whatsoever of funds and skilled people to prioritize anything they want to prioritize, I'd say more than sufficient time has passed that they're at least at something resembling this sort of willfully ignorant stage.
  - atatatat 5y ago
    Never assume ignorance where a scumbag can take new default level of societal ignorance and hide behind it....
  - Forbo 5y ago
    Never assume ignorance where greed would suffice.
  - wolverine876 5y ago
    Amazon could do it if they wished; they don't want to.
  - twirlock 5y ago
    How about never assume ignorance when you're dealing with a giant corporation's systemic problem that the giant corporation benefits from ignoring.
- duxup 5y ago
  They can be very different things. Poor communication channels happen even when folks don't want it to. Humans are bad at doing such things.
londons_explore 5y ago
Doesn't cloudfront generally act like cloudflare? Ie. We don't inspect your content. Law enforcement are the only people who can stop us hosting a site.
- jorvi 5y ago
  Cloudflare has taken voluntary action on sites 2 (or 3?) times now. They can no longer claim complete neutrality. I don't know about Cloudfront.
  - 0xbadcafebee 5y ago
    It has nothing to do with "neutrality", they have Terms of Service like every single service provider in the world. If you violate them, there goes your infra. Spreading malware is almost certainly a violation of AWS' ToS (Amazon engs, correct me if needed)
    - meowface 5y ago
      It's a little more complicated than that in Cloudflare's case. The debate isn't really relevant to AWS/CloudFront or anyone else, but Cloudflare has famously had a policy of not kicking off any customers as long as they abide by US law. The CEO publicly identifies as a free speech absolutist. (Malware/phishing/etc. is still removed, since it's illegal.) The CEO publicly broke their policy on this on two occasions: the neo-Nazi website The Daily Stormer, and 8chan. In each case, only after a long saga played out. For The Daily Stormer: after they mocked the deceased victim of the Charlottesville rally, Cloudflare received public pressure to boot them but refused, and then the owner subsequently tried to troll them/the public by claiming Cloudflare executives secretly supported their ideology, causing them to finally be removed. (https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/ ) For 8chan: Cloudflare received a lot of heat for not removing them after the first and second incidents of posters becoming mass shooters, eventually removing them after the third mass shooting. (https://blog.cloudflare.com/terminating-service-for-8chan/ https://blog.cloudflare.com/terminating-service-for-8chan/) I forget the term/aphorism for this (like "double-bind", sort of), but they put themselves in an awkward position because they're probably one of the most neutral service providers out there - still far more than probably anyone else to this day - but by marketing themselves as 100% neutral, being only 99.99999% neutral created lots of lasting negative PR that people still regularly bring up. Any other company would've kicked those people off way sooner and there would've been little to no publicity, because they routinely do such things, but now Cloudflare is hated by both the pro-censorship and the anti-censorship crowd. (See: https://en.wikipedia.org/wiki/Cloudflare#Mass_Shootings https://en.wikipedia.org/wiki/Cloudflare#Mass_Shootings and everything below. It's quite a rollercoaster.)
adreamingsoul 5y ago
The AWS forums are going to be the best way to start a discussion with people who can escalate.
berto4 5y ago
always a narrative/explanation...right on
- jjoonathan 5y ago
  If there is no escalation path, that's a big problem, and nobody here is pretending otherwise.
- Kiro 5y ago
  It's always the other way around. A company can never do anything right. HN will always find an ulterior motive.

LoveLeadAcid 5y ago

Nah, Amazon has a cozy relationship with intelligence agencies (CIA, for instance, uses Amazon for cloud services) and they probably don’t want to step on any dangerous toes or lose money and business.

bbarnett 5y ago

It feels like this is more a result of Amazon not being able to connect you with the right escalation path to verify & act on these claims than a considered decision to ignore them. Those two things are actually the same thing, both are wilfully ignoring situations like this.

seanmcdirmid 5y ago
Never assume malice where ignorance and incompetence would suffice instead. Those two things are actually not the same thing at all, depending on how you define “willful.”
- csharptwdec19 5y ago
  It's malice but from a different aspect; willful malice in the name of 'cost cutting'.
  - deleted 5y ago
    [deleted]
  - xyzzy123 5y ago
    How many FTEs should they have dedicated to triaging security complaints from (relatively speaking) randos on the Internet about their customers? Also, would you take that job? Some poor support person probably got this and punted because they couldn't pattern match to something in their handbook. For every thoughtful, detailed security report there are about 500 others that involve voices from appliances, self-xss, csrf on logout and 5G coronavirus. It is extremely difficult for L1 support to make sense of these. Having a support contract or attracting attention on the forums are decent ways to pop out from the background noise.
    - blacksmith_tb 5y ago
      Not to worry, they'll replace their overworked human staff with sentiment analysis bots which will do an equally uneven job of sorting the wheat from the chaff, with even less hope of appeal.
  - Nasrudith 5y ago
    Malice is the wrong term for it even if we accept the premise. (I do not but that is another can of worms.) Malice implies a desire to hurt people. It would be utilitarian callousness if anything, negligence if there were legal obligations shirked. There is no law against just poor customer service like being a jerk isn't illegal.
- toss1 5y ago
  Yes, that is a good summary of Hanlon's Razor, a sort of corollary to Occam's Razor about mot creating unnecessary entities in your conceptual models. Hanlon's Razor is a good first approximation or initial approach to a situation, not the end of the discussion. There are many situations where incompetence may appear to be an explanation, but is in fact not the root cause, and may even be being actively used as a cover for malicious actions. The point of the razor is that it is up to us to sort out the difference, not to just jump to a conclusion that it is malice, or that it is incompetence. In this case, Amazon has had plenty of time, resources, and skilled people to see the need and implement an escalation & resolution pathway. That they have so persistently failed to do so for so long indicates a cause beyond mere incompetence. Even if they are not being as actively malicious as the malware distributors, they clearly and actively DGAF.
  - seanmcdirmid 5y ago
    > That they have so persistently failed to do so for so long indicates a cause beyond mere incompetence. So you are claiming that they have had so many opportunities to do the right thing, that they aren't merely incompetent, but are in bed with the evil doers? That would be a huge claim, to say the least.
    - toss1 5y ago
      There are many options between incompetence and being actually 'in bed with', which I read to mean 'knowingly cooperating with', the criminals. The first example is that it's simply more profitable for them to turn a blind eye unless one of the relationships becomes a public problem. They wouldn't be actively aiding and abetting the crime, but neither are they stepping up to ensure that it isn't happening on their systems. It's being complicit several steps beyond incompetence, but not the same level as active cooperation. And, considering that Amazon has no shortage whatsoever of funds and skilled people to prioritize anything they want to prioritize, I'd say more than sufficient time has passed that they're at least at something resembling this sort of willfully ignorant stage.
- atatatat 5y ago
  Never assume ignorance where a scumbag can take new default level of societal ignorance and hide behind it....
- Forbo 5y ago
  Never assume ignorance where greed would suffice.
- wolverine876 5y ago
  Amazon could do it if they wished; they don't want to.
- twirlock 5y ago
  How about never assume ignorance when you're dealing with a giant corporation's systemic problem that the giant corporation benefits from ignoring.
duxup 5y ago
They can be very different things. Poor communication channels happen even when folks don't want it to. Humans are bad at doing such things.

londons_explore 5y ago

Doesn't cloudfront generally act like cloudflare? Ie. We don't inspect your content. Law enforcement are the only people who can stop us hosting a site.

jorvi 5y ago
Cloudflare has taken voluntary action on sites 2 (or 3?) times now. They can no longer claim complete neutrality. I don't know about Cloudfront.
- 0xbadcafebee 5y ago
  It has nothing to do with "neutrality", they have Terms of Service like every single service provider in the world. If you violate them, there goes your infra. Spreading malware is almost certainly a violation of AWS' ToS (Amazon engs, correct me if needed)
  - meowface 5y ago
    It's a little more complicated than that in Cloudflare's case. The debate isn't really relevant to AWS/CloudFront or anyone else, but Cloudflare has famously had a policy of not kicking off any customers as long as they abide by US law. The CEO publicly identifies as a free speech absolutist. (Malware/phishing/etc. is still removed, since it's illegal.) The CEO publicly broke their policy on this on two occasions: the neo-Nazi website The Daily Stormer, and 8chan. In each case, only after a long saga played out. For The Daily Stormer: after they mocked the deceased victim of the Charlottesville rally, Cloudflare received public pressure to boot them but refused, and then the owner subsequently tried to troll them/the public by claiming Cloudflare executives secretly supported their ideology, causing them to finally be removed. (https://blog.cloudflare.com/why-we-terminated-daily-stormer/ https://blog.cloudflare.com/why-we-terminated-daily-stormer/ ) For 8chan: Cloudflare received a lot of heat for not removing them after the first and second incidents of posters becoming mass shooters, eventually removing them after the third mass shooting. (https://blog.cloudflare.com/terminating-service-for-8chan/ https://blog.cloudflare.com/terminating-service-for-8chan/) I forget the term/aphorism for this (like "double-bind", sort of), but they put themselves in an awkward position because they're probably one of the most neutral service providers out there - still far more than probably anyone else to this day - but by marketing themselves as 100% neutral, being only 99.99999% neutral created lots of lasting negative PR that people still regularly bring up. Any other company would've kicked those people off way sooner and there would've been little to no publicity, because they routinely do such things, but now Cloudflare is hated by both the pro-censorship and the anti-censorship crowd. (See: https://en.wikipedia.org/wiki/Cloudflare#Mass_Shootings https://en.wikipedia.org/wiki/Cloudflare#Mass_Shootings and everything below. It's quite a rollercoaster.)

adreamingsoul 5y ago

The AWS forums are going to be the best way to start a discussion with people who can escalate.

berto4 5y ago

always a narrative/explanation...right on

jjoonathan 5y ago
If there is no escalation path, that's a big problem, and nobody here is pretending otherwise.
Kiro 5y ago
It's always the other way around. A company can never do anything right. HN will always find an ulterior motive.