Hacker News Reader

Comment by tjr | Hacker News Reader

I have seen companies have rules about (or against) cloud computing in general. I remember when decent web-based translation services first came out, and the guidance from BigCorp was to not use them for anything work-related.

From what I personally have seen, this sort of guidance remains. When companies do use things like Google Docs or Microsoft Office365, they likely have some specific contract in place with Google / Microsoft / etc., that the company's legal team has decided they are happy with.

I anticipate that the same will eventually be true of ChatGPT and such, that there will be some paid corporate offering with contract terms that make the company lawyers happy.

Most of my career has been with larger companies, often with high data sensitivity; I can easily imagine that some smaller and/or less data-sensitive companies might not care about any of this.

View on HN

I work for a company who for a very long time was strongly opposed to employees using any cloud-based infrastructure, including OS or programming language package managers (eg. apt-get, Pip for Python, etc), opting to host their own instance if possible and disallowing usage if not possible. IT did finally cave and switch to Office365, which has been slowly opening the floodgates to other services being allowed.

The gets into some really interesting corporate governance issues.

The cloud is a terrible bet for many large companies. The benefits are minimal while the risks are huge, however what’s in the best interest for the company is only tangentially related to what happens.

It’s really difficult to ensure companies actually take low probability risks seriously. A 1% chance to lose 10 billion dollars is an easy bet for upper management to make when their personal risks and rewards don’t line up with the company’s risks and rewards.

As somebody who is completely puzzled why you could think that the cloud is a terrible bet for many companies - are these companies allowing their employees to use Google Search or other parts of the internet or do they have to look up things in paper books in the corporate library?

Let’s not pretend Google search is what people mean when they say “cloud.” It’s about running internal processes on external systems.

As to the risks, many companies live and die by their internal secrets. These range from a private keys, customer lists, trading strategies, and similar trade secrets to actual serious R&D efforts.

Sometimes the damage is obvious such as crypto exchanges suddenly finding themselves broke, but corporate espionage can also be kept quite. Losing major government bids because a competitor read some internal memo’s is a serious risk and you may never know.

Again, how do you know that somebody doesn't put something sensitive into the Google Search bar?

While theoretically possible for something bad to happen, short phrases are much less likely to have actionable/sensitive info in them than the full document corpus of a company.

The actual history of companies losing secrets.

It’s much harder to reconstruct actionable intelligence from a huge stream of people using Google search even if they’re using it to preform sensitive calculations.

How many companies do you think have people who know security as well as Azure, GCP or AWS (disclaimer: my employer)?

What percentage of companies do you think actually use AWS securely?

There’s plenty of high profile fuckups from people falling to AWS specific gotcha’s.

This is already in the works. Microsoft offers an Azure GPT4 service for business. They already offer a business version of CoPilot as well. I have not gone over the details but I imagine the usual business and support agreements will be in place for the business tiers.

Reply on news.ycombinator.com