Do you want performance, or correctness.

Well, if you want performance you use write through caching and in the case of distributed storage: more nodes confirming the block before returning. Huge performance cost.

Outsourcing this just means someone else makes these tradeoffs, they will prioritise the general case- and they’re even more incentivised to move the needle towards things that are most visible to the end user.

In this case, performance.

You won’t notice that theres a third commit server off-site (unless that site is bombed), but you will notice slower writes- and the general case says that people will express comparative dissatisfaction with weaker performance and use it as a justification to use another provider.

So any software company/project which actually took the time and effort to fully handle the enormous complexity, they can't sell themselves based on that fact because every other company (who didn't invest the effort) is also claiming it and the customer has no mechanism to verify the claims until some major rare event occurs.

And most of the effort is required precisely to handle those 1% of rare situations.

It's very clearly not about you being able to set-up redundancy for yourself.

Not just in terms of service costs, but in time and complexity. In many cases building out that complexity is complicated and difficult. And sometimes the functionality you need isn't supported in the regions you use.

Now I'm thinking about legal/contractual rules that might force that kind of geographic risk.

I mean, logically you could have the Allowable Location send pre-encrypted backups to anywhere in the world, except (A) laws and regulations aren't always logical and (B) you still have the problem of keeping the decryption keys somewhere safe without leaving the key jurisdiction.

They could, of course, open other regional data centers in other countries, or say "data in this geo zone may be in any of X, Y or Z" countries, but for the latter that pretty starkly limits some of the major customers they'd have, I would guess, and for the former, well, they have other geo zones already, so if people weren't replicating to them, I'm not sure why adding me-east-1 me-west-1 me-central-1 would fix that issue, they just wouldn't replicate there either.

this is one of one of those things - were in the current era either a cloud provider should provide automatic backups in another geographic zone.

if you're in us-east, then your back-ups should ideally be in eu-west + africa for redundancy.

(The obvious option here might be an encrypted backup on some hard drives in a safe in a local office.)

  > I can assure you that lawmakers were not thinking about efficient disaster recovery plans or back ups when they made the laws.

I generally agree, although if a small country only had half a dozen or so redundant data centers then it would be relatively easy for a powerful adversary to wipe out all of the data centers and potentially have a significant economic impact on that country.

Having a backup data center in an ally country might make sense. Kind of like how I keep an encrypted backup hard drive at my parents house. Whenever I go to visit I pull it out and backup my laptop there too.

(I can feel someone saying "but surely having redundancy in one country is good enough, so I'll just say that I know relatively sane people who try to have hemispheric redundancy in their data, and also you never know when two different-in-every-quality-but one locations will suffer from the same disaster. Floods; heat-waves; national protests and strikes. It's surprising how often rare things happen!)

On your second point, it really is crazy. And also amazing that this is a capability that is -- or should be -- available to anyone in the world, not just in the US, and not just devs. Hopefully without also having to think about their data suddenly finding itself in a warzone.

Did Amazon make such a promise? They didn't as far as I know. My understanding is they provide specific guarantees like given an AZ outage, your data is still safe (provided you architect correctly).

You should check your home insurance contract, for instance... It likely would not cover an ICBM strike.

If it dies, we will just have to re-download the data.

And if the data center is more than about 5 years old it almost certainly was not planned with adequate backup power to run racks of GPUs.

Strictly speaking from a missile defense perspective there's an argument 2 sites are a waste of valuable interceptors.

"You choose the AWS Region(s) in which your content is stored. You can replicate and back up your content in more than one AWS Region. We will not move or replicate your content outside of your chosen AWS Region(s) without your agreement."

(or an AWS Outpost thingy, assuming those things work even if the mothership is down)

This was not "a free attack". The goal was and is preventing the world's leading terror organization from acquiring nuclear weapons, especially when they already have the missiles to carry them. It's just a bad situation and the decisions are difficult. Even now, the IRGC continues attacking their erstwhile allies. Those would likely be nukes if they'd had them.

We haven't surrendered anything to them. It's an open secret that the U.S. has been moving oil out of the Strait all along. Of course, all the IRGC does is attack civilian ships because it is unable to do anything against the U.S. Navy, and knows it would face immense pain if it directly attacked American military vessels. Last time the IRGC tried, it lost half a dozen oil tankers that were sitting ducks in the Strait. The only language these people understand is violence. An MoU was signed this summer, but the IRGC had a point to make and resumed attacks shortly after.

And containment hasn't worked well at all. Iran has been building underground facilities for more than two decades. It is very clear that they want to be a nuclear power, and we can't let that happen. The moment you grant Iran any kind of ceasefire or sanction relief, that money goes straight into funding weapons and terrorism.

Well, obviously.

> You don't need missile defense at all because you won't be a target.

No, you don't need it because you have offsite backups. And this is completely disconnected from whether you use AWS or DIY.

> you won't be a target.

Of missiles, maybe in this particular conflict, sure. But running a DC is not your core business, so which DC is more likely to be subject to burglary, power outages, diesel shortages (Amazon will have better negotiators than you), fire suppression, hell, private fire departments if needed, etc…

Was missiles or copper thieves the biggest threat, even there, in 2020? Would AWS or every small company be better at protecting against the latter?

It's true that you are less likely to be a target than a state-sponsored tech megacorp's data centers, but the risk is still present.

I get your main point, but just wanna point out that AWS is one of the largest military contractors in the world. They hold multi-billion dollar contracts from the DoD, USAF, CIA, and more. An estimated $4B a year in military spending goes to AWS

For one thing, regardless of what the US did, they did not launch the attack that damaged the datacenters. That attack was provoked by US actions, but the attack was an intentional and voluntary act by Iran/IRGC. I don't think any of the usual settings for liability for the acts of others really apply here, but I'm not a lawyer.

You'd also need to find a court of competent jurisdiction. The US is out because of soveriegn immunity. The Military Claims Act prohibits claims that "arise from action by an enemy or result directly or indirectly from an act of the armed forces of the United States in combat" [1]. The Federal Tort Claims Act bars "any claim arising in a foreign country" as well as "any claim arising out of the combatant activities of the military or naval forces, or the Coast Guard, during time of war" [2] and precedent recognize a state of war without a declaration.

The courts in the country where the data centers were attacked might not be interested in addressing conduct of the US that didn't happen in their country. The courts in Iran are likely to consider the attack on the data center a legitimate act of war and not a tort; anyway good luck collecting against the US with a judgement from an Iranian court.

Amazon might have a better time making a claim against Iran, in the court where the attacks took place, but good luck collecting a judgement. Maybe a case in the International Court of Justice, but those have to be submitted by a country and involved countries must consent.

[1] https://uscode.house.gov/view.xhtml?path=/prelim@title10/sub... chapter section 2734 (b) (3)

[2] see page 28 and 29 of https://www.congress.gov/crs_external_products/R/PDF/R45732/...

Putin is launching and provoking wars, not the EU.

> you will probably still blame America

No, we would blame Putin, because he's the blameworthy party.

As for Iran, Trump (and Trump voters by extension) is the blameworthy party. I don't even think any other R would have been dumb enough to go at Iran like this.