[yazaddaruvala]

Having both worked at Amazon and still in the cloud industry, to me this seems like a strange take.

Apple leases these computers from Amazon like it would from any other colo. Why wouldn’t these servers be considered Apple servers?

Barring a major privacy violation by AWS (which doesn’t seem likely), or some other sort of 0-day hack the data on these servers is entirely private to Apple.

[sandbox_escape]

This means trusting AWS’s privacy policies too, which users aren’t always aware of or expecting when Apple promises full control. It’s about honest transparency.

We pay a premium for Apple's privacy restrictions and then end up being tricked to rely on Amazon's. It is false advertisement to say the least....

[ShadowRegent]

When Apple says your data doesn't leave their servers, that doesn't mean those servers have to be in their own datacenters or that Apple doesn't have other vendors that help them deliver their service. It also doesn't mean those companies have access to your unencrypted data. That data also, by necessity, likely traverses other networks in encrypted form on its way between you and Apple.

[sandbox_escape]

Apple claims that data they are in full control of your data from Safari, Maps, and Spotlight etc.... Data center or not, this contradicts both the spirit and letter of that promise.

This is basic logic.

[mingus88]

If you have any evidence that Amazon is accessing the data of their leased tenants, that would be an earth shattering indictment of the entire cloud industry

It would be akin to accusing Datapipe or any other provider of pulling drives out of any client with racked servers in their data centers.

[orev]

And that’s exactly why high security applications don’t use cloud like this; because that can never be guaranteed by some policy compliance certificate. That’s the only thing stopping them from pulling drives, etc.

[orev]

If Apple is leasing physical servers from Amazon, without Amazon further involved in running them (other than dealing with hardware issues), then this argument holds water. Otherwise it doesn’t, even if they’re using Amazon VMs or some higher level services. A VM hosted on someone else’s physical platform is not an “own servers” in this context (which is who has access to the data).

I know HN is very imbued with the cloud approach, and maybe from that perspective running your own servers is just so unthinkable it may as well not exist at all, you don’t get to change how language works. If someone says they’re running on “their own servers” that always means the whole stack including physical and up.

Ownership is determined not only by who pays for it, but also who has direct access to the actual devices.

[bell-cot]

Yes-ish. When you're making broad "trust us" claims to consumers - who don't know the industry or its practices, let alone the technical details - then the really honest approach is to follow those consumer's understanding of your promises.

Otherwise, they might end up feeling that they were duped by the weasel-words of a sleazy lawyer.

[countrpt]

Maybe some might feel that way at first, but it’s also an opportunity and responsibility to educate.

This problem is why enterprise contractual agreements and large compliance systems exist for companies at this scale. Large hosting providers like AWS, Azure, GCP, etc. provide an ability to scale and assurances about risk mitigation, privacy, and availability that are much more viable than each company having to maintain their own private in-house fleets just to create an additional illusion of privacy/security that’s actually no better than tight contractual controls to begin with.

Maybe they need to explain this properly, but servers don’t magically have a lower level of risk just because they’re behind your four walls. In fact, if you lack the experience and expertise, the risk is almost certainly higher depending on your threat model. (And for Apple, their threat model is at the nationstate level. They don’t choose their hosting providers lightly.)