4 ms·

So many sources yet no source of the actually outrageous claim that Google will use this to illegally siphon customer data maybe this deal is about a company w

by breppp 2y ago

So many sources yet no source of the actually outrageous claim that Google will use this to illegally siphon customer data maybe this deal is about a company with a lot of revenue in an area google is heavily investing in: cloud security?

diggan 2y ago
> actually outrageous claim that Google will use this to illegally siphon customer data Hypothetical question as much as anything: If Google purchases a company and the data the company stores about their customers, is it illegal for them to use this data for whatever they want? Lets say it would give them an understanding of what features from AWS people tend to use the most, and they use that to improve Google Cloud, would that be illegal?
- breppp 2y ago
  yes, due to privacy and contract obligations as well as this is the surest way for GCP to spectacularly commit suicide
  - diggan 2y ago
    Unless you're talking about some specific Wiz<>customer contracts, how do you know? AFAIK, there are no explicit laws forbidding that. Maybe you could share what law you think this would be breaking?
    - breppp 2y ago
      OP mentioned training AI on customer data GDPR, CCPA, HIPAA, etc, as Google has no way of knowing which data they will train on, add to that copyright and that's just off the top of my head cloud contract obligations are also pretty clear about customer data. furthermore it would be bad engineering and security if Wiz had actual direct access to customer data, versus having their code having access to said data. That would be a huge issue in due diligence for example
      - diggan 2y ago
        Did you skim through Wiz's Privacy Policy? They're keeping a lot of stuff that isn't "direct access to customer data" and already permitted to be sent to 3rd parties, wouldn't surprise me if you could aggregate what features are most used on AWS by collating some other sources than having actual access to customers cloud. Obviously, existing agreements would need to continue to be run properly, no question about that. But there is always plenty of other data that probably could be used by Google to gain some insights.
        breppp 2y ago
        what you talked about is different and is aggregated metrics that might be legal and interesting but i highly doubt it's 30+ billion dollar interesting i imagine you can buy that data from data brokers without any legal exposure but that's only a guess
      - zifpanachr23 2y ago
        I've been consistently surprised at how common bad engineering and security practices seem to be within the security vendor space though. So idk this just makes it sound more plausible to me cause this would be exactly the type of company to have a scandal like that.
      - majestik 2y ago
        Read through the Wiz MSA [0] at section 6 which discusses “Customer Data” and among other things specifically asks Customer not to send HIPAA data (perhaps to sidestep the issue you just raised) and concludes with this: — Customer hereby grants to Wiz a non-exclusive, worldwide, royalty-free right to use Customer Data to provide the Services and perform its obligations under this Agreement. — Or if reading terse legal documents isn’t your thing, go ahead and just read through Wiz’s own blog post about how their scanner works, which confirms they have full, direct access to customer EBS volume snapshots in the default “full SaaS” deployment model. [1] Your point that due diligence would have taken issue with this might not be grounded in Google’s reality. 0: https://wiz.pactsafe.io/legal#wiz-subscription-agreement https://wiz.pactsafe.io/legal#wiz-subscription-agreement 1: https://www.wiz.io/blog/the-wiz-approach-to-agentless-scanning https://www.wiz.io/blog/the-wiz-approach-to-agentless-scanni...
deleted 2y ago
[deleted]
billjings 2y ago
Facebook did exactly this with a VPN acquisition. They didn't break into customer data; they just mined it for usage patterns. So as a pure speculation on Goog's motives, it doesn't sound farfetched enough to call ridiculous. Competitive data is valuable, particularly if you want to strangle the youth in their cradles (or acquire them).
- breppp 2y ago
  google is not facebook, and an ad-supported consumer software is not cloud. OP talked about AI training which is a bit more than metadata also, the vpn example ended in court

by breppp 2y ago

diggan 2y ago

> actually outrageous claim that Google will use this to illegally siphon customer data Hypothetical question as much as anything: If Google purchases a company and the data the company stores about their customers, is it illegal for them to use this data for whatever they want? Lets say it would give them an understanding of what features from AWS people tend to use the most, and they use that to improve Google Cloud, would that be illegal?

breppp 2y ago
yes, due to privacy and contract obligations as well as this is the surest way for GCP to spectacularly commit suicide
- diggan 2y ago
  Unless you're talking about some specific Wiz<>customer contracts, how do you know? AFAIK, there are no explicit laws forbidding that. Maybe you could share what law you think this would be breaking?
  - breppp 2y ago
    OP mentioned training AI on customer data GDPR, CCPA, HIPAA, etc, as Google has no way of knowing which data they will train on, add to that copyright and that's just off the top of my head cloud contract obligations are also pretty clear about customer data. furthermore it would be bad engineering and security if Wiz had actual direct access to customer data, versus having their code having access to said data. That would be a huge issue in due diligence for example
    - diggan 2y ago
      Did you skim through Wiz's Privacy Policy? They're keeping a lot of stuff that isn't "direct access to customer data" and already permitted to be sent to 3rd parties, wouldn't surprise me if you could aggregate what features are most used on AWS by collating some other sources than having actual access to customers cloud. Obviously, existing agreements would need to continue to be run properly, no question about that. But there is always plenty of other data that probably could be used by Google to gain some insights.
      - breppp 2y ago
        what you talked about is different and is aggregated metrics that might be legal and interesting but i highly doubt it's 30+ billion dollar interesting i imagine you can buy that data from data brokers without any legal exposure but that's only a guess
    - zifpanachr23 2y ago
      I've been consistently surprised at how common bad engineering and security practices seem to be within the security vendor space though. So idk this just makes it sound more plausible to me cause this would be exactly the type of company to have a scandal like that.
    - majestik 2y ago
      Read through the Wiz MSA [0] at section 6 which discusses “Customer Data” and among other things specifically asks Customer not to send HIPAA data (perhaps to sidestep the issue you just raised) and concludes with this: — Customer hereby grants to Wiz a non-exclusive, worldwide, royalty-free right to use Customer Data to provide the Services and perform its obligations under this Agreement. — Or if reading terse legal documents isn’t your thing, go ahead and just read through Wiz’s own blog post about how their scanner works, which confirms they have full, direct access to customer EBS volume snapshots in the default “full SaaS” deployment model. [1] Your point that due diligence would have taken issue with this might not be grounded in Google’s reality. 0: https://wiz.pactsafe.io/legal#wiz-subscription-agreement https://wiz.pactsafe.io/legal#wiz-subscription-agreement 1: https://www.wiz.io/blog/the-wiz-approach-to-agentless-scanning https://www.wiz.io/blog/the-wiz-approach-to-agentless-scanni...

deleted 2y ago

[deleted]

billjings 2y ago

Facebook did exactly this with a VPN acquisition. They didn't break into customer data; they just mined it for usage patterns. So as a pure speculation on Goog's motives, it doesn't sound farfetched enough to call ridiculous. Competitive data is valuable, particularly if you want to strangle the youth in their cradles (or acquire them).

breppp 2y ago
google is not facebook, and an ad-supported consumer software is not cloud. OP talked about AI training which is a bit more than metadata also, the vpn example ended in court