Hacker News Reader

Comment by Freak_NL | Hacker News Reader

If you are handling data that is subject to national regulations concerning personal data (e.g., health care) using a cloud provider for all your needs is risky and might not be legal. If you use one of the big-name (and therefore affordable) providers such as Amazon, your data may very well fall under America's Patriot Act — there is a lot of legal uncertainty about this. If I go with a local party instead, there is also no guarantee that this company in turn won't branch out to the US, or get bought up by an American company, again putting citizen's private data in reach of (in my case) foreign governments.

View on HN

Yes. We were building a website for a bank and wanted to put some services in the cloud (after all, the online banking system was completely separate). The security team of the bank was originally very opposed to the idea.

It's been a while so I don't remember the specifics, but we did eventually have some but not all parts in the cloud.

Erm, no. All major cloud providers have clear statements regarding data sovereignty, compliance and whatnot. There is no uncertainty, only lack of awareness (but I'll freely grant that it is not a simple matter).

Look for the equivalent of https://www.microsoft.com/en-us/TrustCenter/Transparency#Tra...

(Full disclosure: I work at Microsoft)

Sorry but, I am afraid that this train has already left the station.

So just because mickeysoft and other 'major' clouds providers as you say, have some certificates and a webpage where it says to play nice it's all good? Wow...

Do you honesty believe that?

Maybe I'm too cynical these days, but I find it pretty laughable that a statement regarding 'data sovereignty' has any real meaning at all these days.

Unless you control the hardware, you have no idea what the hypervisors are doing on your rented vm's. The idea that national actors don't / wouldn't pull anything they want from them seems comically naive to me. Christ, we can barely trust our own hardware anymore with backdoored firmware crap, IME and such..

Realistically though, most companies don't care so it's not a problem if you keep the blinkers on; their compliance folks just want the document which says it's not happening and they'll never know when it does so who cares. Their ops folks can barely use the APIs probably, let alone contemplate the impact of someone reading the memory of my databases from the hypervisors.

As an individual and someone who cares for my data or that of my clients though, that's not enough for me, and I'd never trust tnese folks with any data, only mindless compute and serving public content...

Don't you share this data over networks from time to time? Is all your data siloed and bolted down to one place never to move anywhere? How do you trust the data to not take a hike in some random direction you don't fully trust?

By encrypting anything you transmit over the Internet?

and anything you have on hardware you don't own. And on hardware you own.

Well, depends on the data.

Most things are CRUD;

Current gig is a load of on-prem DBs' -- AWS boxes might hit an API in one of the datacentres which can query it for a given user, I think there's a difference between using AWS to serve HTTPS vs Hosting the whole db there (this is marketing/tracking data)

It's the difference between AWS/USGVT being able to decrypt a HTTP convo to a specifc user after we've combined a lot of data and having access to all 200TB of it..

Let's say that I am a pharma company.

Q. Don't you share this data over networks from time to time? A. Hell no.

Q. Is all your data siloed and bolted down to one place never to move anywhere A. Yes that is the plan actually.

Q. How do you trust the data to not take a hike in some random direction you don't fully trust A. Easy, it never gets out of my data center.

An IT director that works in a pharma company, will simply laugh after reading the "don't build private clouds" article

Clear statements are not forms of assurance. A policy does not stop packets, unless it's a physical firewall ruleset.

Just few things happened recently related to data on cloud.

1> Google deleted People's account who bought Pixel from reseller. They have to beg google to restore their data, contacts. Not going to happened if you have it in your own cloud.

2> Windows 10 is full of telemetry. Imagine someone knows exactly what software you used, when you used it, for how long. Advertisement are built-in with system level. You don't own your machine anymore, Windows 10 can decide when it want to upgrade itself then lock you out from using it for hours. Your data now is in Microsoft's cloud, but you don't decide how they can use it, who they are going to sell to.

For depository reason? Sure of course, cloud is reliable on up time, expandable with a few click. But if Cloud provider decided to wipe the account with whatever reason, what you are going to do?

If a cellular network, or a power-grid provider decided to foreclose your accounts. What are you going to do?

The difference is that i can build my own email server, file server, web server, and so can you. The internet needn't be in the hands of powerful few.

You can also build your own power to some level, with solar and wind.

Not enough to power my mail & web server and an electric kettle, unfortunately, where I live, especially during winter months (~2-3kWh / day, when electricity is most needed). It's more viable to use diesel generator if i were thinking of going off-grid. To go on further minimizing dependency on something that isn't readily available, i'd probably go with gasoline engine generator equipped with wood gasifier [1]. Green power, unfortunately, is no libertarians dream - it only works when you can scale - that is, basically, if you're state-level actor.

[1] https://en.wikipedia.org/wiki/Wood_gas

Uhm... And why would we actually believe Microsoft about that? They have screwed their customers numerous times already, and they were more than happy to cooperate with NSA.

Wow. I got downvoted for being straightforward and transparent?

You probably got downvoted because of the antagonistic wording of your post:

> Erm, no.

That can come across as a rude way to disagree with someone (it does to me).

> There is no uncertainty, only lack of awareness […]

That's dismissive (it reads as “you are not uncertain about this matter, you just think you are”) and not very helpful either.

Reply on news.ycombinator.com