joecode

Interesting... so it seems resume trumps argument at HN?

Well, pile on the down-votes folks, I've got to get back to work.

Your resume is very impressive, and I see that you obviously know a lot about security at Amazon, yet this by itself does not discount my points. Those are:

1) AWS could be compromised, as my first friend claimed, without Amazon knowing about it.

2) My second friend is not allowed to use AWS for security reasons.

The truth of the first point is indeterminable, I think we may agree. Meanwhile, the second point may indeed be due to my friend being misinformed, if for example, you are aware of a Amazon-wide policy that says engineers can use AWS willy-nilly, so long as they abide by general security regulations that are used elsewhere.

I'm not sure where the confusion lies, but I'm guessing you see "security concerns" as equivalent to "knowledge of ownership"?

It seems to me those are entirely different things, as one can be concerned about potential threat without knowing if it is real or not. But I do not work in the security community myself and may be using language sloppily.

I would be much obliged if you could show me where the crux of the confusion lies.

I'm not sure how you can say that so matter-of-factly. My security friend was talking about something that Amazon does not (and presumably very few people do) know. Meanwhile my friend at Amazon was just stating the fact that he was not supposed to use AWS, or only with extreme caution. Of course that may differ from department to department, if that's what you mean.

My friend from Amazon works in the supply-chain side of things, and he said he really wants to use it, but everything has to be encrypted and some stuff is off limits.

I take it you work on the retail side of things? I'd be interested to hear any more details that you can share.

Certainly agree. Perhaps it would be better to suggest moving to dedicated servers, depending how security-paranoid you are, anyhow.

While I agree it is hard to believe, it would be even more surprising if Amazon did know about it. The fact that they do not use AWS internally suggests that---at least with their level of paranoia---they seem to suspect AWS themselves.

One potential reason not to move: Security.

A good friend deep in the security community once told me, off hand, that EC2 was "owned." I didn't take this too seriously until another good friend, who has been working at Amazon for the past several years, told me that engineers at Amazon were generally forbidden from using AWS due to security concerns.

That much said, I still decided to use EC2/RDS/S3 to host the infrastructure of my latest startup. It is just too convenient to walk away from. Once it matters, I can move the critical stuff to dedicated servers.

EDIT: To clarify, I'm not suggesting that Amazon knows AWS is "owned" and offers it to others anyway. I'm only noting that, for certain critical services, they themselves do not appear willing to take the risk.

The title and tone do suggest he is making a general criticism of hacker news. Still, it says "A Hacker News Story", not "Any Hacker News Story" so the anatomy could be specific, but the main point more general.

It appears he is accusing us of groupthink.

I'm not sure how much merit that claim has---certainly he has presented no "actual research" himself, but it is an interesting criticism nonetheless.

Mostly looks good, but I'd use a different font, or actual handwriting on top of the graph. And the arrow is ugly.

Maybe have a free option to get some traction.

Launch. If it gets traction and it looks like court is the only other option, make a settlement with him. Don't worry what is "fair" or about the work you've already sunk in. Just make sure it's worth it for you, get him out of the way whatever it takes, and move on.

Good advice. Beyond that, I recommend surrounding yourself with critical, intelligent, trustworthy people. I bounce all my ideas off a core group of friends, and generally don't bother with anything until they all give the green light. Besides that, it's just ROI/risk evaluation. Unless you're already a millionaire, it is best to focus on lowest possible investment for the highest likely return. Later it may be worth taking bigger risks.