Interview with an anonymous AWS cybersecurity engineer | Hacker News Reader

Interview with an anonymous AWS cybersecurity engineer

logicmag.io

125 pointswho-knows67 comments

This reads a lot like a PR piece for Amazon, with most "answers" promoting Amazon nearly like a press release and very little negative points.

A few sentences that stand out:

> If you have a ton of data in your data center and you want to move it to AWS but you don't want to send it over the internet, we’ll send an eighteen-wheeler to you filled with hard drives, plug it into your data center with a fiber optic cable, and then drive it across the country to us after loading it up with your data.

> Q: I know there have been a number of collective actions among Amazon warehouse workers around the issue of safety during the pandemic. > A: (a series of measures implemented at Amazon)

> Internally, people say, “Oh, we’re probably better than our competitions, or other warehousing and logistics companies.”

> Q: Has Ring brought Amazon into much closer relationships with law enforcement? > A: it would really surprise me if any of those relationships were the result of the Ring acquisition [...] I think Amazon also kind of backed into that situation. We only realized after the fact that we had all this data about who was coming to people’s front doors.

This absolutely has to be a PR piece, or one filtered through a marketing layer of some sort. The only thing that threw me for a loop are the negative points, but this could just be a clever ploy to further the deception. The company we pay to do marketing has all kinds of ridiculous tricks they propose, so I wouldn't be surprised if this is a thing.

Speaking as someone who worked in the PR sector. This reads like an article crafted to influence public opinion by polish the truthful elements while downplaying their flaws.

It's been established that "selective whistleblowing" articles are deemed to be more trustworthy than official marketing statements. Therefore, it would be foolish for corporates to not exploit that to their advantage.

Or moral.

I find it very hard to belive a cyber security engineer knows that much of the wider company and it's history.

This seemed like a fairly normal level of knowledge to me, honestly. There's a lot of public information about the company, and you work there so you want to learn and know more - from both internal/external sources. Anything you found particularly surprising?

This person is very clearly mixing things that he knows directly, things that he's read about in books (e.g. Amazon's strategy in the early days), and rumors that he's heard (e.g. Jeff Bezos' personal life). There's no way that a cybersecurity engineer at a company as sprawling as Amazon has reliable firsthand knowledge on so many different unrelated topics.

The writer is a faculty associate at the Berkman Klein Center at Harvard Law, which is an organization I have tremendous respect for, so it's really a shame that they were naive enough to publish this.

It is verging on irresponsible journalism to give this person anonymity without providing any details on their knowledge or credentials and seemingly spending no effort challenging or fact checking any of these answers. That isn't how these pieces are supposed to be written.

There's a massive off vibe for me in things like

> So if you have cancer and you might die from your cancer, we won't help you get treatment

It just feels.. off. I wouldn't go as far to say the person doesn't work at Amazon at all and instead wants to jab at them but I'm definitely thinking it loudly

To me it feels like someone was kind of bullshitting with their friends and maybe making themselves seem more knowledgeable and important than they really are. It's totally irresponsible to put it in print.

Very much this. They don’t speak in a way that makes me think they have any internal knowledge of the areas they are speaking about.

This is the more likely answer, good shout

The point was regarding fulfillment center workers who don't work enough hours to get company healthcare. That is how it's handled.

If you get cancer or any other major medical catastrophe, Amazon won't do anything to you if you're a part time worker without health insurance. But even if you don't have the health insurance, Amazon will provide support if you catch COVID. Because it's good business to not have one uninsured person to expose an entire shift to a highly communicable disease.

Aye but it's more that it was mentioned at all rather than whether it's true or not

With the exception of it being a whistleblowing thing you don't often see jabs like that -- especially jabs at departments the person has no involvement with. Also if it is whistleblowing it's more a "they" than a "we" thing

It is verging on irresponsible journalism

No names. No contact information. No accountability.

This isn't journalism. It's a random blog that claims to put out a print edition three times a year.

I didn't even notice the total lack of bylines or masthead. I shouldn't have thrown in the "verging on" qualifier. It is just flat irresponsible to publish this in this manner.

Giving the benefit of the doubt, he sounds like an experienced senior guy so he's surely plugged in to internal communications, discussions, and rumors. And a lot of times in security there are opportunities to work with a large cross-section of teams.

I've worked with engineers at Amazon up to the senior principal level. Even if you grant that people in cybersecurity see a broader swath of the company, there's just no way that he can talk authoritatively about everything from AWS sales tactics, to hiring practices for former DoD procurement people, to real estate strategy to Amazon's own supply chain, to Jeff B.'s personal life. It would be like a mid-level employee at State Department talking about how the Trump administration views farm policy, and what the National Park Service is planning, and what types of cool things the US Mint is cooking up. That State Department guy might have heard about a lot of those things either from reading the news or from talking to buddies, but he wouldn't come within a mile of it as part of his job.

Which is fair. I don't think the interview is meant to be read as an authoritative source of truth on Amazon culture and sales and so forth, but rather just relaying what they've heard. They're more plugged into the Amazon rumor mill than I am and I think rumors often contain kernels of truth.

I don't think he said anything particularly insightful irt all those topics. A lot of the statements were superficial things that you'll pick up while working on adjacent areas (and as we know, it's pretty easy to jump around different teams/fields in Amazon) or from Amazonian friends.

Interesting things he didn't really talk much about: Alexa (there was 1 like 1 very superficial reference to it), Kuiper, and others.

I don't think this is a PR piece, and most likely it is not approved by the company (the reference about Jeff's Sex Life would've been removed). This does feel like a real view from an insider, it's very opinionated, and not all of it is right.

They're clearly putting on an air of authoritativeness, but yeah exactly. I read this more like a very extended Glassdoor review. You're getting one person's perspective. Interesting interview, big grain of salt.

> Jeff Bezos studies other “great men” in history and imagines himself to be a kind of Alexander the Great. There's even a building on the Amazon campus called Alexandria, which was the name of one of the company’s early projects to get every single book that had ever been published to be listed on Amazon.

I'd guess the building is named after the Library of Alexandria – one of the largest and most significant libraries of the ancient world – and not because of a god complex as the story implies.

> The writer is a faculty associate at the Berkman Klein Center at Harvard Law, which is an organization I have tremendous respect for, so it's really a shame that they were naive enough to publish this.

I don't see a writer listed. What am I missing?

(Disclosure -- I'm a BKC fellow this year)

I initially saw the link on her twitter feed: https://twitter.com/moiragweigel/status/1341414901143777280

Based on this I'm still not sure if she actually wrote the piece or just published it (as her bio lists her as a co-founder of the site.)

Based on this tweet, I believe she was the interviewer: https://twitter.com/moiragweigel/status/1341423429958979593

I'll add: even if he is speaking for AWS with some authority, he certainly doesn't speak for the rest of Amazon. I've seen some teams with _really_ bad practices (security and otherwise.)

As for your comment about the writer, the entire website feels very "off" to me - no author listed, no "About" page with names/links, nothing to give this credibility. I did see the link to the cofounder's Twitter page, so at least there is someone behind it, but it is pretty well hidden.

Maybe it's an interview of Bezos himself? It's written a lot like from someone's point of view who a) knows the early history b) is familiar with current daily business (like covid) c) is familiar with how different factions inside the company were years ago. If you look at the company from a global perspective but still from the inside, there are only few people around who can write such an interview.

Caesar wrote his books in the third person as well. Bezos seems to me like the kind of guy who'd do that.

Also I'm not too familiar with how Bezos writes, but from the few interviews of him that I've heard, it sounds a lot like him to me. See also this letter... guess the author :). https://twitter.com/LettersOfNote/status/923473337115914240

What’s an example of a division that AWS subsidizes particularly heavily?

Prime Video, for one. Jeff loves Prime Video because it gives him access to the social scene in LA and New York. He’s newly divorced and the richest man in the world. Prime Video is a loss leader for Jeff’s sex life

errm... That should be on their SEC risk report

This person is almost certainly not that intimately familiar with Jeff's private life. Take this with a grain of salt.

Look man if HN isn’t the place for wildly overconfident, wholly unsubstantiated speculation then idk what it is for

Let's not kid ourselves - HN is Valleywag with a lower kill count

It's also the first thing I've read here in six months that's made me laugh.

Read more comments.

The only weird thing about this take is I could believe it. And so what if it’s true? The guy has worked to become the richest man in the world (though I may be against his methods of doing so), and isn’t even from a prominent family. I don’t see how anyone could be upset by this XD

I find it hard to believe that "subsidizing Prime Video" is the only way for Jeff Bezos to gain entry to the LA/NYC social scenes.

Agreed. Also, Prime Video IS a major incentive for a lot of people to sign up for Amazon Prime and thereby helping perpetrate their near monopoly - so I guess it's a win win for Amazon and for Jeff's sex life.

This is like interviewing a dog about the inter workings of the household that owns him.

Kind of tangential, but

> If you're working in Seattle for Amazon and you're good at your job and you want to leave your job tomorrow, you have far fewer opportunities. Where are you going to go, Microsoft? There's not nearly as much mobility. So I think a big part of the reason we have less organizing [than Google] is that people are more afraid to jeopardize their jobs. If you want to stay in the Northwest, you keep your head down.

Is that... really how people view Seattle? Feels like there's always a zillion companies hiring here.

There a lot of tech companies in Seattle, many of which are growing their head count. I'd say it's just as good a job market as SF or NY, albeit slightly smaller.

I don't buy the BS from the interview/blog article.

No Amazon engineer I know was worried about leaving/loosing their job. All but one said their engineering culture wasn't fun to work in, and they all left before fully vesting... so i wouldn't say they were held hostage in any way.

To be fair, with the way Amazon's TC/RSUs work you always have some left unvested - I don't know if it is possible to quit "fully" vested (unless you're referring only to the initial grant.)

People with the FAANG mindset have only five preferred employers, and only one of them is in Seattle.

Facebook and Google both have multiple offices around Seattle. I wouldn’t be surprised if Apple or Netflix were interested in hiring in Seattle either.

I'd add Microsoft and drop Facebook, personally, but... yeah, the first part is kinda fair. That said, the second part is wrong. It was no trouble at all to jump from Amazon to Google Seattle when I felt the time was right. My desk at the office (if you remember offices from the pre-pandemic days) is less than two blocks from my original desk at Amazon.

It's also not that uncommon to see people go from Amazon go to Microsoft especially in teams like Azure. There's more difference between teams within the two of them than there is between the two as a whole. Although, people generally go to Microsoft for better work life balance and benefits. Going from Microsoft to Amazon to boomerang back to Microsoft is also quite common.

source: work at MS

As someone who pays for and reads Logic Mag, I would caution others to take what is said here with a grain of salt, and also not to be surprised by the low quality interviews they feature, often with a rambling lack of focus. I started purchasing issues of Logic after reading one promising excerpt at a bookstore. However the overt biases of what topics they cover/how they cover them, the frequent reliance on vague anonymous sources of dubious quality, clear political biases, and low signal to noise ratio mean the current issue may be my last.

Almost none of those questions were about AWS cybersecurity.

Author asks 1 semi-security-related question, I think here we go, follows up with "so you guys acquired some unrelated product, how's that going?"

Wtf is this article even about, am I reading a random lunch conversation between old friends that was made more interesting by the guy coincidentally working in security (a hot topic) and being made anonymous (so that people would assume shocking secrets are to be revealed inside)?

But when funding dries up for startups and companies have to shutter, then all of their digital operation overseas is cut loose. And the people who lose their jobs go into cybercrime. They think, “There's no other options for me. So sure. Let's do it. Lock and load.”

this section is just nonsense. So the crisis happens then devs in "developing countries" become cybercriminals ? total bs ...

Are you telling me you've never gone and downloaded a car after getting laid off?

"These days, the company takes security extremely seriously. I think you'd be hard-pressed to find many nation states that have as sophisticated a security approach as Amazon does."

Sounds like PR fluff. Maybe the crappy nation states have poorer posture, but decent nation states tend to have decent knowledge of security principles, decent isolation of data and tenants within networks, various physically enforced unidirectional links and decent actionable threat intelligence, none of which are necessarily evidenced for Amazon by the interviewee. Additional evidence to back the claim would have been nice. I am not saying nations do not make security mistakes, they make plenty, but I am not convinced it is due to a somehow inferior or less sophisticated approach.

"They might, but ultimately the security standards of their data centers are always going to be lower than those of a cloud provider like AWS. A cloud provider has many tenants and they can have economies of scale that let them have more sophisticated security systems than someone fully managing their systems in-house."

Interestingly, the economies of scale argument, while true, cuts both ways, because there is an economic limit to securing shared infrastructure. The business model of AWS and other CSPs is to multiplex access to shared resources, thereby introducing multi-tenancy issues as well as putting more eggs in the one basket, which is much more lucrative for an adversary to target. I think a mature cybersecurity engineer should be aware of the tradeoff, seems this one is somewhat biased.

I am not sure if it is intentional, but marketing a big truck with guns may be capitalizing on conflating security with the perception of security. Can someone please explain why the truck being giant adds to security? Is it harder for it to roll over on the freeway and cause bits to spill?

I think it's intentional. The client doesn't really care about security, just the perception of security. That's why the lvl 3/5 stuff works. They can look at a 53' trailer and a guy with a handgun and it _looks_ more secure than a scp script or whatever. It's also harder to to be fired when you look like you covered your bases, as opposed to fucking up some shell command and sending your whole db to the trash.

In light of shake-ups at the US Post Office in 2020, this ... smells funny.

"The rumors that I hear, both internal and external, are that we're very seriously interested in acquiring post office real estate. The reason why the post office is valuable to privatize is because of their real estate holdings. They have great real estate in every downtown of every city in the United States. Amazon may be interested in buying all of the post office locations, and we have the cash to do it. So why not?"

There’s a big datacenter in a post office in LA. I visited it once as we rented bare metal there. Amazing building. So maybe that’s the reason? :)

Trump hates Bezos though so selling the real estate to Amazon of all people makes little sense.

So he has to wait a month?

Actually, it's common knowledge in commercial real estate circles that the USPS is trying to unload prime downtown properties.

Chicago's Old Main Post Office (so massive that it has an interstate highway running through it and 18 train tracks under it) was recently redeveloped for a bunch of tech companies.

> Interview with someone who got an internship at aws and is now parroting things they read online.

FTFY

>the company captures $4 out of every $10 spent online

This should be rephrased as it's only for consumer product purchases

It might be (coincidentally) accurate for cloud as well, if you could disentangle figures for things like O365 and Gsuite.

It's probably very high, but a lot of competitors have been gaining some market share (maybe less proportionally, since the market obviously is increasing still) too, maybe the largest two being Azure and GCP

> The second-largest private employer in the United States after Walmart

Neither company is private. They’re both public companies. This is the second sentence in the article. The rest of it sounds made up

I think the private qualifier here is to exclude governments, since the US and state governments employ a _lot_ of people.

Private as in private sector.

I used to work for AWS (2008-2014).

There are things I am not comfortable disclosing in public; however, I can tell you that most of what's written is incorrect, guesswork, or distorted from reality - e.g. the "origin" of Amazon, or the origin of AWS.

I've read enough to know that this piece is not worth reading in its entirety.

I would not be surprised if this was a PR piece. However, as an AWS SDE, a lot of this felt incredibly accurate - especially the parts about company culture and employee attitudes. I can count on one hand the amount of non-work related, non-small talk conversations that I've had.

Surprisingly doesn't read like a hit piece. It actually sounds like a real AWS engineer. There's some good about Amazon/AWS, and some bad. That's my experience and the experience of most of my colleagues.

Of course, the anti-Amazon mob will just call this a PR puff piece. But it doesn't read like it to someone who actually works in cybersecurity at AWS.

Reply on news.ycombinator.com