Hacker News Reader

Comment by primitivesuave | Hacker News Reader

Is there any assurance that someone can't just break into whatever facility you're housing these machines in, and walk off with all my data? Do I even know that you're going to be in business in 5 years? What happens if someone DDOSes your infrastructure? There is hardly any information on the landing page, let alone answers to questions like these.

There's really nothing differentiating this service other than metrics, and I wouldn't show this as a hosting option to my clients because of how little information there is about it. I'm not trying to put you down, just giving some real-world perspective on what your potential users are looking for.

View on HN

What happens if someone DDOSes your infrastructure?

Dealing with DDOS would be, for me, a killer differentiator. Most hosting providers will "just nullroute you" and fairly quickly kick you off their sites when people decide to consistently DDOS you. This makes life very hard for multiplayer game startups, as games are a part of the online world where DDOS is very common and doesn't even need a profit motive. A game implementer either ponies up $$$ for enterprise level DDOS, or ends up trusting providence and luck. This is especially true if a startup is trying to do something that confounds expectations in an existing genre in a major way.

Actually, dealing with DDOS combined with low latency to everywhere would be the killer combination of features that differentiates such a site. (You'd have to do this with an MMO app framework that actually maintained different instances in different geographic locations, and transparently switched most of your users between them.)

> Is there any assurance that someone can't just break into whatever facility you're housing these machines in, and walk off with all my data? Do I even know that you're going to be in business in 5 years? What happens if someone DDOSes your infrastructure?

You receive no such assurances from Rackspace, OVH, Hetzner, Softlayer, etc. They could all go out of business, anybody could walk out with your data, and if you're getting DDOSed, well, as always you're getting your checkbook out to mitigate it unless you have a very large team (in which case, why are you going with a hosting company anyway?).

OP is going for the Digital Ocean of physical machines. Treat it as such. If someone wanted assurances, they're going to pay out the nose and go with an established provider.

If someone wanted assurances, they're going to pay out the nose

This pretty much actively discourages broad categories of potential garage tinkerer apps/startups. I suspect there's an opportunity here.

I am in agreement with you. If you're $ENTERPRISE, you're most likely not going with OP, but there is a large "garage tinkerer apps/startups" market they should be targeting until they're established.

Why use this guy's overpriced service when so many cheaper, well-established hosting businesses exist, like OVH's http://www.soyoustart.com/us/offers.xml

Because OVH's service and support are terrible. Much rather give the new guy a try.

Is there a reason to dismiss the question like this? It's a matter of probability: This site just appeared out of thin air as far as most of us are concerned. Yeah, Rackspace could go out of business tomorrow. But that's a hell of a lot less likely -- and more likely to happen with some sort of warning -- than a brand new provider going under (since we all know what the odds are for new businesses).

If the OP is "going for the Digital Ocean of physical machines," perhaps he should be clearer about his intentions. I personally don't think that's a reasonable assumption based on the information he's provided.

> Is there a reason to dismiss the question like this?

I'm not dismissing your questions. I'm arguing that listing information on your website doesn't mean you're any more or less capable at handling the issues you're described.

I've seen <10 people startups succeed against destructive technical challenges, and I've seen +$500 million companies completely fail on the most simple problems. QA/FAQs aren't the deciding factor (although they provide signaling to clients, both current and potential).

I have to agree with you here as you make an excellent point about QA/FAQs. It's entirely possible that the people behind this know exactly what they're doing, but from a client perspective it is a bit sketchy that there is no information other than server specs.

The SSAE 16 SOC 2 attestation would address physical access controls. At my last job with a hosting company, as an Engineer with substantial infrastructure in my local DC, I was not allowed entry without signing in and being issued a temporary DC badge. The whole industry probably isn't there yet, but auditors are cracking down on who is allowed unrestricted physical access and without that certification you cannot get big business customers.

Signing in with a badge does't prevent you from smuggling data out on a USB stick.

I've been in call centers that attempted to screen for storage devices via metal detectors and x-ray machines, but that's certainly not the norm for data centers. I know of customers of my former employer who would not provide system passwords and utilized disk encryption, but I have my doubts that their key management practices completely protected against someone with physical access. Ultimately if you're hosting somewhere that you don't control your primary defense is reputational risk and lawsuits.

Reply on news.ycombinator.com