The very short version: it is madness to continue transferring the running of European societies and governments to American clouds. Not only is it a terrible idea given the kind of things the “King of America” keeps saying, the legal sophistry used to justify such transfers, like the nonsense letter the Dutch cabinet sent last week, has now been invalidated by Trump himself. And why are we doing this? Convenience.
  • Foni@lemm.eeEnglish
    291·
    2 days ago

    What the hell is a government doing using someone else’s cloud? I have a small business and I bought a Synology NAS years ago. How is it possible that a government does not have its own servers?

    • B-TR3E@feddit.orgEnglish
      2·
      23 hours ago

      What the hell is a government doing using someone else’s cloud?

      Fucking up everything. Thar’s what governments do for a living,

    • Black616Angel@discuss.tchncs.deEnglish
      6·
      1 day ago

      Yeah, that just doesn’t scale. Don’t get me wrong, what you do works and is good, but you (probably) don’t have an off site backup or 100TB of customer data, that is needed in 17 countries accessed by over 15.000 employees.

      I’m not saying, that you need a public cloud provider for that, there are other companies, that do these kinds of things, but it is more comfortable and as with SAP no manager has ever been fired for proposing using Microsoft.

        • Black616Angel@discuss.tchncs.deEnglish
          2·
          1 day ago

          Yes, but there are even more smaller companies doing that and in the past a lot of companies did that themselves (if big enough) but “the cloud” is seems just so convenient, that they don’t want that anymore.

    • macniel@feddit.orgEnglish
      13·
      2 days ago

      Buying service level agreements on rented hardware is easier and cheaper (you don’t have to pay your own IT). Security and data protection, pfft nobody needs or wants that.

        • varyingExpertise@feddit.orgEnglish
          3·
          1 day ago

          “Yes, but that’s another departments cost. Or some lobbyists told me this is cheaper. Anyway, we’re locked into the whole thing by now, doesn’t matter anymore.”

  • modifier@lemmy.caEnglish
    11·
    2 days ago

    The cloud is a tool of oppression in the wrong hands, and it is in the wrong hands.

    Let the sun shine in.

  • leisesprecher@feddit.orgEnglish
    16·
    2 days ago

    Tried to explain that to the higher ups in my org for months.

    They introduced some proxy/VPN that pipes all of our traffic through a service that is not only breaking SSL, but also owned by a US corporation.

    That’s enough red flags to make Mao blush, but nobody saw any problem in it…

      • leisesprecher@feddit.orgEnglish
        4·
        1 day ago

        Let’s say you open Youtube (or any other site) in your browser. Normally, that connection is encrypted end2end, so only Youtube and you see what data is being sent. An outside observer (your employer, your ISP, etc) might deduce from the network traffic that you’re accessing YT, and how long/how much data, but nothing else.

        This encryption is based on SSL/TLS, in a small nutshell, that works by having a chain of cryptographically signed certificates, that proof to you, that YT is really YT, and not someone else (your employer, for example). Attacks like this are called Man in the Middle (MITM). The certificate chain however, needs an anchor. Somewhere to start. These are called Root CA (certifying authorities). Typically these are dedicated companies or large ISPs. Their certificates (the public parts) are stored on your device from the factory (more or less). And thus your device can verify the entire chain of trust from the certificate YT send you down to the RootCA…

        Now, if someone would install a new RootCA certificate on your device, than that entity could become a Man in the Middle, it acts as a relay for all of the traffic going out of your device, can read everything send over the wire - and your device wouldn’t even know it. If that entity would be part of a US company, they would be legally forced to hand over all their data to NSA, FBI, etc. even if the actual data transfer woud happen completely within Europe.

        This is exactly what Twingate seems to do. Crowdstrike and ZScaler are similar products.

        The underlying problem here is that IT security in large organizations doesn’t mean “How can we be secure?”, but “How can we make a legal argument that we did nothing wrong?”. So security clusterfucks like this can be implementend, since the CTO can claim not to have been negligent.

        PS: The description above is obviously very simplified, the Wiki articles for SSL/TLS are much better.

        • Sirius006@sh.itjust.worksEnglish
          2·
          23 hours ago

          Wow, thanks a lot for the detailed explanation. More than enough for me for the moment, but it seems I’ll have more changes to make than I thought, and a lot more research.