

Cloud insurance - petar
http://popalg.org/cloud-insurance

======
oakenshield
I don't quite understand what you're trying to get at. Are you saying that
cloud providers should provide you some sort of insured access to data in case
something catastrophic happens, or are you saying that you should be able to
store encrypted data in the cloud so the cloud provider or another authority
cannot read it?

As for the former problem, cloud storage providers such as Amazon S3 already
provide more redundancy for your data than you could possibly design cost-
effectively on your own (in fact, they even offer a _reduced_ redundancy
service if you don't want to pay for the S3 redundancy).

The latter "problem" isn't really a problem --- it's entirely up to you to
encrypt the data you want to store in the cloud and keep the key to yourself,
and you can easily have an encrypted frontend to your S3 block storage or even
your Dropbox folder. I don't see the relevance of something like SUNDR...
IIRC, it is a way to merely store your data on an untrusted service. However,
most business use the cloud for _computation_ (which of course requires
storage). So SUNDR won't apply when you have to trust both computation and
storage to an untrusted entity?

You could of course run a distribution on your compute node VM that encrypts
data going out of the VM to the cloud provider infrastructure, but the benefit
is limited because your applications are finally running on the provider's
hardware. I suppose we need to wait until that homomorphic encryption stuff
becomes real :)

~~~
F_J_H
I took it to mean protecting yourself from this:

You select a cloud based CRM provider, work with them for a couple of years,
store all your contacts, leads, opportunities, issues there, and then they go
bankrupt, shut down the service, and you have no access to any of your data. A
couple of years of very important data gone...

~~~
petar
Yes. This is what I meant regarding what the problem is. The mention of SUNDR
was more of a side comment on how one might implement a service whose only job
is to store your data without being able to understand it. I wanted to point
out that it is possible. But this is a technicality anyway. The big questions
are:

(a) What does it even mean to require that the cloud companies provide you
with a mechanism of converting the cloud data to some common format that you
can use without the cloud app. In some cases, there might be no such common
format. And,

(b) Do cloud companies have an incentive to play along and provide you this
way out. It would be work for them. Somehow they need to care.

These are questions with unclear answers. Yet, the problem stays: your time
and data are completely unprotected. What is more problematic is that the
common user is not sophisticated enough to be aware of the (high) chances that
the cloud app they use will go bankrupt and shut down leaving them with
nothing.

------
F_J_H
Interesting idea. I've started using a few more cloud apps lately, and the
thought of losing everything certainly crossed my mind again. The problem
thought is often the data is tied to some sort of object structure, which may
be hard to replicate. For example, lately I've built a couple of mind maps on
MindMeister that I would not want to use. However, the data mostly has meaning
in the mind map structure, and having it in raw form, while better than
nothing, would still mean I would need to convert it into something workable
again.

~~~
petar
Valid concern. I wonder what is a good common-denominator solution.

