Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Comment Re:No, just no. (Score 1) 91

Lets be honest, no company would allow, let alone offer, tours if it had any risk of leaving a bad impression to potential customer.

It is not so much a bad impression or good impression it is an accurate impression. Obviously they are going to spin things positively. But it is not to their advantage for the customer to not know the upsides and downsides. They don't want to sell services they can't provide. So for example if the data center offers 24/7 smart hands they will present that. If they offer 8/5 smart hands they aren't going to claim 24/7. If they have 2 week's of oil on hand they will want to present that if they only have 4 days they aren't going to claim 2 weeks.

No company in the world would allow a client to perform such audits

Not true. Remember that quite often the IaaS provider and the underlying colo are separate. So for example if AWS is hosting out of location X, the colo company for X (say QTS for example) is going to be audited by Amazon. QTS might very well show you the result of the Amazon audit. Even better is if a bank colos there.

. Whether the provider plays (willingly or not) hand it hand with intelligence agencies is yet another question... You obviously still like bedtime stories. In the meanwhile, I'll leave my sensitive data off the hands of cloud.

Assume the answer is any colo provider you to to will work with USA intelligence agencies. But so will your technical staff. Nothing you do will stop domestic intelligence agencies. As for foreign though, the IaaS companies often offer far better security than your company could ever afford.

But intelligence agencies aren't the real threat. Your facility is likely vastly less secure than the worst of the commercial colos, you are making it much easier to get spied on by thieves.

You don't get audited by anyone serious.

Comment Re:No, just no. (Score 1) 91

How do you know any of that is true?

For a customer you can easily have a tour arranged. You can meet with your account manager regularly. You'll know the people assigned to your account.... Your agent can just tell you since we all go on tours.

How many people review the data center they are migrating to?

I'd say most customers go their data center at least once and sometimes more than once during the sales process.

How many people vette the employees in the cloud center?

You mean like an HR vetting? Those are done quite well. In addition the centers themselves are regularly audited by customers and auditing firms. Again you can pick your center based on the policies you want.

There is no incentive for the vendor to do any of that, it just reduces profitability.

Quite the contrary. The better the data center the less cost sensitive the customers. It increases profitability. Lower end centers selling rack space below cost to supplement existing customers who have become semi-indifferent might have those sorts of incentives to cut corners but again a customer is going to know if there are hitting up a low security / low cost provider.

And the IT management can just say, "It is a professional Fortune {500 | 50} company they *must* be good". . But trust me, the incompetence I have seen in Fortune 500 companies has been astounding.

Exactly the point. You see a much higher level of competence in telcos and fiber companies which run most data centers. You see a much higher level of competence in IaaS operators. Which is my point for most companies this is a security upgrade.

Comment Re:regulatory aspects (Score 1) 91

Do we want them keeping copies for the NSA, FBI, CIA, etc to eventually crack the encryption to view?

If the NSA, FBI, CIA ask for a copy of your data your IT staff will give it to them. Don't kid yourself. Your IT staff is not going to jail for their "at will" employer.

I have yet to see a cloud service prove that they cannot access any data that I would store in their equipment.

  There are plenty of cloud providers with very rigorous controls and audit reports. That is readily available. Not from Amazon (but even they are getting better) but Sungard, Oracle cloud, Verizon cloud, Firehost... You are asking for a standard feature.

Comment Re:Great for lawsuits and discovery. (Score 1) 91

This is somewhat true. Let's narrow a bit. First we are talking civil discovery only and then that's just an argument against IaaS vs. Colo though. Obviously for a criminal case where the government is seriously pissed i.e. the government issues a warrant and ceases the servers they will get the data in either case. Also don't kid yourself once they take the servers your IT staff can be terrified by "obstruction" type charges and will help them get data.

OK so with that off the table. If you intend to be stay close or over the line with discovery breaking apart the management of the service and the physical service makes it easier to avoid discovery because you have three parties than can legally block one another. A can say B knows, B can say C knows and C can say A knows. That's even better than having the in-house staff obstruct discovery where a judge is more likely to find the company liable.

I should also mention that companies that are frequently subject to discovery BTW often have the opposite problem getting middle management and lower management to admit wrongdoing to legal. Often during discovery those people are hiding documents trying to "help" the company when in reality creating a problem of what looks like not complying with the court.

So at best you are making an argument for colo + MSP over IaaS.

Comment Re:instead of just posting here... (Score 1) 91

People trust banks with their money because the government is insuring it against theft or loss. No such guarantee comes with Cloud storage.

Yes they do. There are many auditing agencies that supervise and audit clouds. For example once a cloud provider has agreed to be a data partner they become subject to HIPAA, And there are insurance programs you can buy that include data breach.

Comment Re:instead of just posting here... (Score 1) 91

Do you want your info on the same service that Sony uses the next time North Korea decides to mess with them? That's a very real potential issue.

Sony was hacked because they were utterly incompetent and didn't believe they would ever be subject to a APT type attack. financials, pharmaceuticals, social networks... have no doubts they will be subject to APT type attacks. So were Sony on a cloud Sony likely isn't successfully hit at all. Nothing happens other than the ineffective attacks the internet infrastructure has to repel every day.

Comment Re:No, just no. (Score 1) 91

That's not entirely true though it is mostly true. There are cloud systems and MSPs (and cloud migration exports) that will work on top of many IaaS that offer: auditable procedures, security audits, practice improvement.... Obviously you can implement those things without cloud but for many companies the cost of a SOC is undoable but having a SOC through their MSP is doable.

Comment Re:No, just no. (Score 1) 91

Yes. Web is a return to the mainframe paradigm. People are enjoying the upside of this paradigm and while they are experiencing some of the downsides the ratio is such that mainly things are getting better. Once the environment becomes too monolithic and tightly controlled the freedom of "do whatever you want" will have huge advantages and we will see a shift away.

You already see this to some extent on mobile with Apple's push for performance away from the almost totally web paradigm that was popular prior to Apple.

Comment Re:The Fuck? (Score 3, Informative) 175

You are correct, I've never worked for Microsoft I don't even sell much Microsoft. Mostly when I'm dealing with SQLServer datasets they have been no problem for RDBMS. My company has helped do connector work for Azure on Hadoop / SQLServer mixtures.

I suspect the reason AC thought I worked for Microsoft was I thought the Windows 8 (and early new interface for Office) migration program (i.e shift the x86 ecosystem) that Balmer / Office group was pushing made a lot of sense and defended it.

there are very few scenarios extreme enough that Oracle cannot handle the database workload as well as any NoSQL solution

Oracle is excellent. Oracle has problems with massive parallelism though. The Oracle engine works well at 10 CPUs handling versatile workloads. It doesn't at 1000 CPUs focusing on one big table scan for one query.

But god help those novice developers using the NoSQL database set up by a novice DBA when they don't comprehend what they are giving up by saying "no thanks" to ACID compliance.

If you aren't using relational you better be using old fashioned block type strategies (i.e. full table writes like you do in COBOL) or not be doing transaction processing at all. That's one of the things you are giving up when you go non-relational. Data changes become much trickier.

But that's not a problem for most NoSQL where you just write the data out, process it for X time and changes are handled via appends if at all. A good relational analogy to the append structure is how RDBMS handle materialized views and data changes.

Comment Re:The Fuck? (Score 1) 175

Well, for queries on structured data, no, not often at all. Practically never if properly configured.

Why do the people who make those engines disagree with you and advocate hybrid strategies?

Maybe MySQL does, I don't know. PostgreSQL does not.

Enterprise DB which writes Postgres disagrees with you. That's one reason they have a practice around supporting IBM's big data platform and themselves author the Postgres Plus Connector for Hadoop.

Comment Re:The Fuck? (Score 1) 175

but it's not always a win, especially if you don't know what you're doing or why.

I agree. I always start big data conversations with the "what query do you want to perform that doesn't work on RDBMS"? If they can't even name one then there is no reason to go big data. A dataset under a 100g, that isn't being read / destroyed quickly that can be structured consistently never needs big data. One of those 3 things has to not be true.

The problem on /. right now is that lots of the developers who are SQL advocates didn't come up in the pre-SQL years when the ratio of computational power to storage was much lower than it was 1990-2005. Techniques that made sense when you could only do say 3g / hr are making sense today when storage is often measured in petabytes and its hard to get 5g / sec from even the best arrays. 100t of read at 5g / sec = 5.5 hrs. If you need answers in 55 seconds then even getting a factor of 10 above 5g / sec (which I've never seen done) won't get you close to your goal. That's my point to most of the SQL advocates there are use cases because 100t of data in a table is no longer something that even midsized business can't play pretty comfortable with.

Comment Re:Terrible arguments for Big Data (Score 1) 175

Why bother lighting the fuse for a full cartesian product blow-up at all?

The main reason is when the blow up in practice is sparse.

Say for example A has 1 million rows and 20 columns. B has 1 million rows and 20 columns. Column A1 is a link to rows in B. On average a value in A1 will have 3 corresponding rows in B. Pulls from A*B tend to be 5 rows or less. It is cheap to just pull the appropriate blocks from A and then the appropriate blocks from B. That's going to be much faster than denormalizing,

Slashdot Top Deals

A morsel of genuine history is a thing so rare as to be always valuable. -- Thomas Jefferson

Working...