Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon insiders sound alarm over security

politico.eu

Post reply on HN
Print view View original

51–60 of 63 posts

Re: Amazon insiders sound alarm over security

#51

Post by jhanschoo »

croes wrote: post #21
ActorNightly wrote: post #10

Every time I read articles like these, I get dissapointed about the state of the internet. The only thing you know that is likely to be true is that someone got fired from Amazon, and thats it. You don't know if they are telling the truth. You don't know if they were in the right. You don't know if Amazon was fixing the problem, and they decided to be an asshole and go over their bosses because they felt that not eno…

The only way to prove it, would be a massive data leak.

Or they can assuage concerned people with a 3rd-party audit.

Re: Amazon insiders sound alarm over security

#52

Post by MrDresden »

rurban wrote: post #31
croes wrote: post #22

Earlier quoted context omitted.

You get sued, because such claims are business damaging.

Good, because then you can verify your claims in court. Which Amazon will not be able to counter. So they will fear the light. Like their friends, secret services doing their illegal things, but they are protected by "National Security" claims, Amazon not.

So you would rather that whistleblowers would only be given attention by media outlets if they are publicly outed alongside the revelations that they usually bring?

Tell me, how well did that go for Edward Snowden and Chelsea Manning?

Re: Amazon insiders sound alarm over security

#53

Post by DocTomoe »

mike_d wrote: post #39
vmception wrote: post #12

Its good they are sounding the alarm, for example, Crypto AG had their cryptographer employees continually find security flaws only to have upper management tell them to work on something else, only to find out after 50 years that it was a CIA operation selling backdoored products to nation states. With nothing being outside the realm of possibility, removing the need for trust should be priority number one.

> Crypto AG had their cryptographer employees continually find security flaws only to have upper management tell them to work on something else I would be very interested if you could share accounts of this happening. From the declassified documents I have studied the Crypto AG "backdoor" consisted of misleading customers that less complex models (with smaller keys) would be suitable for their communications, working…

Just in case you did not see this before - there has been a talk about the Crypto AG and some of the background at last year's replacement for the CCCongress: https://media.ccc.de/v/rc3-103955-cryptoleaks

Re: Amazon insiders sound alarm over security

#54

Post by rualca »

patrick451 wrote: post #40
ekianjo wrote: post #16

Earlier quoted context omitted.

> So 3 employees involved with security and not 1 employee. Also, they were pushed out AFTER alerting about security issues. How much credibility do you put in such testimonies though? Especially if everyone is a "anonymous source", you can basically invent just about anything and publish it and pretend for it to be a genuine article without any fact under the hood.

You're getting downvoted a lot, but these days I too place very little confidence in a story that cites anonymous sources, regardless of whatever supposed gravitas the publication is supposed to carry.

Honest question: where do you place the goalpost with regards to news on corporate malpractice?

If not from whistleblowers, which have a long track record of being persecuted extensively and subjected to very personal and very damaging retaliatory attacks if not for anonymity, then in your eyes what warrants questions?

Re: Amazon insiders sound alarm over security

#55

Post by rualca »

015a wrote: post #5

> "These inaccurate, unsubstantiated and dated claims don’t reflect our commitment to keeping personal information safe. Amazon has comprehensive, long-established privacy and security policies, procedures and technologies in place. Every company has Policies. Zero companies have Realities which match their policies. This means nothing. > We regularly audit our services to ensure compliance and have zero tolerance fo…

> Every company has Policies. Zero companies have Realities which match their policies. This means nothing.

Throughout the years I've grown a dislike of company policies.

They feel like a tool designed to discard accountability down the totem pole.

An executive asks an underling to write a policy, he publishes the report with or without a revision or care, and from thereon any and all responsibility regarding a problem is automatically circumscribed to the poor entry-level bastard who was forced to something remotely related to the policy.

Re: Amazon insiders sound alarm over security

#56

Post by ctvo »

devindotcom wrote: post #28
ekianjo wrote: post #16

Earlier quoted context omitted.

> So 3 employees involved with security and not 1 employee. Also, they were pushed out AFTER alerting about security issues. How much credibility do you put in such testimonies though? Especially if everyone is a "anonymous source", you can basically invent just about anything and publish it and pretend for it to be a genuine article without any fact under the hood.

Journalists do check the credentials of the people they include in articles like this. They don't just take randos at their word. These people are anonymous to you but not to the journalist. If you simply don't believe the writer that's a totally different issue - but people at major outlets like Politico don't just invent sources and stories out of whole cloth like you suggest.

But they do lie, and sometimes we learn about it and they get fired.

Pyramid of trust:

- cited sources

- anonymous sources

- off the record sources

Re: Amazon insiders sound alarm over security

#57

Post by ctvo »

MrDresden wrote: post #52
rurban wrote: post #31

Earlier quoted context omitted.

Good, because then you can verify your claims in court. Which Amazon will not be able to counter. So they will fear the light. Like their friends, secret services doing their illegal things, but they are protected by "National Security" claims, Amazon not.

So you would rather that whistleblowers would only be given attention by media outlets if they are publicly outed alongside the revelations that they usually bring? Tell me, how well did that go for Edward Snowden and Chelsea Manning?

Edward Snowden wasn’t a whistleblower. He stole US intelligence material as a contractor, leaked it to the press and fled the country to avoid facing criminal charges.

The whistleblowing process is not break the law then claim whistleblower protection. You report wrongdoing to a specific, independent body and are offered protection against retribution.

A better example of the system is the whistleblower on Trump’s first impeachment, who is still protected under law and still can’t have their identity revealed publicly.

Edit: To clarify, this only applies to the federal government. I only bring it up since you named two individuals who were associated with the federal government. With Amazon and other private companies, leaking to the press is effective and encouraged.

Re: Amazon insiders sound alarm over security

#58

Post by lupire »

ctvo wrote: post #57
MrDresden wrote: post #52

Earlier quoted context omitted.

So you would rather that whistleblowers would only be given attention by media outlets if they are publicly outed alongside the revelations that they usually bring? Tell me, how well did that go for Edward Snowden and Chelsea Manning?

Edward Snowden wasn’t a whistleblower. He stole US intelligence material as a contractor, leaked it to the press and fled the country to avoid facing criminal charges. The whistleblowing process is not break the law then claim whistleblower protection. You report wrongdoing to a specific, independent body and are offered protection against retribution. A better example of the system is the whistleblower on Trump’s fi…

Doing something in an illegal way doesn't mean you didn't do the thing. Especially when the thing is exposing illegal activity by the body empowered to enforce law.

Re: Amazon insiders sound alarm over security

#59

Post by croes »

ctvo wrote: post #57
MrDresden wrote: post #52

Earlier quoted context omitted.

So you would rather that whistleblowers would only be given attention by media outlets if they are publicly outed alongside the revelations that they usually bring? Tell me, how well did that go for Edward Snowden and Chelsea Manning?

Edward Snowden wasn’t a whistleblower. He stole US intelligence material as a contractor, leaked it to the press and fled the country to avoid facing criminal charges. The whistleblowing process is not break the law then claim whistleblower protection. You report wrongdoing to a specific, independent body and are offered protection against retribution. A better example of the system is the whistleblower on Trump’s fi…

There is a difference in whistleblowing the wrondoing of a person or company and the wrongdoing of the government. In Snowdens case who would have been the independent body and who could have offered protection inside the USA?

Re: Amazon insiders sound alarm over security

#60

Post by yashap »

guitarbill wrote: post #45
yashap wrote: post #32

Earlier quoted context omitted.

Yeah, Amazon is a massive target for hackers, but hasn’t had any particularly bad breaches that I can remember. I’m sure their security/privacy is far from perfect, but it seems to be pretty effective. FWIW I’ve never worked for Amazon, but I have quite a few friends and former coworkers at AWS. We’ve had discussions about security and privacy, and the general sense I got from them is that Amazon has more of a focus…

From OP: > They also noted that AWS is largely run separately from the rest of the company. So this maybe isn't surprising. One deals with mere customers, the other with businesses that have money and lawyers. AWS is also newer than Amazon, right?

Yeah good point, it’s certainly possible that Amazon.com and AWS have significantly different security/privacy policies/practice.
Post reply on HN