Comment by dredmorbius
5 days ago
1. If you're hosting third-parties at scale (as in: more than one), you'll have procedures for validating ownership and access.
2. That doesn't actually seem to be Iron Mountain's argument here, though the reporting isn't crystal on the point.
For the first level customers, sure. But their customers’ customers? Almost certainly not.
There is no way for Iron Mountain to determine who OSS’s customers are, and their permissions, without help from OSS itself.
And because OSS is defunct, they can’t get that help.
So imagine I decide to make some tool to let my customers store their files. I just decide to toss them all in a big fat S3 bucket behind the scenes with what look like random UUIDs for the keys in the bucket. All the relationships between whose files are whose are in some other database not hosted on AWS.
How does AWS then determine which files are whose when my angry clients go knocking on their doors because I've decided to disappear?
1 doesn't hold: you validate ownership and access by customer. OSS is the customer not PBS. OSS owns that process for PBS, not IM. It might not be technically possible (encryption, mixed data, sharing, ACLs). It might expose private data of non PBS OSS customers. It might violate the contract they have with their clients like OSS.
2 it doesn't say either way. From owning systems like this, I'd assume there's some degree of "we have no idea what's in this bucket and can't just hand it over to random person asking for it".
Context: I owned a photo backup startup. 8.6 billion photos. Some might be yours, most are not. If you went to AWS and asked for a copy of the bucket, they rightfully wouldn't have complied.