obnauticus

Uhh…Wut?

Somewhat depends on your threat model. The relative value of an iCloud/aws/gDrive 0day is going to be higher than Nextcloud. If you’re in the category of people concerned about this type of breach, self-hosting a PHP web app and claiming it’s somehow safer wont save you either. For this risky population, neither solution works since attackers are willing to throw expensive exploits at your data in either scenario.

If you aren’t being specifically targeted, then you would care about low hanging fruits discovered by something like automated scanning. Not exposing your service to the internet does solve this assuming you’re confident in the stack which provides this isolation. But managing this stack and performing risk calculus here is actually where the security horse trading happens. I think most people aren’t safer managing this themselves — arguably they’re actually worse off.

I have high standards for the confidentiality of my data. I care about things like lateral movement and the massive attack surface that isolation tech to prevent such movement has. I also won’t design monitoring and alerting, ensure a patch state, or perform code audits on Nextcloud and all the isolation tech required to secure it to a comporable level of security. Because of this, I instead reason around the cost of exploitation. I want it to be higher than what I believe Nextcloud provides and I’d rather require an attacker to use an expensive 0day to extract my data off a cloud provider like Google versus a potentially cheap one against my own infra.

Agreed. The breakdown is indeed pretty poor IIRC.

Generally you use these disclosures to make directional decisions about infrastructure. The list of fixed and disclosed CVEs combined with the legacy PHP code base doesn’t really pass the security sniff test. You really wouldn’t know for sure without doing a full code audit.

Frugality. Your cost per hour is reduced.

Learn and be curious. If you’re working on the weekend, you get to do this 24x7.

At least they get to keep their two days of WFH.

New policy - five days RTO, two days WFH, per week.

I noticed this too and I am afraid they wont ever release this on the web app since they seem to have the best lane and road mapping data.

It does. You can tax loss harvest from companies that you own, so it makes sense to have a bunch of bets that are money pits.

Can it? You still need a ton of very expensive infra, engineering, ops to manage all of this.

Waymo has clearly been playing the “but it’ll be cheaper” game for a long, long time now. It makes sense if you squint really hard and fudge some numbers about unit economics.

If the expected outcome is for it to be eventually cheaper, then why when I open the app does it costs almost twice as much as an Uber or Lyft? You’d think they would want to at least convince investors and train customers that the savings are real and they’re going to prove it by passing it on.

Sunk cost fallacy

It’s not a grammar fix, it’s a sentiment fix.

There are a ton of operational costs that Uber/Lyft have lobbied to give to cheap contractors with no benefits.

I think the title is missing a word:

“Alphabet _has to_ invest another $5B into Waymo”.

I’d like to remind everyone that it’s still a taxi business with taxi margins (best case).