Hacker News Reader

Comment by zxcvbn4038 | Hacker News Reader

This article is kind of depressing, when did hosting your own server become a lost art?

One of parler’s problems was they didn’t scrub headers which made it very obvious they were using AWS and which AWS services they were using.

AWS is just a bunch of APIs - they could have colo’d their front end or put a bunch of varnish servers in front if it at a colo and nobody would have been the wiser they were using AWS on the backend (assuming their AWS account didn’t have Parler Inc in the payment details). From there getting taken down from one colo would just be an issue of spinning up a front end at another colo. Front that setup with a couple CDNs and now you have layers where you have to coordinate between half a dozen companies to bring the site down completely, meanwhile your data is safe in AWS because nobody knows your using AWS or even if they do it’s hard to pick you out from the millions of other AWS users.

View on HN

Yep, the amount of incompetence in Parler's case is just mind-boggling.

Their failure to make it cloud agnostic being 1 (even though they claimed before they went down that their app could run without AWS without issue).

Their failure to be incapable (still) to get it running again on non-cloud hardware..

And of course their inability to, as you suggest, move the frontend routing to a CDN/Cloudflare/DDosguard type service and have all the heavy lifting continue to be done via AWS/Azure/Google till you can run 100% on your own hardware.

Maybe they didn't think they needed to. Before a few months ago, you didn't yank someone off your network because you didn't like their politics. (yea yea, terms of service something or other)

> Before a few months ago, you didn't yank someone off your network because you didn't like their politics.

AWS dropped WikiLeaks as a customer back in 2010 for political reasons, and apparently this was announced by a US senator even before AWS did so themselves:

http://edition.cnn.com/2010/US/12/01/wikileaks.amazon/index....

Cloudflare and Daily Stormer is another good example. The mistake there was the implication that Cloudflare was endorsing the stormer rather then being a neutral carrier and Cloudflare shut down that idea quickly. I have to applaud them, it’s hard to be neutral in the US, everything is “with us or against us.” People watch too many gangster movies I think.

Not that my company will produce anything as controversial as Parler but I now use this example to explain why we go the extra mile with things (e.g. scrubbing headers). Sometimes the worst-case scenario really does come true.

> Yep, the amount of incompetence in Parler's case is just mind-boggling.

Parler's case has zero to do with incompetence, and it boggles the mind of how suddenly putting together web apps with bare metal servers is somehow depicted as normal or usual or basic competency skills. It isn't. At all.

The majority of the world's web apps are hosted by one of the four major cloud providers. AWS alone hosts about 1/3 of the world's websites. The only reason anyone ever had to move away from AWS ever was due to their high prices, and even then the decision was always to move to another major player.

Hell, whenever I point out that there are bare ones cloud service providers which are far cheaper.than AWS, such as Hetzner, I'm faced with at best an industrial dose of skepticism.

Let's face it: up until now there wasn't any reason at all to even consider hosting your startup app on a non-major cloud provider. At all. In fact, it's tremendously hard to argue using anything beyond them. You need scale on-demand, high-availability, and reliability. You do not get any of that by even picking most of the non-major cloud providers, let alone running bare metal servers.

Post-facto accusations of incompetence are not justifiable, specially when criticising the undisputed go-to rule that driver over half of the world's websites.

> bare metal servers is somehow depicted as normal or usual or basic competency skills. It isn't. At all.

Just calling them servers is sufficient. I don't know when this "bare metal" crap started

Standing up a service is a basic competitancy

AWS publishes which IPs it owns, so scrubbing headers is not enough for secrecy. (Not that doing something that relies on secrecy is a smart plan for a business, anyway.) https://isitonaws.com/

Using your own ips works against you anyway - it’s easy for someone to backlist your ip range to keep people from seeing content that they don’t agree with. However blacklisting all of AWS, GCP, or Cloudflare breaks so many things that nobody does it - and that would be the same for any large CDN. DNS is still an issue but increasingly less so since all the work being done to bypass censorship by authoritarian regimes (aka keeping people from blocking internet ads) works just as well for controversial content.

I think you can bring your own public IP assignments to AWS. Wouldn't that do the trick? I mean, there's always tracerouting, I suppose.

You can‘t transfer single ips to aws, only complete networks. And then this networks is limited to a single region.

So it sounds easy, but is only usefull for companies with multiple networks. But even then i guess aws is publishing that they handle your networks.

> AWS is just a bunch of APIs

This is a gross oversimplification of what AWS is. For starters, no one pays for AWS for the APIs. People do pay AWS for the on-demand infrastructure, and the global network of datacenters, which makes it trivial to setup a highly-availiable web application distributed globally. AWS allows you to put your highly-availablr global application together by click-click-clicking on dashboards, run AWS-specific infrastructure-as-code scripts, or run third-party scripts like Pulumi. In the process, APIs don't play any role in the decision process.

Actually my assessment it is spot on. AWS is just a bunch of APIs, you don’t need to be inside a VPC to use them, you can call them from anywhere. If you wanted to hide your usage of AWS you could stick a varnish server in Digital Ocean or any other cloud or colo provider and have it make signed requests to your S3 bucket, or lambda, or a traditional load balancer fronting http servers. People might know or suspect you were using AWS but if they can’t tie you to specific account then it’s hard to get you shut down. It’s always possible that someone could bribe someone at your CDN or colo to lookup origin ips but even then you could plan for that and put your data stores in a separate account so that even if your http server account is shut down, you can spin up another AWS account for the http servers and your back in business.

From a technical standpoint I think half the fun of working for Parler would have been evading the left’s efforts to take them down. I don’t know who they hired for technology but they lacked spirit in addition to fundamentals! ;)

Reply on news.ycombinator.com