Hacker News Reader

Comment by gavinpc | Hacker News Reader

"Its" data?

There's no mention in TFA of the data belonging in any way to the users. And maybe that's accurate.

Yes, we have web/cloud apps now. But that is—or should be—orthogonal to where data is stored and hosted. Of course app vendors have every incentive to create lock-in. And most users are just happy to hear that "you do not need to take any action" and your data will just be magically faster and more secure. But at least around here, wouldn't people rather own their storage? Does remoteStorage have any legs?[0]

This kind of happened with authentication, right? It's common now to use OAuth to provide login using a third party. Of course, they're mostly silos, too, but at least in principle an app could let you choose a provider.

[0] https://tools.ietf.org/html/draft-dejong-remotestorage-07

View on HN

Your points are covered in the official announcement [1], and cross-linked on their FAQ about the announcement [2]. That was also posted to HN but didn't get much traction [3].

[1] https://blog.evernote.com/blog/2016/09/13/evernotes-future-c...

[2] https://help.evernote.com/hc/en-us/articles/226885427

[3] https://news.ycombinator.com/item?id=12490149

I wish people cared.

After many years in this industry I've personally come to the conclusion that nobody actually cares about security, privacy, or data ownership. People say they do but they are lying, as evidenced by the fact that they do not change their behavior. People gripe about security and privacy but continue to use "free" surveillanceware/spyware and continue to migrate everything to cloud hosts they don't control.

The only thing people care about in reality is convenience and user experience, and they're obviously willing to give up an almost unlimited amount of personal privacy and control to get those things.

It sounds like that might be a reaction to the lack of obvious repercussions of giving up privacy and security. What tangible harm does the average person come to by giving up privacy, security, and data ownership?

I think it's more about immediate impact.

Will I be hurt today if I put my data on someone else's cloud? probably not. Will I 10 years from now? possibly, but by then, my brain will have disassociated those two.

You don't necessarily sacrifice those when choosing a third party. We all apparently work in related industries...do you and your colleagues sit around and dream up ways to exploit customers? I don't, nor do those I work with.

I don't think anyone does. Its rarely a thought-out malice. It's more of unexpected things that happen because no one thought or cared to safeguard against that, or because such safeguards would've broken some legit feature or business model.

Like that E2E vs spam filtering issue explaination from GMail engineers.

Somebody does, apparently, otherwise business models would be much more straightforward. I worked in a social media marketing, "let's take an EU grant and spin off random shitty SaaS to bolster our marketing platform" company. I could see people in charge inventing new and great ideas for "bringing in value" without noticing (in any apparent way) that those ideas were mostly literally shitting on the users to make a quick buck. Reality distortion field? Sociopathic tendencies? Call it what you want, but it does happen, and that's where most of the "brilliant" business models come from.

We don't need all people to care, only those who can make a difference. We have the technology to build privacy-enforcing versions of popular services. We can make them better, faster, and stronger. We could create new, fun, and interesting things as well! What is lacking is the coordination and funding to compete properly.

The real question is, how do we fix that?

One point is that you often don't really hear about the people who care enough to avoid much "social media" and cloud services... because they're avoiding many of the tools by which they might talk about it. They're also relatively uncommon, and if your friend group pretty much requires use of social media tools to stick together, you're not going to find them.

At the moment, I use GMail, IRC, a Matrix server I set up for my hackspace, a couple of niche forums, and a niche social network. I'm in the process of organising some hackspace servers to provide email hosting, so hopefully I'll be able to switch off of GMail at some point. The next step after that would be some form of cloud file hosting.

I'm not overly privacy-conscious though - I've used Tor once to see what the fuss is about, and I don't have AdBlock or NoScript installed. But at least I avoid explicitly putting my data in the hands of companies I have no control over as much as possible.

I have a similar situations. In a hackerspace I manage, we're still using GMail and Google Docs for collaboration. We're slowly moving to self-hosted services, like OwnCloud, but we can only do that because we're an established group of people. Back when the space was forming, there was no one willing to shoulder the sysadmin responsibilities for managing all the tools we needed to start and grow the organization.

What we need is separation of virtual machines from the code they run. Exchangable backends, if you like. We should be able to use cloud tools like e.g. Google Docs while also being able to choose our own backend - whether this or that cloud, or even our own servers. Right now, instead of running someone else's code on our data (as it is with files and local work), we're giving third parties our data for them to run the code for us.

You're pretty much describing Sandstorm, for the record. Have you had a play with it?

Not yet. Will have to schedule some time for it.

> I wish people cared.

I wish too, but this is a moot point - everyone has a shit ton of things to care about in their adult lives. By the time we're done putting out fires at work, dealing with mortgage, bills, grocery shopping, sick parents, broken sinks, searching for a good school for our kids, etc. there's precious little care left to be given. Greedy and socially destructive cloud/SaaS business practices are a distant position on a long list of things to care about, so you can't say that "if people don't care about something then it means they're ok with that". It only means the issue isn't immediately pressing/dangerous enough to warrant prioritizing it.

Why do you wish people cared? I don't care and I'm perfectly happy with that.

Because not caring for the issue has adverse effects in society.

It's not about individual happiness.

To give an extreme example, there are people who don't care about police violence. While they are might fine, and probably wont ever have to suffer it, the resulting society is worse than if they cared.

> Because not caring for the issue has adverse effects in society.

Ok, but people obviously don't think the issue is that big since the majority doesn't care.

So? The majority didn't care for slavery either (if it wasn't in favour of it).

Whether the majority (or a minority) merely likes something is not a justification for it.

As to whether its not harmful, just, etc, that requires argumentation and further inquiry.

But at least around here, wouldn't people rather own their storage

I know I'd rather not own any storage at home. I have a 9TB storage array (well, I'm only using about half) that I use for pictures, music and movies, and if I had a faster and more reliable internet connection, I'd happily move that all to the cloud.

I'd want my own encryption key though, so the provider can't see any of the data.

All of that data already lives at a cloud provider as backup -- took a couple months to upload it all.

I've thought about doing this a lot. I have a solid and stable 20 Mb connection at home, only have had ~2 hours of downtime this year.

The thing is... I don't want to basically trap myself into AWS or Dropbox. I run a 6Tb array like you, and kinda set up my own cloud, drag and drop, etc.

I don't think I'd ever give it up because:

1) It's cheaper to run myself (long term) - I'd have to consistently pay someone else ever increasing amounts to store data (which seems dumb since storage gets cheaper every year, their service doesn't).

2) Security - I don't want anyone to have access to those files but me. I'm 100% sure Amazon or Google would be able to access those files if ordered too by a government. Hell, they might do it without being ordered, who knows what's happened since Snowden.

3) Ease of use - my setup is based on a local network (as well as an ssh component). Basically, my setup works like Dropbox. The only drawback is no mobile component. If I want to change that I have access to all the parts and can do what I want. With AWS (which I use all day for work) I cant swap out a drive or stream a movie to my TV, phone, or desktop with a click.

I've got just about 60TB in my apartment with gigabit and I wouldn't consider moving them to the cloud. Way too risky for me.

Now I will say, if I could trust a cloud service that wouldn't charge a ton of money for 60+tb then I would jump on it.

Hosting yourself is still way cheaper. But services like S3 do get cheaper. When S3 was released in 2006, it cost $0.150/gb*month. That price underwent a half-dozen or so cuts every couple years to reach its current price of $0.03.

Its actually been that price for about 2.5 years now. With competition from Google, Microsoft, and Backblaze, its possible we could see a push toward even cheaper prices before too long.

As for security, S3 does support SSE at rest with a user-provided encryption key. So you're good to go there.

On security, I'd like to point out that GCS now supports Customer Supplied Encryption Keys [0]. If you lose your key, we can't help you. Nobody can just unwrap your encrypted data.

On cost, I'm using Nearline myself ($.01/GB/month so about $10/TB/month) as an offsite backup of my home NAS setup. Paying for actual bytes stored instead of bytes of capacity gets you at least 20% (raid overhead) but honestly closer to 50% or more depending on how full you are. The poster above had about 3 TiB apparently which works out to $30/month. That's pretty good for an unthrottled replicated storage system offsite.

(And like you, I'm considering making my media directly read-only available via App Engine or something, because once you're talking about 1+ TiB of photos all photo hosting sites fall over).

Disclosure: I work on Google Cloud.

[0] https://cloud.google.com/storage/docs/encryption

Agreed. I keep a server at home, not because I want to but because I have to. The cost of cloud storage and compute, relative to what you can field in your closet, is inordinate. You do pay the premium for not managing it yourself.

Its my hunch that the statement you quote is just simply wrong. If you're keeping a computer at home that is doing something valuable enough to keep it around, it should valuable enough to you that there has to be _some_ price cheap enough, and _some_ capabilities good enough, that the cloud makes sense. The exception to this is, of course, the hobbyists and the tinfoil hatters.

That's... gotta be extremely expensive.

I don't care about my internet connection but it was looking like hundreds of dollars a month or more to store that sort of data.

(I only post in the hope that I'm missing a magic, affordable bullet.)

I imagine that the users do not retain rights over their data.

Why would you think that? I didn't read them carefully, but the TOS seem reasonable, granting Evernote a limited license to the data for the purpose of providing the service.

https://evernote.com/legal/tos.php

But choosing where to store the data is sort of obviously inside the umbrella of providing the service.

Because a rational person will assume a TOS attempts to acquire as many rights as possible. I certainly don't read them because IANAL.

This is just a round about way of saying "I sure am surprised people think they 'own' their data if it's stored and managed by a commercial entity as a business and not spelled out as a primary feature of the service".

The primary business purpose of Evernote is, indeed, selling data storage and access. The price tiers are based, in part, on max upload and max amount of notes.

I'm not quite sure what you're saying. Are you agreeing with me, or are you arguing that protecting the legal ownership and rights to data is a primary selling point of the product? I just don't see it.

That's not a rational person, it's a simplifying-until-wrong person.

That person is neglecting the fact that it's not in the business' interest to "acquire all rights". The main reason being that _some_ layer would read it and _everyone_ would read it the next in the New York Times.

A secondary reason is that it'd be illegal and/or unenforceable in many jurisdictions.

Reply on news.ycombinator.com