3 ms·

interesting idea. so running a VM is fine, but if you protect your users by sometimes checking for certain usage patterns (that they said they didn't want), yo

interesting idea. so running a VM is fine, but if you protect your users by sometimes checking for certain usage patterns (that they said they didn't want), you become liable for a lot more? I thought though that they did do some pretty deep stuff, like silently update for heartbleed - http://distinctplace.com/2014/04/16/openssl-heartbleed-ec2-autofix---be-aware/ http://distinctplace.com/2014/04/16/openssl-heartbleed-ec2-a... did I misread?

dalke 12y ago
Well, yes, you can become liable for failure to do what you said you would do. That's what secondary liability means. If you check for certain usage patterns, but there's a 10% chance of failure, then will 10% of that customer base sue you for not doing the job you said you will do? Remember, you've started with the premise that there is a clear signal. Certainly it's possible to tweak any SHA calculation enough to confuse detection algorithms. What advantage is there for Amazon to put the infrastructure in place, as compared to the current (seemingly generous) practice of revoking fees for abused accounts?
- logicallee 12y ago
  obviously, the benefit is that they are not then out all that computing power! (for which they refund fees at a 100% loss.) I would think their gross profit isn't all that high - certainly not nearly 100% where they can do these refunds without a second thought or loss to them. it's like asking, if a store refunds things stolen from you, what is their incentive to reduce this theft? well, obviously, the fact that after these refunds they are out these goods. . . The only time they don't care is with 100% profit margin. regarding your first point... they don't have to promise they will check for bitcoin mining by having a fraud prevention check in place. the fact that I cheerfully allow my bank to hold some transactions that look questionable to them while they verify with me, doesn't mean I will extend liability to them if they fail to hold a transaction or find it questionable. it's more a matter that they might refund me if I did not actually make a transaction (as with Amazon) so they want to cover themselves in some instances from this happening in the first place. more power to them.
  - dalke 12y ago
    Have you tried to estimate their profit or gross margin? I think it's wrong to analyze this as stolen goods. It's an opportunity cost. Unless they are fully utilized, the cost is power, cooling, and depreciation on the hardware. Not the market price of what that CPU time would have been sold for. Based on http://www.geekwire.com/2014/heres-startup-dumped-amazon-web-services/ http://www.geekwire.com/2014/heres-startup-dumped-amazon-web... the internal cost might be 50% or even less than market price. You have a habit of positing that because you wouldn't do something means that others wouldn't as well. You can sue a bank for acting in bad faith, which "does not necessarily involve furtive or evil motives, but has a commercial sense of disregard of and refusal to learn the facts when available; and that the circumstances and conditions may be so cogent and obvious that to remain passive amounts to bad faith" - http://caselaw.findlaw.com/ky-court-of-appeals/1496975.html#sthash.HPOfqUcd.dpuf http://caselaw.findlaw.com/ky-court-of-appeals/1496975.html#... . Bear in mind that it's very difficult to extrapolate from a regulated bank to an unregulated company. there are also a lot of banking laws put into place define exactly what bad faith means. For example, it used to be that you were liable for stolen credit card misuse until the time it was reported. The law changed to limit your liability, which placed more emphasis on the bank to do fraud detection. The parallel here is obvious; if as a matter of principle they decided to assume 100% liability, then this gives them inventive to improve fraud detection, which can be done through things like usage analysis. While assuming no liability gives them less inventive to go after fraud. If Amazon wants happy customers, then great service helps - no principle needed. (In addition, the US government requires additional reporting and oversight of your bank account. For example, the bank can be in trouble if they decline to notice a pattern of structuring your transactions to be under the $10,000 reporting limit to the government.)

dalke 12y ago

Well, yes, you can become liable for failure to do what you said you would do. That's what secondary liability means. If you check for certain usage patterns, but there's a 10% chance of failure, then will 10% of that customer base sue you for not doing the job you said you will do? Remember, you've started with the premise that there is a clear signal. Certainly it's possible to tweak any SHA calculation enough to confuse detection algorithms. What advantage is there for Amazon to put the infrastructure in place, as compared to the current (seemingly generous) practice of revoking fees for abused accounts?

logicallee 12y ago
obviously, the benefit is that they are not then out all that computing power! (for which they refund fees at a 100% loss.) I would think their gross profit isn't all that high - certainly not nearly 100% where they can do these refunds without a second thought or loss to them. it's like asking, if a store refunds things stolen from you, what is their incentive to reduce this theft? well, obviously, the fact that after these refunds they are out these goods. . . The only time they don't care is with 100% profit margin. regarding your first point... they don't have to promise they will check for bitcoin mining by having a fraud prevention check in place. the fact that I cheerfully allow my bank to hold some transactions that look questionable to them while they verify with me, doesn't mean I will extend liability to them if they fail to hold a transaction or find it questionable. it's more a matter that they might refund me if I did not actually make a transaction (as with Amazon) so they want to cover themselves in some instances from this happening in the first place. more power to them.
- dalke 12y ago
  Have you tried to estimate their profit or gross margin? I think it's wrong to analyze this as stolen goods. It's an opportunity cost. Unless they are fully utilized, the cost is power, cooling, and depreciation on the hardware. Not the market price of what that CPU time would have been sold for. Based on http://www.geekwire.com/2014/heres-startup-dumped-amazon-web-services/ http://www.geekwire.com/2014/heres-startup-dumped-amazon-web... the internal cost might be 50% or even less than market price. You have a habit of positing that because you wouldn't do something means that others wouldn't as well. You can sue a bank for acting in bad faith, which "does not necessarily involve furtive or evil motives, but has a commercial sense of disregard of and refusal to learn the facts when available; and that the circumstances and conditions may be so cogent and obvious that to remain passive amounts to bad faith" - http://caselaw.findlaw.com/ky-court-of-appeals/1496975.html#sthash.HPOfqUcd.dpuf http://caselaw.findlaw.com/ky-court-of-appeals/1496975.html#... . Bear in mind that it's very difficult to extrapolate from a regulated bank to an unregulated company. there are also a lot of banking laws put into place define exactly what bad faith means. For example, it used to be that you were liable for stolen credit card misuse until the time it was reported. The law changed to limit your liability, which placed more emphasis on the bank to do fraud detection. The parallel here is obvious; if as a matter of principle they decided to assume 100% liability, then this gives them inventive to improve fraud detection, which can be done through things like usage analysis. While assuming no liability gives them less inventive to go after fraud. If Amazon wants happy customers, then great service helps - no principle needed. (In addition, the US government requires additional reporting and oversight of your bank account. For example, the bank can be in trouble if they decline to notice a pattern of structuring your transactions to be under the $10,000 reporting limit to the government.)