Hacker News Reader

Comment by agopaul | Hacker News Reader

If I were you, I would put a little emphasis on the security of your service. Logs can definitely contain sensitive data and companies rely on you to store that data in a "proper" way.

At least, as a possible customer, that is one of my biggest concern.

But maybe I'm just too focused on security given that our clients ask us about it pretty much every day. So as a possible vendor (for us or other SaaS businesses) and being part of our chain of trust, I'd expect some words on how you handle security and how much it is important for you. That is lacking on the website if I'm correct.

Anyway, congrats on the service! I think that there is room for LogDNA in the logging-warehousing market

View on HN

Yes, thanks for the feedback. We'll be adding this and a FAQ section soon. We do encrypt everything in transit, end-to-end, just like most in our industry. We do not encrypt at rest at the moment but will be looking into it.

Not encrypting at rest seems like a huge oversight, given that your service most likely uses AWS S3 and it is dead simple to turn on encryption. I'm not sure anyone will trust you to store their log data without at least encrypting data at rest.

http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncrypti...

It's literally setting a policy on a bucket and a flag on object PUTs if you're not managing the keys yourself.

Yes we do plan to be doing this for S3 archives.

No worries, just pointing it out. Honestly this should be on by default on the AWS side.

Hmmm, we're using EC2 mainly, not S3. I've seen an option to encrypt disk but haven't researched it fully.

Thanks for the response. You can also encrypt EBS volumes using Amazon's KMS, so I'd research that. It will be an important feature for your potential enterprise customers.

> I'm not sure anyone will trust you to store their log data without at least encrypting data at rest.

I know something of logs.

Speaking for requirements inside other's logging use cases is pointless given privacy needs vary from use case to use case. While your statement may be factual for some use cases, claiming it's "a huge oversight" is blanket blaming statement across all use cases and thus becomes worthless.

Besides, if you want search for things in the logs, things have to be kept hot and moving unencrypted. That means no at rest encrypted storage for near realtime search use cases.

I wish I had a stick I could hit people with to get them to stop creating double bind arguments. If you really want privacy for your logs, deal with them yourself on your own equipment. If you absolutely have no time to deal with your logs yourself, then get comfortable with privacy issues.

Not encrypting your customer data at rest in a cloud service just seems really amateur in this day and age. What type of customer are you anticipating that will care about tons of storage but won't care about security?

Totally agree. I'm not looking at anything that doesn't integrate with AWS IAM and KMS, even if it's an external service.

Reply on news.ycombinator.com