I bet in the end it was not really such a disadvantage for all the OnDemand customers: Imagine they had the two data centers: The log shipping Joel "sold" us would have had a nasty side effect: If someone makes the call to do the switch over, everyone would have lost the last few hours of work!! All customer mail, all bug events would be gone.

Well one could say that in the particular case it might have worked out: They knew about Sandy in advance and had a bit of time until the lights went out. But if it happens unexpected, it's a tough call to make: Keep it running or keep the last data since the last log shipping?

If on the other hand they had gone with Sql mirroring, it's likely that there would have been quite some outage just because of the mirroring: If one of the two data centers went down, the whole system would be down, it's often like that with failover systems