Hacker News Reader

Comment by anon84873628 | Hacker News Reader

Isn't Google doing some thing where they give the software stack to a local operating partner?

I guess you can say the code is still backdoored / untestable but it seems that could be audited.

From the article:

> People also fool themselves that special keys and “servers in the EU” will get you “a safe space” within the American cloud. It won’t.

The problem isn't sneaky backdoors, the problem is that the King of America can order Google to shut that thing down and Google will have no choice but to comply.

Well, the thing I was referring to isn't GCP regions with data residency requirements. It sounded like a clone of the entire stack installed on hardware owned by the customer government.

I guess the King of America could still shut down the ability to provide support updates.

Only if the systems operate in within their jurisdiction. Systems residing outside of their jurisdiction are not susceptible to the same policies and requests. Most cloud providers in international spaces provide secure government solutions that are designed around the regional policies.

That seems naive or not responsive to the comment. If the US government tells Google to shut down all international sites/servers, or it will cease to exist in the US, I don’t think “but the servers aren’t in the US” will really matter.

I also don’t think anyone can count on extra-judicial demands from the current executive branch.

Am I wrong or misunderstanding something?

Then the government of said country will just force the local company to separate from its us parent company. Don’t forget these regions/servers are usually owned by local subsidiaries.

This ^

I feel like people like to fear monger, but cloud businesses won't bend to US requests for anything that resides outside of the US.

Not really, the whole point of this type of cloud offering is that it doesn't phone home to Google / the US. Sure, it will be left to the partner to support all of it, but it can't be shut down from one day to the other.

(Googler, opinion my own)

The issue with that is that Google can be required to backdoor it, and the partner can't realistically vet updates to a reasonable level.

If Google isn't able to shut it down or providing the infrastructure necessary to keep it running in some way, why pay them at all? Whatever path towards work that you say could happen to support it in the future could just happen now instead. If that's too expensive for the customer or the local partner to consider, I have to question what this setup is even helping hedge against at all, because the whole point of it seems like it should be for the customer to be able to put in whatever work they need to up front to be able to avoid being forced to deal with it on a timetable they don't have control about in the future.

It sounded like Google was providing all the software necessary to use a cloud system effectively, including IAM. And you could get all of the other GCP services like BigQuery or PubSub etc. I don't remember what it was called though.

So that seems to be the value add. Of course the software will eventually need updates...

Have your heard of the Clarifying Lawful Overseas Use of Data Act?

In France we have https://www.s3ns.io/ which is a Google / Thales partnership, where Thales owns 90% of the company, handles the datacenters and Google provides the software and the updates without touching the servers themselves.

They are about to go live in a few months.

This is a good option IMHO, and we're about to migrate some of our workload (currently 100% on AWS) on it.

We use EKS, RDS on standard PG, SSM and S3. S3 is a standard now, SSM can be replaced by something else fairly easily, EKS and RDS are just managed open-source software. So it's mostly an added burden on the devops side.

What happens if Google is no longer allowed to provide software updates due to trade restrictions, sanctions or executive orders? Does Thales have a copy of the source code and the capability of keeping it up to date themselves?

In France, this is https://www.s3ns.io/en

Reply on news.ycombinator.com