Hacker News Reader

Comment by toomuchtodo | Hacker News Reader

> Is there any assurance that someone can't just break into whatever facility you're housing these machines in, and walk off with all my data? Do I even know that you're going to be in business in 5 years? What happens if someone DDOSes your infrastructure?

You receive no such assurances from Rackspace, OVH, Hetzner, Softlayer, etc. They could all go out of business, anybody could walk out with your data, and if you're getting DDOSed, well, as always you're getting your checkbook out to mitigate it unless you have a very large team (in which case, why are you going with a hosting company anyway?).

OP is going for the Digital Ocean of physical machines. Treat it as such. If someone wanted assurances, they're going to pay out the nose and go with an established provider.

View on HN

Is there a reason to dismiss the question like this? It's a matter of probability: This site just appeared out of thin air as far as most of us are concerned. Yeah, Rackspace could go out of business tomorrow. But that's a hell of a lot less likely -- and more likely to happen with some sort of warning -- than a brand new provider going under (since we all know what the odds are for new businesses).

If the OP is "going for the Digital Ocean of physical machines," perhaps he should be clearer about his intentions. I personally don't think that's a reasonable assumption based on the information he's provided.

> Is there a reason to dismiss the question like this?

I'm not dismissing your questions. I'm arguing that listing information on your website doesn't mean you're any more or less capable at handling the issues you're described.

I've seen <10 people startups succeed against destructive technical challenges, and I've seen +$500 million companies completely fail on the most simple problems. QA/FAQs aren't the deciding factor (although they provide signaling to clients, both current and potential).

I have to agree with you here as you make an excellent point about QA/FAQs. It's entirely possible that the people behind this know exactly what they're doing, but from a client perspective it is a bit sketchy that there is no information other than server specs.

The SSAE 16 SOC 2 attestation would address physical access controls. At my last job with a hosting company, as an Engineer with substantial infrastructure in my local DC, I was not allowed entry without signing in and being issued a temporary DC badge. The whole industry probably isn't there yet, but auditors are cracking down on who is allowed unrestricted physical access and without that certification you cannot get big business customers.

Signing in with a badge does't prevent you from smuggling data out on a USB stick.

I've been in call centers that attempted to screen for storage devices via metal detectors and x-ray machines, but that's certainly not the norm for data centers. I know of customers of my former employer who would not provide system passwords and utilized disk encryption, but I have my doubts that their key management practices completely protected against someone with physical access. Ultimately if you're hosting somewhere that you don't control your primary defense is reputational risk and lawsuits.

If someone wanted assurances, they're going to pay out the nose

This pretty much actively discourages broad categories of potential garage tinkerer apps/startups. I suspect there's an opportunity here.

I am in agreement with you. If you're $ENTERPRISE, you're most likely not going with OP, but there is a large "garage tinkerer apps/startups" market they should be targeting until they're established.

Why use this guy's overpriced service when so many cheaper, well-established hosting businesses exist, like OVH's http://www.soyoustart.com/us/offers.xml

Because OVH's service and support are terrible. Much rather give the new guy a try.

Reply on news.ycombinator.com