Schneier on Security

Clive Robinson • December 7, 2011 6:28 AM

@ Bruce,

“The more interesting question is: which government should I trust instead”

On the assumption you were not being flippant / rhetorical… only if you are interested in political discussion, if not then you are asking the wrong question.

From the point of view of providing a solution, you should be asking,

‘Given the current infrastructures available to me, how do I use them such that I don’t have to trust either the infrastructure operators or those who might have undue accesss to the infrastructures or influance over the operators?”

Asking it that way gives you the basis of a plan of action on which to work, not an open ended political debate best held on the porch with a beer in your hand when the sporting talk has run it’s course.

@ All,

However there are more fundemental questions that need to be looked at than “who might get access to my/our data”, such as how do I ensure I continue to get access to my/our data (under all foreseable survivable eventualities).

One thing that is quite clear, is that the majority of those leaping into the cloud for data storage are most certainly not asking the right questions and appear to be doing it for no other reason than “very shorterm managment thinking”. Which is often based on a faux assumption of cost saving or as more often (mistakenly) said “Because it’s more efficient”…

This is dangerous thinking, just as dangerous and along the same lines of “If I place another bet I can wipe out my current loses” the faux assumption here being (against more rational thinking) that you are actualy going to win this time…

Also in most cases people leaping into the Cloud don’t have sufficient information as to who owns / provides what and who carries the actual risk and why, or even who actually owns the data stored.

One aspect of this is being called by some cynical people “cloud data offseting” that is I sell you a cloud storage service but in actuality I own no infrastructure and in effect carry no risk (other than bankruptcy).

Unbeknown to my clients I just subcontract the work to which ever infrastructure provider gives me what I perceive is the “best deal” and it could just be “Amazon” or other well known organisation as the backend and I front it by renting a server or two through the likes of say “RackSpace”. My only effective “value added” if any being the choice of software and the entries in the configuration files on those rented servers…
Which whilst it may not be illegal, and of no issue whilst things are working, what happens when things go wrong either technicaly or if the business fails and the bills to the infrastructure providers goes unpaid?

The further these Cloud providers are away from you the more things are likely to go wrong technicaly and contractualy and the less your opportunity of seaking redress or even getting your data back…

In the worst case your private data may fall into the hands of a receiver or other debt recovery agent, who will sell it for whatever they can get, irespective of what contractual arrangements you thought you had put in place (and yes this has happened before in similar circumstances)…

Therefore two obvious things arise,

1, You have to make your private data of no worth to others.

2, You have to make the access to your data highly fault tolerant.

The first implies some form of client side data encryption the second the use of high assurance / availability techniques at all levels technical, contractual and providers (which kind of blows most expected cost savings out of the water).

That is you need to store your data with three or more providers (think RAID on NAS/SAN as to the why and the how) and if you are sensible the data “stripes” are stored using a threshold scheme to reduce / prevent collusion / compulsion.

With a little further thought as an international organisation you can even beat the UK RIPA and those less than humourous people with cold wet blankets and rubber hose pipes providing their drivers are rational (the way my luck runs I’d probably get the ones who just get job satisfaction or feel the need of the exercise…)

Clive Robinson • December 11, 2011 3:02 AM

@ Richard M Stallman,

This disagreement illustrates the meaninglessness of the term “cloud computing”. … I’ve decided decided to reject the term and never use it

Whilst I would agree that in practical and technical terms “cloud computing” is effectivly so nebulous as to be devoid of measurable meaning it is a “term in common use”.

And as with many things to do with human perception “they do not exist without a name, and although the name brings them into existance, they are not the name” a point that was not lost on the logician Charles Lutwidge Dodgson (AKA Lewis Carroll) in his poem “The White Knights Song” and other well known works.

The term is out there and others ascribe to it the meanings they might wish, but it’s existance as a term no matter how devoid of meaning it might be to you or I cannot be denied.

In this respect it is like many other terms such as “knowledge” or “engineer”, it is either or both, to broad in scope, or effectivly self referential.

The solution to this very human perception problem has always been to break it up in some way by methods such as catagorise the scope or impose a hierarchy or both. Thus you get “mechanical engineer” and “design engineer”, that begat “mechanical design engineer” etc often prefixing the more quatifiable description of “specialising in…”.

In many respects this is a social norm to prevent alienation of others who would have little or no concept of what a particular highly specialised field of endevor is by it’s name alone.

George Orwell whilst working in a book shop at the botom of Pond St Hampsted London during World War II realised into his writings that this social norm was important as it could be, by witholding its use be used as a method of segregation and thus repression.

So by all means when talking to specialist in a particular field of endeavor withold using it, but remember the important use of it as a social norm when addressing a less specialised audiance, even if you just restrict yourself to why you are not going to use it further in the current address, discussion.

All of us have our own pet dislikes when it comes to terms, two of mine are the misappropriation of the term “hacker” and the more recent “China APT” and no doubt some people are smiling on reading this admission because of my past stamping of my (less than) little foot on the subjects 8)

Clive Robinson • December 11, 2011 6:20 AM

@ Matthias,

NB: Improved spelling and less mixing-up of homonyms(“it’s” vs. “its”) would be appreciated

Yes I’ve a life long bad habit of that, the question is though “Can an old dog be taught new tricks”?

Speaking of “dog food” in the UK and I believe Germany as well one major supplier is “Pet Foods”, who just happen to be owned by the same company as “Mars” who make chocolate bars, so pick the type of “dog food” you would prefer

P.S. For all canine and other pet owners please don’t feed human chocolate to your pets, it’s poisonous to both them and you (theobromine). The difference being that whilst as little as 30gm of dark chocolate can kill your four legged friend, it takes around 10Kg in one go to kill a human.