It is no longer safe to move our governments and societies to US clouds

On premises.

I’m not sure what this looks like outside of the US, but colocation providers offer racks of machines, or to host your machines, while providing access to cheap bandwidth and peering capabilities. It’s absolutely possible to move away from the major cloud providers. However, it will require a degree of investment within your organization to support these deployments no matter which you choose, which could be a new investment compared to using AWS, GCP or Azure.

I guess you can say the code is still backdoored / untestable but it seems that could be audited.

Don't build them. Vendor lock-in is a real problem: even if there are no political issues, it's a business risk because they can charge you whatever they want.

Also, the cost of migrating off these things is usually overestimated. It's an HTTP request, for crying out loud.

Replace (most, not all) crusty apps with a web version - sounds good to me. Put it in the cloud - that's optional.

For hosting their government's own specific computing needs, and assuming a respectable GDP, they can build their own datacenters (pretty trivial) and hire contractors to build cloud computing environments (more challenging).

Open source cloud isn't too hard. There's OSS for about 80% of software needed for a cloud computing service provider, and you fill in the rest with proprietary and custom stuff. There's already several providers (one in the US, several in the EU/other countries) that offer "public cloud" using OpenStack. They literally give you, the customer, your own OpenStack cluster, and bill you for what you use. It's insanely easy and powerful. Yet everybody still uses the more popular providers (DO, Hetzner, Scaleway, etc), despite the fact that they all have proprietary interfaces, without anything close to feature parity with OpenStack. I guess people really like vendor lock-in and lack of features.

The hardware is more challenging to source; the chips all come from Taiwan or China, and the US and China make most of the good hardware.

For private business in their country, they might offer grants and tax incentives to EU companies to build out more local cloud hosting services. But since it's the EU I'm sure it's massively more complicated than that.

Coming from IT land, the answer is simple: you don't use them in the first place, and you grit-and-bear the replacement cost if and when the time comes. This is a negative on my research notes, slide decks, and papers when it comes to evaluating various cloud platforms for our workloads, and yet it's also the number one reason we're forced into a specific provider (some leader loves their proprietary tooling, and forces us to use it).

Look, I'm not saying these proprietary tools are bad, per se, just that they have a steeper cost than initially presented to the consumer in terms of architecture complexity and inevitable migration. The very first question you should be asking before consuming niche or proprietary products from vendors is, "Can I do this in a standard way that's more portable?" For stuff like Azure Functions, the answer is emphatically yes - but it comes at the cost of managing additional infrastructure, which is often the main reason companies want to use those tools in the first place (a misguided notion about throwing out infrastructure to save money).

As for the solved problem of compute (VMs and Containers), well, literally any cloud provider should have that ready to go. The question is whether or not your org is willing to retain the talent needed to build and support your clouds internally, or if they'd rather pay higher outsourcing costs with vendor lock-in instead.

Was that before or after 2016?

But EU citizens genuinely care about privacy, in part because of decades of totalitarian and near-totalitarian regimes.

There is another risk underpinning this, I'm not familiar with this so it's mostly hearsay on my part, but foreign firms in the US routinely get completely screwed in US courts, and fear the seizing of their data in discovery processes or other ways. The data sharing agreement was made to provide some degree of clarity or assurances in this regard.

I've met managers who are convinced that if they're not careful, their IP and business data will get stolen by their US competitors through various legal or less-legal means. EU executives have been detained for days at the border on suspicions of terrorism to coerce them into selling US assets. I can't judge if this is paranoia, and maybe those companies could make use of better protection against Chinese hackers but there's certainly some truth to that.

If those very basic precautions had been taken, migrating to a Euro cloud, or a private environment (open cloud stack) would be trivial.

If not, a lot of people should be fired...but granted, there are a lot of stupid people out there...

All that said, I'd say the concerns around this are vastly overblown.

I believe so, yes. I don't think Americans realize how profoundly the last few weeks have affected European political thought. It'll take a while before you see concrete changes. Europe is like a mammoth tanker, slow to change direction, but practically unstoppable. I believe that it's more likely now than ever before for European governments and businesses to sever their dependency on American technology. Lots of comments in this thread explain how hard this is, how big the feature gap between, say, AWS and OVH is, but as a European entrepreneur I gotta say, this looks a lot more like an opportunity than a problem to me.

Except if any of the bits are flipped you're f-d; especially so if your adversary is a nation.

That should scare everyone given his propaganda machinery aimed at elections he does or doesn’t like

Not that they're the only ones. Israel has been busy stuffing investment cash into the pockets of Unit 8200 members so they can found security software and service startups coughSnykcough

It’s the best of both worlds, they get the decades of research Google has put into systems engineering and fault tolerance while retaining the security of having their own servers.

Very few actually qualified and capable techies here trust any of the US-based cloud providers.

There are cloud environments specifically for classified info:

https://aws.amazon.com/federal/secret-cloud/

https://techcommunity.microsoft.com/blog/coreinfrastructurea...

If your unencrypted data flows through any AWS memory or compute, or if your encryption key flows through any AWS memory or compute, then AWS *can* access that data.

https://reason.com/2024/12/26/foia-for-all/

It was Ukraine/Zelensky who suggested that first not Trump. It was back in November. But we tend to forget such things for some reason...

From https://www.ft.com/content/623c197f-6952-4229-bfbc-0a96e43d6...

> Two of the ideas were laid out in Volodymyr Zelensky’s “victory plan” with Trump specifically in mind, said people involved in drawing it up. The proposals were later presented to Trump when Ukraine’s president met him in New York in September.

So Trump agreed eventually and then Zelensky started a media storm about how Trump wants take their natural resources and turn them into a colony. And everyone somehow immediately forgot that the proposal originated with Ukranian government.

> The levels of behaviors between the sides here are not symmetrical

It comes from a fundamentally different perceptions of reality and politics. There is idea that things have to be just and fair. And when they are not we like to say "it's not fair" and someone comes and fixes it. I am afraid it just doesn't work like that past the childhood age.

> American leadership made it clear that norms, laws or morality are only for suckers.

When weren't they? You're thinking maybe everyone just finally woke up? Morality and laws do not apply in practice on the international arena. It would be nice if they did, I agree, but they don't currently.

EU should have always had it's own strong army, it should have never trusted the US and not relied on them for protection. But they also shouldn't have been buying energy from Putin and funding his operation for years.

> trying to turn Ukraine into basically colony (by demanding their resources forever)

Keep in mind it was Ukraine that proposed the idea of offering their resources back in October 2024[0]

0. https://www.cfr.org/expert-brief/zelenskyys-victory-plan-ukr...

However there can be weirdness sometimes. I vaguely remember a case where Microsoft had to hand over EU data to a US law enforcement agency due to a court order, but giving that data would violate Irish law. I know there's a new variant of the EU-US Privacy Shield, but with the current US administration that could get ignored very easily.

Which raises the question: can for example Microsoft-the-US-entity in de jure sense cleave off Microsoft-the-EU-entity whilst still maintaining de facto connection between the two? If not, there are definitely big opportunities abound.

Like, the conversation will go, "Get us this data"; "EU law says we're not allowed to"; "We don't care, do it or we shut you down."

As someone with an infra background a lifetime ago, I am confident I could spin up Kubernetes and Deepseek R1 in OVH or Hetzer within a few days. The primitives exist, the EU simply needs to lean into cultivating and supporting them (orgs, platforms, etc) to push EU entities consuming these services away from US Tech. Perhaps the tech stack is a national security interest, just as a manufacturing base and supply chain is. Better to be prepared than to be entrenched in the US Tech ecosystem and then suddenly be held hostage for reasons.

For example, Hetzner has great potential, but they’re only just now releasing object storage after 4 years in the cloud space, and they don’t even have managed database yet.

Thank you! As a german that saw how the sauce is made in public sector tenders it's exactly this!

This is not restricted to hosting / cloud sector. It's a good summary for most german IT companies.

Arrogance and incompetence are rampant. Programmers and their managers need to go en masse to have some substantial change.

Everyone is so full of themselves and disconnected from reality it's scary.

The brain drain ultimately takes it toll. The most capable people from europe ( and every where else), move to US , be they engineers, management, entrepreneurs etc.

Given that for today's election here in Germany actual problems barely played a role. Not just that, over the last two decades very little was done. For example, we have skyrocketing rents due to a general lack of housing, which leads to all kinds of problems apart from affordability. For example worker mobility. Who dares to move to another job and city when it's so hard to find a flat?

That's par for the course for almost all big problems.

I think the probability is high that the new German government is going to try to sit this one out. After all, they survived Trump the last time, and it's only four years, right? Worse, they would have to do many things that will be very unpopular with one or the other interest group.

Unless somebody puts a gun to the heads of all those in government they will procrastinate rather than make any big changes.

I see little chance that they will cancel the order for US military hardware. They might actually buy a lot more, to appease Trump. After all, not getting the F-35 would have repercussions for the nuclear sharing agreement with the US. They need the F-35 to have a certified platform for nuclear bombs they are supposed to get from the US, stored in Germany for that purpose.

That would mean they would need a European approach to nuclear weapon sharing and weapons. The German government regularly has trouble even just to work together with only France, due to wildly different philosophies and interests.

Europe is far too divided, and the German government sees its role in doing as little as possible when it comes to radical change.

I think part of it is that the leadership of all our big parties mostly consists of politicians whose whole life is just that. They don't have anything else. Even if they get a job at a company it's for their political connections. They won't risk this, and they barely have any strong opinions! They look at polls and change what they stand for accordingly and easily. I'm not saying this to sound mean, I think that this is a mostly accurate description.

Opposing the US would take spine! It's a lot of trouble and uncertainty. They will try to avoid that if at all possible.

----------

By the way, it's not just F-35. Germany also ordered the Israeli-American Arrow 3 long-range missile defense system, sixty CH-47 Chinook, and 380 other contracts worth 23 billion just from the "Sondervermögen" (special fund) of 100 billion. Surely that will just become more, given that Germany continues to need to purchase things like Patriot missiles.

The strategy was - to the chagrin of the French if I understood the news articles written at the time right - to rather buy something proven and quickly available from the Americans rather than start a lengthy inter-European development process.

It is this generation's F-16, many thousands will be built and sold.

(as of this comment, Bluesky has ~32M users and counting)

We just need to see if phpbb can scale to a billion, and if not, why not.

Microsoft will be tough to replace. There are good alternatives, but retraining personnel, etc. will take years. Google, I am not sure. Their cloud services are replaceable. Search may be tougher, but the quality of Google Search has become so bad that it's often easier to ask an LLM.

Being US startup with English only you have access to 300m people right away.

There were country specific social networks but then all cool kids were on FB so everyone moved there.

The same with LinkedIn, our country specific business social network closed down finally last year. First 3-5 years it was growing then everyone moved to LinkedIn so that network was ghost town for 15 years someone kept it alive just in case but seems like they stopped wasting money.

https://joinmastodon.org/about

(So is SAP, for that matter.)

(I’m not disputing the chances, just the logic of the analogy with Airbus.)

I think it'd be faster and cheaper to replicate GitHub or even Office, which are complex but fairly feature-stable, than to offer a real cloud competitor with a fraction of the services that Amazon, Microsoft or Google offer in their cloud portfolios.

I heard an interesting thought on the Lex Friedman podcast though. If software engineering really becomes cheaper and more readily available thanks to AI, maybe more companies will start building more of their own services. Then, maybe then, will the European enterprise be able to wean itself off from the big cloud vendors.

Are there good resources for comparing clouds with sovereignty in mind?

So yeah, not my favorite of the whole "not my favorite" cloud migration plan, but the only realistic path forward at the time

The only good providers I'd use again are London based.

Some of the long-term consequences are permanent: everyone in Europe unambiguously knows that the post-war dynamic is gone, and if they invest in their own alternatives they won’t want to throw away that investment. As an example, allies who bought F-35s are wondering if they should’ve followed the French path now that they’re faced with the prospect of being on the other side from America. If they decide to move to European control of key infrastructure, they’re not moving back for at least a generation.

Does it really matter?

If large Western countries want to spy on each other, there are so many ways via so many devices.

That's why I'm talking about safeguards -- why not just focus on ensuring everything is encrypted in rest and in transit, so you can use anybody's cloud anywhere?

Note that this is largely the case for any bank where you're not a native to their country - because of the Common Reporting Standard. However the US asymmetrically applies FATCA instead of the CRS.

https://en.wikipedia.org/wiki/Common_Reporting_Standard#Mult...

"The U.S. receives information relating to US citizens' accounts from many countries due to the compliance requirements of the FATCA. The United States, in many cases, will reciprocate by sharing banking data with countries for accounts which their citizens hold in the U.S., but not automatically, as is required by the U.S. in FATCA."

This makes serving US citizens in an "average" financial institution an added burden that might not be considered worth the cost.

I find Europeans to be particularly annoying because they've willingly turned themselves into de-facto vassal-states without even realizing it, and despite constantly panicking over the outcomes of internal American politics they never learn their lesson or take any real steps to become less dependent on the United States.

I'm pretty sure I remember the exact same conversations about whether it's safe to host data in America eight years ago, because they haven't changed at all. I happen to think they're over-reacting and that Trump isn't going to do anything with their precious data, but they're well within their rights to have negative opinions about internal american politics. However it's also incumbent upon them to understand that they have no standing in who the American people elect, and that if they don't feel safe not being America's #1 priority they need to become more self-reliant. Europe is not the center of the world to us, they're just another one of the six continents that aren't North America.

[1]: https://www.gutenberg.org/ebooks/57037

https://web.archive.org/web/20160304023516/https://www.claud...

It's a book he wrote about how to maintain power in a feudal society, with references to many historical events to back up his arguments. Usually it comes down to being wary of accepting help from somebody else unless you understand their motivations, what they stand to gain, and what you stand to lose in the long run. It's sort of like "Art of War" in that it's written for a specific time and place but the principles behind it are so universal they can be applied to many different situations, even business management and interpersonal relationships.

So anyways, my point in the OP above was that this is the sort of situation that he wrote extensively about; obviously there weren't any computers or cloud storage in 15th-century Italy, but he definitely makes several points on the dangers of relying too heavily on third parties for resources, because it gives them leverage with which to manipulate them.

[1] https://theloop.ecpr.eu/the-cancelled-elections-and-the-main...

There's countless examples of countries trying to influence the elections of others. I'm from the UK and a notable example that comes up here was when the US president threatened Brits that the UK would be put on the bottom of the list of trade talks if they voted Brexit.

And just recently nearly 100 staff from the UK government were supporting Harris in the US presidential election.

I'd also argue that propagating this idea that people are too stupid to see through the lies and interference in an election undermines the point of democracy. If we cannot trust people to make sound democratic decisions, then why do we even support democracy as a political system? In a democracy sometimes people will be misled. You need to trust that people will ultimately make the right decisions.

But sure, they could have specified something to the effect of "if a browser specifies (though current technical means) that the user is DNT they should follow that" but there was lobbying from the advertisers and other parties as well

Back then, the powerful force was resentment, and honestly, they had good objective reasons to feel that way, too, given how the 90s were in Russia. It didn't make their choice any less misguided, though.

2024 in US felt familiar.

There is no free speech protection in any EU country.

DCMA is overlooked but it's hugely beneficial for US companies and means they're not liable for what their users publish/write on their site. In Europe you have to staff moderation teams to remove defamatory content etc or become liable to be sued yourself.

They always seem to have imagined themselves to sit halfway across the Atlantic instead of a few miles off the French coast.

I'm willing to bet against both the military support for Russia & the NATO dissolution at 4:1 odds before end of this year and 2:1 before end of next year.

I don't think anyone serious actually thinks either of those things are going to happen so I doubt anyone would take me up on that offer.

I think the 'majority' were always like that, though I think in the recent years the proportions became higher.

I guess this reality has never reached the leaders of the EU apparently. Trump was in power before and also threatened to leave NATO yet the EU countries did not prepare for this at all. They had 4 years of Biden to do so but alas they simply waited and wasted time.

> The disturbing thing is how the current administration blamed Ukraine for the war, sees Putin's Russia as an ally, and actively wants to destabilize EU by supporting pro-Russian forces inside it.

You find it disturbing because you are missing the forest for the trees.

China is now very tightly coupled with Russia and Iran. The biggest threat to US hegemony is not Russia, not by a mile. China has the means, the power and the will to start asserting itself on the global stage. On the other hand Russia struggles to hold on to a 5th of Ukraine.

Trump wants to split Russia away from China and is willing to give up on Ukraine in order to make this happen. It's that simple. Russia has huge swaths of raw minerals, fossil fuels, lumber and so on that China needs in order to expand it's economy therefore it makes complete sense to try to slide a wedge between them in order to isolate China.

In this game of Geo-politics, Ukraine and the EU are just pawns that can be traded/pushed around because they have barely any weight in the global order.

You can be mad about this but if you do you should be mad towards the EU leaders from the last 30 years who instead of building a robust industrial base, sent all their jobs abroad, who instead of building a army that could resist an invasion, relied on the US protection without even reaching the minimum NATO investment threshold year after year.

The EU countries made their bed and now they are struggling because most of them are broke, their economies are in the gutter and are slowly crumbling.

> All this is not so hilarious for me, living next to Russia and wondering if they will invade us within next 5-10 years, and whether we will receive any help from abroad when Europe seems to become increasingly pro-Russian. What is happening now is potentially a matter of life and death to us.

This is a weird take. On one hand Russia, is not even able to conquer the whole of Ukraine but somehow it has the capability to steamroll over all the Baltic states? So which one is it, is Russia a paper tiger or an unstoppable force?

Both can't be true at the same time.

Inertia is a big thing, but with many open source products and UX, I'd say that quality is often a similarly big if not bigger factor.

The US is basically the only country with good free speech laws. I am not saying they’re perfect, but I’m not sure what your argument on that point is. Can you share something more specific and explain how it invalidates the American constitutional protections on free speech?

> And the AfD is full of enemies of the constitution and that’s illegal as a party in Germany.

You either have a democracy where people can choose their leaders or you don’t. It appears Germany doesn’t. Preventing a party that is popular, from existing or participating in elections, is literally authoritarian and anti free speech by definition.

> Bringing in a UN resolution that lacks the part where Russia is the aggressor in the war with Russia.

What do you call the illegal coup in 2014? It removed the representation of everyone in Crimea and Donbas right? What about NATO expansionism? The aggressor isn’t very clear. I would argue that the 2014 coup and efforts to suppress Russian ethnic people in Ukraine was an act of aggression that eventually led to this conflict.

> Blackmailing a country that fights for survival to get rare earths.

This framing just shows how thankless it can be for America to help Europe. Asking for something fair in return for hundreds of billions in defense and security funding (not just in this conflict but for a much longer time), especially since it helps remove China’s rare earth control, is reasonable. It’s not blackmail to propose a fair deal. Ukraine and Europe are also certainly free to refuse the deal and not expect American taxpayers (whose pocket this comes out of) to help them further, considering they’ve already done so much.

https://archive.is/C08bk

They don't care at all about the provider being a local or European company. They just want the cheapest option.

Which usually means using the same server to host dev/UAT/prod, and also using the extra storage available to store company data unrelated to the workloads hosted on the server.

Whereas the companies that are using big clouds are more focused on doing things with more care, and trying to avoid as much disaster as possible.

But I guess having PII data exposed on the web from an Hetzner server is better than having everything encrypted on AWS...

I'd love to have a good Google Docs alternative. No one has made one. Nextcloud is the closest we've got, and I use it sometimes, but it's pretty bad.

It's a lot less hard to build in 2025, and hopefully, someone will now.

I just checked a handful but didn't see any.

Governments are too short termist to care. Its probably OK for the next few years so keep it cheap

The danger is not just governments. Its businesses, and even consumer systems. If another country can brick all your vehicles or look through all your spy cameras or take down your telecoms then they have a great deal of power over you.

This will only change after something happens.

A useful resource: https://www.csis.org/analysis/cloud-act-and-transatlantic-tr...

How many tanks can you deploy? IFVs? Artillery? How much ammunition can you supply? How many fighters are in service and mission ready? Bombers? Tanker aircraft? Transport? Helicopters? How many battalions (of any type) can be formed/deployed?

Repeat the same exercise in the context of a navy.

https://www.statista.com/statistics/584035/defense-expenditu... https://www.statista.com/statistics/1294391/nato-tank-streng... https://www.statista.com/statistics/1293688/nato-aircraft-st...

I have my doubts, without the US NATO is largely toothless IMO.

It’s a widely common practice:

France had kill switches in its export Exocet missiles - why wouldn’t the US have also kill switches in its export equipment?

It would actually be strange if they were absent.

https://www.reddit.com/r/europe/comments/ui54r7/france_urged...

Really?

The EU limits explicit calls to violence, genocide denial, and coordinated disinformation campaigns.

Meanwhile, Russia imprisons people for holding blank signs, China censors Winnie the Pooh, and Hungary closed its last independent radio station.

Don’t you think your standards for what free speech is could be slightly different, depending to whom they apply?

Speaking of speech control - how many Russian journalists have mysteriously fallen out of windows recently? …or is evidence only required for Western claims?

1. France used constitutional processes for the Lisbon Treaty - or should we never adapt treaties as circumstances change?

2. Chat Control (wich I don’t personally agree) is being debated, modified, opposed - that's democracy in action. Try publicly opposing surveillance laws in China.

3. Refusing to coalition with anti-democratic parties IS protecting democracy. Just like we don't let parties run on platforms of abolishing elections.

Democracy isn't just counting votes - it's sustaining a system where we can keep voting freely. That's why we have guardrails.

Or would you prefer we just have one final vote to end all voting?

The way out of this is not expecting consumers to install fdroid. It’s putting in place proper regulations to preserve privacy and security for EI societies.

It seems like this is not on the horizon yet. And in the times of AI, it would probably result in a huge productivity hit.

Why the hell not?

From a technology perspective (i.e., data/information theory/performance/what HN should be about), MSSQL is really, really hard to beat in a big enterprise ecosystem. This isn't because of decades of prerequisite evil dealings that make it a morally incompatible offering, but because it's been so thoroughly exposed to every possible use case that yours would certainly flow nicely.

I've been watching a lot of otherwise really compelling ideas and high energy teams get turned into complete shit due to these ideologies. I can understand a EU tech startup being hesitant toward US-based technology, but in 99% of the cases I hear about, it's a purely American tech company with zero international presence that is making a bunch of noise about how much they hate whatever domestic/paid/"closed" offerings.

Google collects 20 times more telemetry from Android devices than Apple from iOS (therecord.media)

816 points by gormandizer on March 30, 2021 | 445 comments

https://news.ycombinator.com/item?id=26639261