Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fire destroys S. Korean government's cloud storage system, no backups available

koreajoongangdaily.joins.com

Post reply on HN
Print view View original

881–890 of 987 posts

Re: Fire destroys S. Korean government's cloud storage system, no backups available

#881

Post by otterley »

littlestymaar wrote: post #597
otterley wrote: post #185

Earlier quoted context omitted.

The U.S. Government can’t decrypt data for which it does not possess the key (assuming the encryption used is good).

Well first of all neither you and I knows the decryption capabilities of the NSA, all we know is that they have hired more cryptologists than the rest of the world combined. Also, it's much easier for an intelligence service to get the hand on a 1kB encryption key than on a PB of data: the former is much easier to exfiltrate without being noticed. And then I don't know why you bring encryption here: pretty much none…

1. More evidence suggests that NSA does not know how to decrypt state-of-the-art ciphers than suggests they do. If they did know, it's far less likely we'd have nation states trying to force Apple and others to provide backdoors for decryption of suspects' personal devices. (Also, as a general rule, I don't put too much stock in the notion that governments are far more competent than the private sector. They're made of people, they pay less than the private sector, and in general, if a government can barely sneeze without falling over, it's unlikely they can beat our best cryptologists at their own game.)

2. The operative assumption in my statement is that the government does not possess the key. If they do possess it, all bets are off.

3. This thread is about a hypothetical situation in which the Korean government did store backups with a U.S.-based cloud provider, and whether encryption of such backups would provide adequate protection against unwanted intrusion into the data held within.

Re: Fire destroys S. Korean government's cloud storage system, no backups available

#882

Post by dh2022 »

stonemetal12 wrote: post #824
kristianc wrote: post #95

The government official who insisted that commercial AWS/GCP/Azure couldn't possibly be trusted with keeping the information will be keeping their head low for a few days then... "The Interior Ministry explained that while most systems at the Daejeon data center are backed up daily to separate equipment within the same center and to a physically remote backup facility, the G-Drive’s structure did not allow for extern…

If you (as the SK government) were going to do a deal with " AWS/GCP/Azure" to run systems for the government, wouldn't you do something like the Jones Act? The datacenters must be within the country and staffed by citizens, etc.

Microsoft exec testified that US Govt can get access to the data Azure stores in other countries. I thought this was a wild allegation but apparently is true [0].

[0]https://www.theregister.com/2025/07/25/microsoft_admits_it_c...

Re: Fire destroys S. Korean government's cloud storage system, no backups available

#883

Post by [deleted] »

Chris2048 wrote: post #873
disgruntledphd2 wrote: post #810

Earlier quoted context omitted.

> I'll also bet the internal audit team slides out of this completely unscathed. They really, really shouldn't. However, if they were shouted down by management (an unfortunately common experience) then it's on management. The trouble is that you can either be effective at internal audit or popular, and lots of CAE's choose the wrong option (but then, people like having jobs so I dunno).

Which begs the question, Does N Korea have governmental whistle-blower laws and/or services? Also, internal audit aren't supposed to be the only audit, they are effectively pre-audit prep for external audit. And the first thing an external auditor should do - ask them probing questions about their systems and process.

[deleted]

Re: Fire destroys S. Korean government's cloud storage system, no backups available

#884

Post by Chris2048 »

ArchD wrote: post #683
FooBarWidget wrote: post #622

Earlier quoted context omitted.

Never attribute to malice what can be attributed to stupidity. There was that time when some high profile company's entire Google Cloud account was destroyed. Backups were on Google Cloud too. No off-site backups.

Hanlon's Razor is such an overused meme/trope that it's become meaningless. It's a fallacy to assume that malice is never a form of stupidity/folly. An evil person fails to understand what is truly good because of some kind of folly, e.g. refusing to internally acknowledge the evil consequences of evil actions. There is no clean evil-vs-stupid dichotomy. E.g. is a drunk driver who kill someone with drunk driving stup…

Hanlon's Razor appears to be a maxim of assuming good-faith; "They didn't mean to be cause this, they are just inept."

To me, it has no justification. People see malice easily, granted, but others feign ignorance all the time too.

I think a better principle is: Proven and documented testing for competence, making it clear what a persons duties and (liable) responsibilities are, then thereafter treating incompetence and malice the same. Also: any action need to be audited by a second entity who shares blame (to a measured and pre-decided degree) when they fail to do so.

Re: Fire destroys S. Korean government's cloud storage system, no backups available

#885

Post by [deleted] »

Romario77 wrote: post #842
stego-tech wrote: post #773

Earlier quoted context omitted.

This. Speaking specifically from the IT side of things, an employer or customer refusing to do backups is the biggest red flag I can get, an immediate warning to run the fuck away before you get blamed for their failure, stego-tech kind of situation. That being said, I can likely guess where this ends up going: * Current IT staff and management are almost certainly scapegoated for “allowing this to happen”, despite t…

I mean - it should be part of due diligence of any competent department trying to use this G-drive. If it says there are no backups it means it could only be used as a temporary storage, maybe as a backup destination. It's negligence all the way, not just with this G-Drive designers, but with customers as well.

[deleted]

Re: Fire destroys S. Korean government's cloud storage system, no backups available

#887

Post by nonethewiser »

panda-giddiness wrote: post #744
phatfish wrote: post #736

"The stored data amounts to 858TB (terabytes), equivalent to 449.5 billion A4 sheets" Just so we can all visualise this in an understandable way, if laid end-to-end how many times round the world would the A4 sheets go? And what is their total area in football fields?

Attached end-to-end, they'd extend almost from the Earth to the Sun [1]. Placed in a grid, they'd cover an area larger than Wales [2]. Piled on top of each other, they'd reach a tenth the distance to the moon [3]. --- [1] https://www.wolframalpha.com/input?i=449.5+*10%5E9+*+%28leng... [2] https://www.wolframalpha.com/input?i=449.5+*10%5E9+*+%28area... [3] https://www.wolframalpha.com/input?i=449.5+*10%5E9+*+%28thic..…

I am shocked that 1 and 2 are both true. I would have guessed 1 would have implied a much larger area than Wales.

Re: Fire destroys S. Korean government's cloud storage system, no backups available

#888

Post by nonethewiser »

BonitaPersona wrote: post #774
phatfish wrote: post #736

"The stored data amounts to 858TB (terabytes), equivalent to 449.5 billion A4 sheets" Just so we can all visualise this in an understandable way, if laid end-to-end how many times round the world would the A4 sheets go? And what is their total area in football fields?

Actual football fields please, the International Standard Unit footbal field, used in SI countries.

Football or soccer?

Re: Fire destroys S. Korean government's cloud storage system, no backups available

#889

Post by preisschild »

eCa wrote: post #120
kristianc wrote: post #95

The government official who insisted that commercial AWS/GCP/Azure couldn't possibly be trusted with keeping the information will be keeping their head low for a few days then... "The Interior Ministry explained that while most systems at the Daejeon data center are backed up daily to separate equipment within the same center and to a physically remote backup facility, the G-Drive’s structure did not allow for extern…

Agree completely that it's absolute wild to run such a system without backups. But at this point no government should keep critical data on foreign cloud storage.

Especially on US cloud storage.

The data is never safe thanks to the US Cloud Act.

Re: Fire destroys S. Korean government's cloud storage system, no backups available

#890

Post by alephnerd »

throwaway2037 wrote: post #384
alephnerd wrote: post #219

Earlier quoted context omitted.

They are overwhelmingly whitelabeled providers. For example, Samsung SDI Cloud (the largest "Korean" cloud) is an AWS white label. Korea is great at a lot of engineering disciplines. Sadly, software is not one of them, though it's slowly changing. There was a similar issue a couple years ago where the government's internal intranet was down a couple days because someone deployed a switch in front of outbound connecti…

> Korea is great at a lot of engineering disciplines. Sadly, software is not one of them I disagree. People say the same about Japan and Taiwan (and Germany). IMHO, they are overlooking the incredible talents in embedded programming. Think of all of the electronics (including automobiles) produced in those countries.

Good point! I wasn't treat that as "software" in my answer but it's true that their embedded programming scene is fairly strong.
Post reply on HN