Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon met with startups about investing, then launched competing products

wsj.com

Post reply on HN
Print view View original

301–310 of 385 posts

Re: Amazon met with startups about investing, then launched competing products

#301

Post by burtonator »

munk-a wrote: post #295
former-aws wrote: post #20

Earlier quoted context omitted.

Cannot up vote this enough. During my time both at Retail and AWS it was perfectly normal to trawl production customer data and come up with ideas to launch competing products. Prices were always set lower or free offering justified as data-driven and customer obsession. I hated the gas lighting their customers and left in disgust of the company and its leadership which encourages that behavior.

I know it's hard to do when you're making good money and would be going against co-workers. But, if you see something, say something. This crap continues because there are too many folks that are happy to help support immoral business practices for some extra scratch. This isn't all on you in particular but when google folks started raising hell about Chinese censorship the company was forced to move. We all have the…

I mean the problem is corruption begets corruption. They WANT do to these things because you're going to get a massive bonus when the product you 'invented' does well because you stole the idea from an Amazon customer.

Amazon needs to be properly taxed so that this crap doesn't happen anymore.

The idea that they shouldn't pay taxes simply because they're large should absolutely enrage everyone.

Re: Amazon met with startups about investing, then launched competing products

#302

Post by ampersandy »

burtonator wrote: post #301
munk-a wrote: post #295

Earlier quoted context omitted.

I know it's hard to do when you're making good money and would be going against co-workers. But, if you see something, say something. This crap continues because there are too many folks that are happy to help support immoral business practices for some extra scratch. This isn't all on you in particular but when google folks started raising hell about Chinese censorship the company was forced to move. We all have the…

I mean the problem is corruption begets corruption. They WANT do to these things because you're going to get a massive bonus when the product you 'invented' does well because you stole the idea from an Amazon customer. Amazon needs to be properly taxed so that this crap doesn't happen anymore. The idea that they shouldn't pay taxes simply because they're large should absolutely enrage everyone.

Who is saying they shouldn't be taxed because they are large? There's no 'large company' tax break.

https://www.cnbc.com/2019/04/03/why-amazon-paid-no-federal-i...

There's specific credits/exemptions in the tax code that they are able to exploit (and perhaps they can only exploit some of them _because_ they are a big company), but it really isn't about their size.

Re: Amazon met with startups about investing, then launched competing products

#303

Post by swiftcoder »

httpsterio wrote: post #205
former-aws wrote: post #20

Earlier quoted context omitted.

Cannot up vote this enough. During my time both at Retail and AWS it was perfectly normal to trawl production customer data and come up with ideas to launch competing products. Prices were always set lower or free offering justified as data-driven and customer obsession. I hated the gas lighting their customers and left in disgust of the company and its leadership which encourages that behavior.

Considering that OP created this account today and that they're admitting to what would be a felony and against Amazon's own privacy policy, I doubt this statement is true. Even if the customer had a misconfigured S3 bucket that was exposed to the public, it would still constitute as accessing customer data you're not meant to see. As other users have provided insight on, everything you do as an Amazon employee basic…

> everything you do as an Amazon employee basically leaves a trail with your employee ID

That might be true in retail, but it wasn't anywhere close to true in AWS. When I left most engineers still had SSH access to the production hosts (and a not-insignificant portion of operations relied on that fact).

Re: Amazon met with startups about investing, then launched competing products

#304

Post by donor20 »

starfallg wrote: post #204
thoraway1010 wrote: post #158

Earlier quoted context omitted.

This frankly doesn't match my experience and I have to say I find it unlikely. Before going into our AWS production S3 buckets, looking at our databases for customer lists AWS seems to be pretty careful to get an OK. Now we are being told that production customer data was normal to trawl? How in the HELL are they passing all their certs with all production data so wide open. I do customer managed keys - I mean, this…

My understanding is that Customer Managed CMK in KMS only means that the customer has control over the key operations - like rotation, key policies, IAM policies, etc. AWS still has actual control over the KMS system and full access to the HSM.

Even under this definition how in the HELL are they "routinely" trawling our production data secured by these keys. I mean, does not one think that is rediculous?

This isn't amazon billing data etc (obviously I expect they analyze that carefully given they bring in billions from billing). To ROUTINELY go through AWS customer production datasets is beyond all reason.

Re: Amazon met with startups about investing, then launched competing products

#305

Post by dodobirdlord »

jacquesm wrote: post #256
dodobirdlord wrote: post #229

Earlier quoted context omitted.

I think perhaps you misunderstand the architecture of KMS. KMS master keys are used to remotely decrypt the symmetric encryption keys for encrypted data that are stored alongside the encrypted data. KMS master keys don't ever leave the KMS servers themselves, and servers can't be accessed directly by anyone. AFAIK they don't have open ports except for handling production traffic and are hardened against opening a she…

I think you misunderstand my concern. What I'm missing in the above scenario is that a resource that should be 100% under the control of the customer and nobody else can be accessed by AWS personnel to open up a door that should be closed unless the customer permits access. What the technical implications are is moot, the process that hands out these credentials should not be accessible to anybody but the customer. I…

> It implies that AWS personnel can impersonate customer representatives or processes run on behalf of those customers. That's a serious problem.

Rather than being a serious problem I think it's more on an obvious fact. AWS personnel build services that specifically exist to act on the customer's behalf with delegated credentials. Any time you configure a managed service to run with an IAM role, that service assumes the role and acts with the credentials granted to the role. AWS personnel have access for emergencies to the systems running their services, and by their very nature those services are in possession of customer credential sets for the IAM roles that the service is configured to use.

For example, a Lambda Function can be configured to run with a particular role. When the Lambda service goes to run the function, it fetches the role credentials from IAM and makes them available to the running Function. It could not be otherwise, because the purpose of a managed service like Lambda is to carry out actions on behalf of the customer. The role's credential set is as much a piece of data as the code of the function to be executed.

But leaving all of this aside, of course AWS personnel can access any and all data you store in their systems. They are legally obligated to turn whatever you have stored over to the courts in response to a warrant. So not only could they gather up your data by this roundabout method of misappropriating credential sets, they must have a way to simply access all of the data directly in a way that doesn't appear in audit trails. I assume for simplicity that the IAM service simply has an endpoint accessible to the company's lawyers that will serve up forged customer credentials on demand.

Re: Amazon met with startups about investing, then launched competing products

#308

Post by wolco »

Aperocky wrote: post #272
wolco wrote: post #236

Earlier quoted context omitted.

Whenever anyone asks for evidence I start to wonder why they need the proof. Why did you need this link? Do you have a business relationship with Amazon? https://www.google.com/amp/s/www.wsj.com/amp/articles/amazon...

[flagged]

I'd like to ask for evidence for statement 2. This sounds more like your opinion than a substantiated claim.

1. Someone needs to pay the people who write stories. If proof is important you should not object to contributing to the people who work on your behalf.

Re: Amazon met with startups about investing, then launched competing products

#309

Post by ashtonkem »

throwaway_aws wrote: post #12

"An Amazon spokesman said the company doesn’t use confidential information that companies share with it to build competing products" Maybe...but in the past, AWS proactively looked at traction of products hosted on its platform, built competing products, and then scraped & targeted customer list of those hosted products. In fact, I was on a team in AWS that did exactly that. Why wouldn't their investing arm do the sa…

Amazon and arguably google are in desperate need of a good anti-trust investigation.

Re: Amazon met with startups about investing, then launched competing products

#310

Post by kristopolous »

gentleman11 wrote: post #87

Standard advice to to not keep your startup secret but to talk about openly to as many people as possible. Eg, quotes about how only 1/1000 startups die to competition, and the rest self destruct or fail to get traction. Is that still the case?

this is more than that.

I've seen people try to play this game. They'll pretend they want to buy you/partnership/invest/be a client and then ask pointed questions: "What dependencies are you using on your backend for XYZ ... have you found any issues with that? If you were going to rewrite it, how would you approach it?"

In the weeds questions about detailed implementation. "Do you have a detailed architecture diagram?" etc. People who haven't seen it are like "boy they are serious. Look at their diligence"

These people need to up their street smarts game: "Nah bro, they're just stealing shit."

How do you know? Check who's in the room/on the call. Ask yourself what kind of decisions these people would make. Find out who they are.

Amazon has been actually pretty light with this practice. They're pretty picky but the right people have been in the room and they haven't really gone deep into the spy questions. The real nasty violators are companies like uber and microsoft. I wouldn't be surprised if they had actual corporate spy departments.

We had GM try to do it but they were bumblers. It was kinda cute. It also seems to be mostly American. I've dealt with a lot of Japanese and Chinese businesses and they were all genuine. If they said they wanted a partnership for reason X, then they indeed want a partnership for reason X.

If they want to steal the tech and go to other markets then there's clear nonexclusive and rights parts of the contract. It's not the "100% lies all the way down" of Uber.

Post reply on HN