David Crossland's Blog

The Guardian recently posted an article quoting Richard Stallman on cloud computing. If a user wants to use network applications in freedom, they can do their own computing on their own computer with their copy of a freedom-respecting network-accessed program if their computer is a network server. Is this a good idea? Yes, I think so.

While this is not the common vision of “cloud computing,” I think that is what critics of “cloud computing” like autonomo.us should be enabling people to do.

Amazon offers a popular “elastic cloud computing” virtual server hosting service, where users upload a GNU/Xen-Linux system disk image which is booted but for which bandwidth, storage disk and processing power is ‘elastic’ - can scale arbitrarily, and on demand. I have not used this service, but I hear it is very simple to use with a pre-configured disk image.

I wonder if putting a system disk image together for services like this, consisting of only free software suitable for the common tasks people use proprietary cloud computing for, and that is configurable with a simple ‘installation wizard,’ would be a good way to provide a practical alternative to cloud computing?

These common tasks seem to be e-mail (Microsoft Hotmail, Google Mail) calendars (Google Calendars) collaborative authoring/spreadsheets (Google Docs) task management (37signals BaseCamp) and blog/status/photo publishing (Blogger/LiveJournal/WordPress, Twitter/identi.ca, Flickr/Picasa, and omnipotent Facebook). The programs behind WordPress and identi.ca seem to show the way forward with “federation” features that allow users to run their own programs while benefiting from the ‘network effects’ typical of centralised services.

Running your own cloud usually means renting a virtualized computer. Or renting a physical computer, or renting space in a telehouse rack with your own physical computer, or leaving your desktop computer turned on 24/7 and connected via residential DSL with a static IP address as Chris does - but I don’t think there is any real difference in terms of freedom here.

This is typically seen as very complex, but I think services like Amazon make it much easier than it used to be.

Renting a computer brings up another issue though, which Richard Stallman brought up with me when I asked him about this: “Do you trust [the computer landlord] not to let the bad guys (such as the police) into your machine?”

I am not sure how to answer that question, and my uncertainly is summarized as: would you trust Amazon?

A small personable and ‘trustworthy’ ISP seems just as vulnerable to haxor attacks or surveillance requests from the state as a large corporate ‘faceless’ ISP to me.

I also wonder about why any bad guys would want access to a personal network server any more than a laptop. Simple vandals trawl the net for unpatched servers (and laptops…) but a personal network server would have a simple authentication lock that would adequately prevent such vandals from accessing out of date server programs.

Obviously the state wants to get into machines to fight crime, and as I’m not a criminal that’s okay - but it also wants access to fight political dissent, and as an activist I am wary about that. But the simplest, cheapest and most common way for the police to get into a machine and to stifle the operator’s dissent is to seize it. People who meet active stifling of their political network activity, say like The Pirate Bay, adequately mitigate that with backups in multiple jurisdictions, so that when any server is seized, another is put online within in a few days.

If the state wants to have covert access without disconnecting the machine, that also seems straightforward, although more expensive; the way the UK surveillance law works, citizens made complicit in surveillance activity (eg, being forced to reveal crypto passwords) face up to 2 years in jail if they tell anyone about it. And police ask ISPs for things without forcing them and ISPs routinely bend over; I suppose thats the difference between a small personable company and a backstabbing corporate one. And for unlawful forced access, I think it is impossible to totally secure against that, since individuals acting alone have annually gained illicit root access to governmentally-secret computers the last 30 years.

But getting into machines covertly seems unnecessary; the tap is better done ‘upstream’ at the network switch. And it's well known that spy agencies have total access to all network traffic with systems like Echelon and Carnivore. (So if I was involved in political dissent forcefully opposed by the state, then probably I would avoid using computer networks. The Unabomber did alright that way… ;-)

I agree it is good to mention this issue when publicizing the problems of cloud computing. But it seems to me that in the current political climate the answer to the question is always, “I do not trust the computer landlord not to let the bad guys (such as the police) into my rented machine, just by asking.”

Yet avoiding cloud computing with programs you control but on servers you rent does not do anything to help resolve this.

This article by David Crossland, except the quotations and unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Share Alike 3.0 Unported License.

• Viewpoint: Seven Technical Security Benefits of Cloud Computing
• Cloud Security: The Need for Two-Factor Authentication in Cloud Computing
• Cloud Computing Is for Stupid People - Richard Stallman
• SYS-CON's November "Cloud Computing Bootcamp" Expected to be Sold-Out