4 ms·

OTOH: 1. big clouds are very lucrative targets for spooks, your data seem pretty likely to be hoovered up as "bycatch" (or maybe main catch depending on your

OTOH: 1. big clouds are very lucrative targets for spooks, your data seem pretty likely to be hoovered up as "bycatch" (or maybe main catch depending on your luck) by various agencies and then traded around as currency 2. you never hear about security probems (incidents or exposure) in the platforms, there's no transparency 3. better than most coporate stuff is a low bar

sfilmeyer 2y ago
>3. better than most corporate stuff is a low bar I think it's a very relevant bar, though. The top level commenter made points about "a business of just about any size", which seems pretty exactly aligned with "most corporate stuff".
likeabatterycar 2y ago
> you never hear about security probems (incidents or exposure) in the platforms Except that one time... https://www.seattlemet.com/news-and-city-life/2023/04/how-a-former-amazon-web-services-employee-hacked-capital-one-paige-thompson-seattle https://www.seattlemet.com/news-and-city-life/2023/04/how-a-...
- noprocrasted 2y ago
  If I remember right, the attacker’s AWS employment is irrelevant - no privileged AWS access was used in that case. The attacker working for AWS was a pure coincidence, it could’ve been anyone.
  - deleted 2y ago
    [deleted]
stefan_ 2y ago
4. we keep hitting hypervisor bugs and having to work around the fact that your software coexists on the same machine with 3rdparty untrusted software who might in fact be actively trying to attack you. All this silliness with encrypted memory buses and the various debilitating workarounds for silicon bugs. So yes, the cloud is very secure, except for the very thing that makes it the cloud that is not secure at all and has just been papered over because questioning it means the business model is bust.
- UltraSane 2y ago
  What hypervisor bugs are you referring to? AWS does offer bare metal servers.
mardifoufs 2y ago
Most corporations (which is the vast majority of cloud users) absolutely don't care about spooks, sadly enough. If that's the threat model, then it's a very very rare case to care about it. Most datacenters/corporations won't even fight or care about sharing data with local spooks/cops/three letter agencies. The actual threat is data leaks, security breaches, etc.
nine_k 2y ago
If you don't want your data to be accessible to "various agencies", don't share it with corporations, full stop. Corporations are obliged by law to make it available to the agencies, and the agencies often overreach, while the corporations almost never mind the overreach. There are limitations for stuff like health or financial data, but these are not impenetrable barriers. I would just consider all your hosted data to be easily available to any security-related state agency; consider them already having a copy.
- immibis 2y ago
  That depends where it's hosted and how it's encrypted. Cloud hosts can just reach into your RAM, but dedicated server hosts would need to provision that before deploying the server, and colocation providers would need to take your server offline to install it.
  - nine_k 2y ago
    Colocated / Dedicated is not Cloud, AFAICT. It's the "traditional hosting", not elastic / auto-scalable. You of course may put your own, highly tamper-proof boxes in a colocation rack, and be reasonably certain that any attempt to exfiltrate data from them won't be invisible to you. By doing so, you share nothing with your hosting provider, you only rent rack space / power / connectivity.
    - doublerabbit 2y ago
      And this is why I colocate, because all the data that hits my server is my data. Sure I do have an AUP/T&C but without proper warrant no one is allowed to touch my server. Case is monitored if it's opened. Encrypted on start-up, USB disabled. I just wished I had my own /24.
      - immibis 2y ago
        At least you can get your own /48, at least if you're under RIPE. You should only do it if you expect to multihome though, or you're doing some experimentation that absolutely needs a PI address. Please don't pollute the default-free zone just for no reason.

sfilmeyer 2y ago

>3. better than most corporate stuff is a low bar I think it's a very relevant bar, though. The top level commenter made points about "a business of just about any size", which seems pretty exactly aligned with "most corporate stuff".

likeabatterycar 2y ago

> you never hear about security probems (incidents or exposure) in the platforms Except that one time... https://www.seattlemet.com/news-and-city-life/2023/04/how-a-former-amazon-web-services-employee-hacked-capital-one-paige-thompson-seattle https://www.seattlemet.com/news-and-city-life/2023/04/how-a-...

noprocrasted 2y ago
If I remember right, the attacker’s AWS employment is irrelevant - no privileged AWS access was used in that case. The attacker working for AWS was a pure coincidence, it could’ve been anyone.
- deleted 2y ago
  [deleted]

stefan_ 2y ago

4. we keep hitting hypervisor bugs and having to work around the fact that your software coexists on the same machine with 3rdparty untrusted software who might in fact be actively trying to attack you. All this silliness with encrypted memory buses and the various debilitating workarounds for silicon bugs. So yes, the cloud is very secure, except for the very thing that makes it the cloud that is not secure at all and has just been papered over because questioning it means the business model is bust.

UltraSane 2y ago
What hypervisor bugs are you referring to? AWS does offer bare metal servers.

mardifoufs 2y ago

Most corporations (which is the vast majority of cloud users) absolutely don't care about spooks, sadly enough. If that's the threat model, then it's a very very rare case to care about it. Most datacenters/corporations won't even fight or care about sharing data with local spooks/cops/three letter agencies. The actual threat is data leaks, security breaches, etc.

nine_k 2y ago

If you don't want your data to be accessible to "various agencies", don't share it with corporations, full stop. Corporations are obliged by law to make it available to the agencies, and the agencies often overreach, while the corporations almost never mind the overreach. There are limitations for stuff like health or financial data, but these are not impenetrable barriers. I would just consider all your hosted data to be easily available to any security-related state agency; consider them already having a copy.

immibis 2y ago
That depends where it's hosted and how it's encrypted. Cloud hosts can just reach into your RAM, but dedicated server hosts would need to provision that before deploying the server, and colocation providers would need to take your server offline to install it.
- nine_k 2y ago
  Colocated / Dedicated is not Cloud, AFAICT. It's the "traditional hosting", not elastic / auto-scalable. You of course may put your own, highly tamper-proof boxes in a colocation rack, and be reasonably certain that any attempt to exfiltrate data from them won't be invisible to you. By doing so, you share nothing with your hosting provider, you only rent rack space / power / connectivity.
  - doublerabbit 2y ago
    And this is why I colocate, because all the data that hits my server is my data. Sure I do have an AUP/T&C but without proper warrant no one is allowed to touch my server. Case is monitored if it's opened. Encrypted on start-up, USB disabled. I just wished I had my own /24.
    - immibis 2y ago
      At least you can get your own /48, at least if you're under RIPE. You should only do it if you expect to multihome though, or you're doing some experimentation that absolutely needs a PI address. Please don't pollute the default-free zone just for no reason.