Hacker News Reader

Comment by dogma1138 | Hacker News Reader

Or you don’t have the resources that Google has.

This statement holds water only to a handful of companies that can actually afford to build their own silicon.

You seem to be assuming that the message was “if you understand what is going on, you will choose to build your own silicon”—if so, then, yes, it overlooks threshold resource needs to do that.

OTOH, the intended message could be “you can't fully understand the issues without the insight gained by building your own silicon”, in which case it would be just as true of companies without the resources to build their own silicon.

Security is about managing risks in a world where resources are limited.

Building your own silicon is the last thing you do to ensure security even if you are Google, you only do that when it’s the last broad viable attack vector left for your adversaries to exploit.

Most people use those handful of companies, so it holds a lot of water.

I’m not saying it doesn’t make sense to Google, I’m saying it’s too broad of a statement to be generalized.

Poor amazon and microsoft, unable to afford to build their own silicon

The world isn’t Amazon or Microsoft, and even for them it’s borderline questionable if designing silicon at scale is the best use of their resources at this point.

As I’ve stated already it’s the last thing you do when you think about security not the first.

When the security posture of your code, configuration, facilities, supply chain etc. is so good that the only attack vector left for adversaries to exploit to compromise your organization in a sufficiently broad manner is the hardware is when you start thinking about building your own silicon.

Or when ofc there are actual business needs for this e.g. you want to be independent of other SoC/ASIC designers or there aren’t any solutions that meet your needs.

Which also comes to the actual point other than the Google key/hsm solutions that look more of a rebadge than a home grown design Google is focusing on things like the TPU due to business reasons aka $$$ not security.

Google isn’t going away from Xeon/EPYC or x86 any time soon, and I find it very questionable if anyone would make a security argument against NVIDIA GPUs as far as Google goes since Google even wrote their own driver stack and CUDA compiler.

Doesn't AWS make their own NICs to support the security features in their custom network stack?

Do they build their on NICs for security or because it’s the cheapest way of segregating network traffic?

As in relying on logical separation of client traffic rather than physical one so they don’t need as many physical ports, switches and most importantly network cables(often the highest actual cost in many data centers as far as networking goes)?

You can get that with vlans.

Buying gold plated cables?

Not at AWS's scale. You can only have 4094 VLANs.

Per switch. Much much more if you use vxlan. My point is that they're not doing it for separation as normal nic's are capable of that.

Per LAN not necessarily per switch, overall getting out of the 16bit tag limit takes a lot of work.

I’m not sure if anyone actually uses VXLAN yet.

You didn’t actually made a point because you haven’t provided proof that what Amazon did for AWS wasn’t done because of operational requirements.

Intel can afford to do its own silicon and they are not going really well security wise right now.

But that was not the message, is about understanding risks.

Reply on news.ycombinator.com