[joecode]

One potential reason not to move: Security.

A good friend deep in the security community once told me, off hand, that EC2 was "owned." I didn't take this too seriously until another good friend, who has been working at Amazon for the past several years, told me that engineers at Amazon were generally forbidden from using AWS due to security concerns.

That much said, I still decided to use EC2/RDS/S3 to host the infrastructure of my latest startup. It is just too convenient to walk away from. Once it matters, I can move the critical stuff to dedicated servers.

EDIT: To clarify, I'm not suggesting that Amazon knows AWS is "owned" and offers it to others anyway. I'm only noting that, for certain critical services, they themselves do not appear willing to take the risk.

[cperciva]

I've worked with Amazon Web Services security people in the past, and while they're not perfect (nobody is) I have always had the impression that they take security seriously. AWS has many very large customers, including the US government and companies handling HIPAA-restricted data; based on the assumption that Amazon employees don't want to be thrown in jail for 10 years, I think it's safe to say that if EC2 is is "0wned" as you claim, it's certainly not well known within Amazon.

[tptacek]

For what it's worth, accidentally (or even negliently) violating HIPAA is fantastically unlikely to get you charged criminally.

[cperciva]

I agree -- but fraudulently violating HIPAA (e.g., if you advertised "this is a safe place to put your HIPAA data" while knowing that it wasn't safe) is probably a rather different matter.

[rbranson]

Yeah but "0wning" EC2 would most certainly get you charged criminally under a number of laws.

[tptacek]

Colin was implying that negligent management of EC2 could leave Amazon employees criminally liable. Obviously anybody who "owned up" EC2 is already a criminal.

[benblack]

"...told me that engineers at Amazon were generally forbidden from using AWS due to security concerns."

The opposite is the case: there has been a huge push for some time to move (significant) parts of Amazon retail to AWS. It's extremely complex and service quality is paramount, so it takes a while to make it all happen.

[joecode]

My friend from Amazon works in the supply-chain side of things, and he said he really wants to use it, but everything has to be encrypted and some stuff is off limits.

I take it you work on the retail side of things? I'd be interested to hear any more details that you can share.

[benblack]

That certain services can't yet be moved to AWS is not an an indicator AWS is compromised. Several services, for example the payments infrastructure, are subject to regulations that make it challenging to implement _at all_, much less in a shared environment like AWS. Again, this is not an argument that AWS is compromised, and teams at Amazon are absolutely using AWS.

[benblack]

"A good friend deep in the security community once told me, off hand, that EC2 was "owned." I didn't take this too seriously until another good friend, who has been working at Amazon for the past several years, told me that engineers at Amazon were generally forbidden from using AWS due to security concerns."

"EDIT: To clarify, I'm not suggesting that Amazon knows AWS is "owned" and offers it to others anyway. I'm only noting that, for certain critical services, they themselves do not appear willing to take the risk."

I may not be the smartest guy, but it seems to me that's exactly what you are saying.

[joecode]

I'm not sure where the confusion lies, but I'm guessing you see "security concerns" as equivalent to "knowledge of ownership"?

It seems to me those are entirely different things, as one can be concerned about potential threat without knowing if it is real or not. But I do not work in the security community myself and may be using language sloppily.

I would be much obliged if you could show me where the crux of the confusion lies.

[biot]

To paraphrase what you said: "I didn't take [statement A] seriously until [statement B]."

statement A = EC2 was owned statement B = engineers at Amazon forbidden from using AWS

Perhaps English isn't your first language, but the way you've phrased it, you're relying on statement B as evidence/proof of statement A, directly implying a connection between the two. It's difficult to read it any other way.

Rewording your original comment: "It was only when that I heard that engineers at Amazon were forbidden from using AWS that I took seriously the comment that EC2 was owned."

[joecode]

Thanks for the reply. There is a connection, of course, but it is not that Amazon knows. Statement B is evidence in the sense that it suggests Amazon does not believe security is sufficiently iron-clad around EC2, which would allow for statement A to be possible in the first place.

I honestly did not expect my comment to create such angst. I recognize that the wording was a bit confusing, but it seems the main thing people are upset about is that I am spreading FUD. Of course that would be quite inappropriate if it was completely unfounded, but I have stated exactly where my concerns came from, so it seems perfectly legit to me.

Your reply is very reasonable and polite, but I am disappointed at the bulk of knee-jerk reactions to this post, as well as their passive aggressive/ad-hominen nature.

Perhaps I am just in a poor mood, but I believe I will be moving on from HN. It was one of the few excuses left for me to procrastinate, so at least I should be more productive. ;)

EDIT: This, by the way, is an excellent article, though somewhat dated, on some of the security shortcomings of EC2. Note it does not address the "nightmare scenario" that Xen (the virtual machine software) is itself vulnerable.

http://cloudsecurity.org/blog/2009/04/08/is-amazon-aws-reall...

[rbranson]

While this is disconcerting, I wouldn't make any business decisions based on such a claim. The idea that EC2 is "owned" without Amazon knowing about it is closing in on absurdity. I've worked directly with Amazon as an outside vendor and they are very security concious, to the point of near paranoia.

[joecode]

While I agree it is hard to believe, it would be even more surprising if Amazon did know about it. The fact that they do not use AWS internally suggests that---at least with their level of paranoia---they seem to suspect AWS themselves.

[benblack]

Both you and your friend are misinformed.

[rbranson]

^^--- this guy used to be a seriously big deal within Amazon operations. Listen to him.

[joecode]

I'm not sure how you can say that so matter-of-factly. My security friend was talking about something that Amazon does not (and presumably very few people do) know. Meanwhile my friend at Amazon was just stating the fact that he was not supposed to use AWS, or only with extreme caution. Of course that may differ from department to department, if that's what you mean.

[benblack]

http://www.linkedin.com/profile/view?id=6320672

[ceejayoz]

For anyone who doesn't want to log in to LinkedIn, "Sr. Manager, Information Security at Amazon.com"

[joecode]

Your resume is very impressive, and I see that you obviously know a lot about security at Amazon, yet this by itself does not discount my points. Those are:

1) AWS could be compromised, as my first friend claimed, without Amazon knowing about it.

2) My second friend is not allowed to use AWS for security reasons.

The truth of the first point is indeterminable, I think we may agree. Meanwhile, the second point may indeed be due to my friend being misinformed, if for example, you are aware of a Amazon-wide policy that says engineers can use AWS willy-nilly, so long as they abide by general security regulations that are used elsewhere.

[tptacek]

The odds of EC2 being owned and Rackspace not being owned are astronomical.

[joecode]

Certainly agree. Perhaps it would be better to suggest moving to dedicated servers, depending how security-paranoid you are, anyhow.

[qq66]

Dedicated servers only give you the illusion of higher security.

[chopsueyar]

Please explain.

[lusis]

You have the same obligation with an EC2 AMI that you have with a physical server.

Using a cloud/vps/whatever provider does not obviate the need to secure the base OS.

[cperciva]

Using virtualized hardware does expose you to vulnerabilities in the virtualization layer, though...

[nphase]

Those get "0wned" on a regular basis too.

[jread]

I'm not sure there is any proof Rackspace Cloud is any more secure than EC2. AWS offers a Virtual Private Data Center service (VPC) which is highly secure. Rackspace Cloud has nothing like that. AWS also offers firewall management functionality which Rackspace Cloud does not. Amazon.com is run out of the same data centers as AWS.

[dschobel]

That's a hell of an allegation to perpetuate based on hearsay.

[dangrossman]

I'd love to hear more about this...

[joseakle]

Could you expand on your comment?