Hacker News Reader

Comment by sfifs | Hacker News Reader

It's standard practice for any retailer to not use AWS.

Part of it is why would you want to give any competitive knowledge to Amazon with your data or even metadata assuming you encrypt data with your own keys (eg. # of users derivable from # of distinct home/mobile IP address connections to your servers, # of transactions from connections your servers make to payment processors etc).

The other part of it is why add to Amazon's profit margin when it's well known AWS likely subsidizes retail to a large extent.

View on HN

I'm curious what kind of access Amazon would have to your data as a retailer running on AWS.

Not in a technical sense, I'm a software engineer, I understand what data _is_ there, but more to the extent of, do they go out of their way to identify you, an AWS customer as a retail business and use that _retail_ data in ways such as described by the original complaint here?

If the answer is anything other than "they definitely don't", I'm concerned.

Nobody can know for sure. Whether or not they were secretly mining data from AWS servers, they would say they don't and nobody on the outside would be able to tell. Even if it's unlikely, many people are simply choosing not to risk it.

This is at the level of a conspiracy theory right now, and one that doesn't even make any sense.

If it were true that Amazon were taking sneaky peeks at data inside AWS related to retailers, and this became public, AWS as a business would be done.

The loud banging you'd be hearing would be the door closing as the last customer exited, followed by all the engineering staff who work on AWS as they see the writing on the wall.

Why would Amazon look to achieve some marginal advantage in its retail businesses at the risk of a total loss to one of its marquee businesses, AWS? It's an idiotic risk.

> If it were true... and this became public, AWS as a business would be done.

Why on earth would you think that? They did worse on their storefront, which has a much smaller migration burden than AWS, and while a few big brands made a stink and pulled out, it didn't even noticeably slow growth.

... because it's a colossal breach of trust. AWS has an entire staff of people whose job it is to convince clients that they can be trusted to be a safe custodian of data that includes heavily regulated types of data.

Doing this would blow a huge hole in that.

Do you really think banks are going to stay in AWS if this happens? Do you really think Salesforce is going to be OK with it? Do you think they'd ever do any US Govt business again?

Yes, yes (to the extent of maintaining their business relationship), and yes. I think you vastly underestimate the power of apathy. 99% of their customers won't even think about it, 90% of the customers who do think about it won't weigh its importance strongly enough to even potentially impact their decision, and 90% of the remaining customers will be satisfied with some minor deflection, platitudes, and hand-waving.

Don't get me wrong, I wish you were right, I just don't think you are.

There is no need for a conspiracy theory.

The metadata that is _required_ to produce your monthly AWS bill reveals a ton of information about the success of your business and what is doing very well for you.

Doing analytics on customer billing is something that Amazon has every reason to be doing, and what Amazon does with that information can be anticompetitive or not.

At a certain level of aggregation, metadata is AWS need-to-know for capacity planning etc or for account execs to understand the needs of their covered clients.

There's definitely room for discussion over when what level of granularity is necessary and whether metadata at different levels of granularity should be shared with product vs. customer facing teams.

That didn't seem to be what the GP comment was about though - 'mining data from AWS servers' sounded to me like a much more invasive approach to client data.

> Why would Amazon look to achieve some marginal advantage in its retail businesses at the risk of a total loss to one of its marquee businesses, AWS? It's an idiotic risk.

There's a pretty obvious way to achieve this risk mitigation which is by spinning off AWS into a completely separate company with separate management accountable to a separate board with separately traded shares and not sharing any offices, employees or infrastructure with Amazon retail.

I don't see how this would be fundamentally different from what Facebook did with WhatsApp data ?

Its always a conpiracy theory untill it happens, and then it becomes obvious all along.

People who predicted the 2008 crash used to get tinfoil hats in the mail.

> This is at the level of a conspiracy theory right now, and one that doesn't even make any sense.

It's a conspiracy theory to believe that a company whose policy it is to not access data that is on their own platform, who was caught accessing said data, would violate such a policy?

Yes, of course they do. There was a post on here about a year ago from someone in the "Amazon profitability team" that involved digging through customers AWS instances to see what they could learn or duplicate for Amazon.

I'm more than a little disturbed by that response, can you back that bold accusation up with some references?

I _need_ to read more about this (about to begin a migration to AWS, not retail though).

https://news.ycombinator.com/item?id=19734261

https://www.datacenterdynamics.com/news/ovh-ceo-unlike-amazo...

https://sellercentral.amazon.com/forums/t/amazon-literally-s...

https://fortune.com/2016/04/20/amazon-copies-merchants/

https://www.theverge.com/tldr/2019/9/19/20874818/amazon-allb...

I can't find the most recent set of posts about peering into customer's AWS instances to research what they could copy but consider that govcloud exists.

Am I missing something or do none of these links even mention AWS?

I’m also unsure how the explicit trust from the government (“consider that govcloud exists”) is somehow evidence for their untrustworthiness?

Thank you for the effort of posting those. Unfortunately they don't really indicate any data being taken from AWS specifically, all of the copying behaviour appears to be Amazon storefront copy-cat tactics.

As for govcloud, it exists because regulatory requirements for running things for gov are more strict than your average user/business requires and such cloud offerings require certain levels of hardening and software security and assurances. I happen to work in the space so I understand the need for an alternative offering for government requirements. There's really nothing nefarious going on there and its more about govs not wanting to run alongside regular users. I see nothing concrete I could take to my superiors.

Source please?

Reply on news.ycombinator.com