Welcome!

Cloud Security Authors: Pat Romanski, Liz McMillan, Elizabeth White, Zakia Bouachraoui, Yeshim Deniz

Related Topics: Agile Computing, @CloudExpo

Agile Computing: Article

Cloud Computing & Privacy: Would You Trust Amazon?

Do you trust [the computer landlord] not to let the bad guys (such as the police) into your machine?

David Crossland's Blog

The Guardian recently posted an article quoting Richard Stallman on cloud computing. If a user wants to use network applications in freedom, they can do their own computing on their own computer with their copy of a freedom-respecting network-accessed program if their computer is a network server. Is this a good idea? Yes, I think so.

While this is not the common vision of “cloud computing,” I think that is what critics of “cloud computing” like autonomo.us should be enabling people to do.

Amazon offers a popular “elastic cloud computing” virtual server hosting service, where users upload a GNU/Xen-Linux system disk image which is booted but for which bandwidth, storage disk and processing power is ‘elastic’ - can scale arbitrarily, and on demand. I have not used this service, but I hear it is very simple to use with a pre-configured disk image.

I wonder if putting a system disk image together for services like this, consisting of only free software suitable for the common tasks people use proprietary cloud computing for, and that is configurable with a simple ‘installation wizard,’ would be a good way to provide a practical alternative to cloud computing?

These common tasks seem to be e-mail (Microsoft Hotmail, Google Mail) calendars (Google Calendars) collaborative authoring/spreadsheets (Google Docs) task management (37signals BaseCamp) and blog/status/photo publishing (Blogger/LiveJournal/WordPress, Twitter/identi.ca, Flickr/Picasa, and omnipotent Facebook). The programs behind WordPress and identi.ca seem to show the way forward with “federation” features that allow users to run their own programs while benefiting from the ‘network effects’ typical of centralised services.

Running your own cloud usually means renting a virtualized computer. Or renting a physical computer, or renting space in a telehouse rack with your own physical computer, or leaving your desktop computer turned on 24/7 and connected via residential DSL with a static IP address as Chris does - but I don’t think there is any real difference in terms of freedom here.

This is typically seen as very complex, but I think services like Amazon make it much easier than it used to be.

Renting a computer brings up another issue though, which Richard Stallman brought up with me when I asked him about this: “Do you trust [the computer landlord] not to let the bad guys (such as the police) into your machine?”

I am not sure how to answer that question, and my uncertainly is summarized as: would you trust Amazon?

A small personable and ‘trustworthy’ ISP seems just as vulnerable to haxor attacks or surveillance requests from the state as a large corporate ‘faceless’ ISP to me.

I also wonder about why any bad guys would want access to a personal network server any more than a laptop. Simple vandals trawl the net for unpatched servers (and laptops…) but a personal network server would have a simple authentication lock that would adequately prevent such vandals from accessing out of date server programs.

Obviously the state wants to get into machines to fight crime, and as I’m not a criminal that’s okay - but it also wants access to fight political dissent, and as an activist I am wary about that. But the simplest, cheapest and most common way for the police to get into a machine and to stifle the operator’s dissent is to seize it. People who meet active stifling of their political network activity, say like The Pirate Bay, adequately mitigate that with backups in multiple jurisdictions, so that when any server is seized, another is put online within in a few days.

If the state wants to have covert access without disconnecting the machine, that also seems straightforward, although more expensive; the way the UK surveillance law works, citizens made complicit in surveillance activity (eg, being forced to reveal crypto passwords) face up to 2 years in jail if they tell anyone about it. And police ask ISPs for things without forcing them and ISPs routinely bend over; I suppose thats the difference between a small personable company and a backstabbing corporate one. And for unlawful forced access, I think it is impossible to totally secure against that, since individuals acting alone have annually gained illicit root access to governmentally-secret computers the last 30 years.

But getting into machines covertly seems unnecessary; the tap is better done ‘upstream’ at the network switch. And it's well known that spy agencies have total access to all network traffic with systems like Echelon and Carnivore. (So if I was involved in political dissent forcefully opposed by the state, then probably I would avoid using computer networks. The Unabomber did alright that way… ;-)

I agree it is good to mention this issue when publicizing the problems of cloud computing. But it seems to me that in the current political climate the answer to the question is always, “I do not trust the computer landlord not to let the bad guys (such as the police) into my rented machine, just by asking.”

Yet avoiding cloud computing with programs you control but on servers you rent does not do anything to help resolve this.

Creative Commons License
This article by David Crossland, except the quotations and unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Share Alike 3.0 Unported License.

More Stories By David Crossland

David Crossley is a post graduate MA Student in Typeface Design at the University of Reading in the UK.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


IoT & Smart Cities Stories
At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throug...
The platform combines the strengths of Singtel's extensive, intelligent network capabilities with Microsoft's cloud expertise to create a unique solution that sets new standards for IoT applications," said Mr Diomedes Kastanis, Head of IoT at Singtel. "Our solution provides speed, transparency and flexibility, paving the way for a more pervasive use of IoT to accelerate enterprises' digitalisation efforts. AI-powered intelligent connectivity over Microsoft Azure will be the fastest connected pat...
As you know, enterprise IT conversation over the past year have often centered upon the open-source Kubernetes container orchestration system. In fact, Kubernetes has emerged as the key technology -- and even primary platform -- of cloud migrations for a wide variety of organizations. Kubernetes is critical to forward-looking enterprises that continue to push their IT infrastructures toward maximum functionality, scalability, and flexibility. As they do so, IT professionals are also embr...
CloudEXPO has been the M&A capital for Cloud companies for more than a decade with memorable acquisition news stories which came out of CloudEXPO expo floor. DevOpsSUMMIT New York faculty member Greg Bledsoe shared his views on IBM's Red Hat acquisition live from NASDAQ floor. Acquisition news was announced during CloudEXPO New York which took place November 12-13, 2019 in New York City.
In an age of borderless networks, security for the cloud and security for the corporate network can no longer be separated. Security teams are now presented with the challenge of monitoring and controlling access to these cloud environments, at the same time that developers quickly spin up new cloud instances and executives push forwards new initiatives. The vulnerabilities created by migration to the cloud, such as misconfigurations and compromised credentials, require that security teams t...
The graph represents a network of 1,329 Twitter users whose recent tweets contained "#DevOps", or who were replied to or mentioned in those tweets, taken from a data set limited to a maximum of 18,000 tweets. The network was obtained from Twitter on Thursday, 10 January 2019 at 23:50 UTC. The tweets in the network were tweeted over the 7-hour, 6-minute period from Thursday, 10 January 2019 at 16:29 UTC to Thursday, 10 January 2019 at 23:36 UTC. Additional tweets that were mentioned in this...
The term "digital transformation" (DX) is being used by everyone for just about any company initiative that involves technology, the web, ecommerce, software, or even customer experience. While the term has certainly turned into a buzzword with a lot of hype, the transition to a more connected, digital world is real and comes with real challenges. In his opening keynote, Four Essentials To Become DX Hero Status Now, Jonathan Hoppe, Co-Founder and CTO of Total Uptime Technologies, shared that ...
After years of investments and acquisitions, CloudBlue was created with the goal of building the world's only hyperscale digital platform with an increasingly infinite ecosystem and proven go-to-market services. The result? An unmatched platform that helps customers streamline cloud operations, save time and money, and revolutionize their businesses overnight. Today, the platform operates in more than 45 countries and powers more than 200 of the world's largest cloud marketplaces, managing mo...
When Enterprises started adopting Hadoop-based Big Data environments over the last ten years, they were mainly on-premise deployments. Organizations would spin up and manage large Hadoop clusters, where they would funnel exabytes or petabytes of unstructured data.However, over the last few years the economics of maintaining this enormous infrastructure compared with the elastic scalability of viable cloud options has changed this equation. The growth of cloud storage, cloud-managed big data e...
Your applications have evolved, your computing needs are changing, and your servers have become more and more dense. But your data center hasn't changed so you can't get the benefits of cheaper, better, smaller, faster... until now. Colovore is Silicon Valley's premier provider of high-density colocation solutions that are a perfect fit for companies operating modern, high-performance hardware. No other Bay Area colo provider can match our density, operating efficiency, and ease of scalability.