Hacker News new | past | comments | ask | show | jobs | submit | fhoffa's comments login

Hi, Felipe at Snowflake here.

Here is the latest from Snowflake on this issue: https://community.snowflake.com/s/question/0D5VI00000Emyl00A...

We'll keep updating that URL with any further news.


So, just to be clear because I found your link filled with a bit too much corporate speak:

1. The linked Hudson Rock post is explicitly claiming that the breaches at Ticketmaster and Santander Bank were caused by a Snowflake employee whose credentials were compromised.

2. This bullet point, "We did find evidence that similar to impacted customer accounts, the threat actor obtained personal credentials to and accessed a demo account owned by a former Snowflake employee. It did not contain sensitive data." (emphasis mine) says pretty clearly to me, then, that Snowflake believes the Hudson Rock account to be false.

So is that a correct understanding then?


The OP Hudson Rock writes something that I understand is saying: This was more than a breach of one customer's credentials, they got some employee creds and they weren't protected by 2 factor so they got into other customer accounts using that engineer's creds.

The snowflake writeup reads to me as if a customer's account creds got compromised - and it implied to me that was the end of it, no central or other account access on thoes creds. Nothing about this use of some employee account info that didn't have 2 factor auth on it.

1. I'm sure snowflake wants all access creds of any kind for their internal employees to use 2fa.

2. It used to be at least as a customer you could create a name/password without 2fa to log in to your own info there if you wanted to, like say as a customer you create a db or table and want to access it.


For 1. Those accounts would be set up by customers, so if they didn’t require 2FA, it didn’t happen.


Will there be any direct comment regarding the article here?


The linked post now contains unambiguous denials of the majority of claims in TFA, and TFA has been taken down.


the ad for protection services?


Yes, I know... I've seen that, also the posts on Reddit/HN and so on, but I am just curious if there is some truth to it.


snowflake has released a handful of statements and articles. giving attention to the ad would only be promoting it. unlikely to be allowed.


The salesforce.com servers are temporarily unable to respond to your request. We apologize for the inconvenience. Thank you for your patience, and please try again in a few moments.


Sill down. “…Visit http://trust.salesforce.com for current system status and availability.”


AppEngine today is wildly different to the App Engine I fell in love with 15 years ago.

Since you're checking notes, please check out all the AE service deprecation notes.

Disclosure: I worked for Google for ~10 years, and I fought internally many of those deprecation decisions. I did not succeed.


Google making AppEngine in the first place always felt weird to me. It was great for some web developers, but outside that use case, really not so much. But it came with a great collection of side technologies, which got unbundled (Datastore, etc) because there were folks (like me) who wanted to use the side tech but not AE itself (for many, many years you couldn't "import numpy" but people would still say "see? We have a cloud, it's called AppEngine").

Once enough things were unbundled from AE, and containers became popular, it wasn't really clear what AE provided that wasn't better solved by more standard tech.

Often times, Google leadership simply didn't understand what its own engineers and product managers knew. People told me for years "we can't do cloud because the profit margins are too small", and now look: Google is a perenially third-place in Cloud but has committed itself so much they can't even shut it down if they want to.


No, we all just migrated the decision of using GAE to using Cloud Functions / Run / Tasks, which is fine. Those are easier for Google to scale over time, than AppEngine.

The problem with AppEngine was that they had to heavily modify the runtimes for isolation... the JVM needed to be secured and that meant maintaining a separate fork, which also meant being perpetually always behind in versions. It also meant any upgrade had to go through a huge security evaluation.

So, moving to another process model, containers, worked much better.


> AppEngine today is wildly different to the App Engine I fell in love with 15 years ago.

I see that as a good thing, it means they are still working on it.


Have you actually been using it for 15 years?

My guess is not, or you would have a different opinion. But that's just a guess


Poor comment and poor guess.

My best friend Jeff started working on Objectify in 2009 after I convinced him to use GAE. I have built two businesses on it. One did $80m in revenue in the first year and I guarantee we couldn’t have done it without GAE.

Now give me back my downvote please.


Wait, you just said in a separate comment that you migrated away from App Engine.

You also just said that you used it very effectively back when it was a different thing.

I think we agree in many more ways than we disagree.

Source: https://news.ycombinator.com/item?id=38020604


Ugh, now you're making me explain myself due to your poor understanding of what I was saying and taking different comments in different threads out of context.

"We migrated"... meaning that over time, everyone is migrating from the concept of using GAE as a first choice, to using things like Run/Functions. Not that I actually physically took code for GAE and moved it to R/F. For example, my last project, I choose to use GCF, instead of GAE. The reason I went straight to GCF is because it is effectively what GAE has morphed into today. This isn't a slight on GAE at all. I've updated previous comment to hopefully clarify this for you.

Again, I have used GCP extensively since about 2009. By the way, much of what you use today was a result of things I did back when I co-founded the Jakarta Apache project, open sourced Tomcat from Sun, brought Lucene under the umbrella, blah blah blah... I've been around the internet since 1991.


This is awesome, thanks for all the background info. Now let me give you an example of App Engine deprecating stuff:

- In 2012 App Engine deprecated the "Conversion API".

- They notified this deprecation in August 2012, and they told users it would stop working only 3 months afterwards.

- You were affected by this deprecation.

- You created an alternative to it, that worked on Heroku.

Source: https://groups.google.com/g/google-appengine/c/-JJccGx5RRk/m...

Did I get this right?

You are awesome. We are just choosing to remember the past with different colored glasses.


Yea, they deprecated something. I even noted that the market is small for it in the thread. I built another solution in a short amount of time, and even gave it away because it really wasn't something people were using a lot of. It was a super niche product. That also wasn't even AppEngine, it was just a nice to have, for me, sub-service.

There was a point where people were upset about GCP and Google changed their whole deprecation policies to be more vocal and longer term about things.

I really don't understand your point. What's the big deal?


You think we are disagreeing, meanwhile I just love how much I've learned (and confirmed) thanks to your replies. Thanks for sharing!


backwards compatibility is a big deal in infrastructure. when a serious provider has bold new ideas, you release appengine2.


FWIW, I now analyze the Stack Overflow dumps on Snowflake

https://medium.com/snowflake/how-to-load-the-stack-overflow-...


Thanks for sharing, good to see alternative options popping up. My wish is that the Stack Exchange dataset could one day be provided as a streaming parquet or arrow table, as underfunded grads and post-grads could then more easily/selectively sample the datasets (similar to how Huggingface provides some of its datasets)[1][2].

The Hugginface repo unfortunately prefilters some of the tables/rows according to some criteria, making it less usable for general analytical queries that the BQ or SEDE datasets enable. If anyone knows of an 'XML-streaming' solution that directly samples from the Internet Archive's data dumps, I am all ears.

[1]: https://huggingface.co/docs/datasets-server/rows

[2]: https://huggingface.co/datasets/HuggingFaceGECLM/StackExchan...


Looking at that source, there's a pretty straightforward explanation of where the page views come from.

- Last month, Stack Overflow had ~142,575,642 visits.

- Last month, Google gave 127,896,508 visits to Stack Overflow

- Last month, Bing gave 7,491,274 visits to Stack Overflow

You could say that the Stack Overflow # of pageviews depends mainly on:

- How often people are searching Google/Bing for answer.

- How often Google/Bing rank Stack Overflow high enough for people to click into it.


I love this, thanks!

How we could we add Snowflake to the compatibility matrices?

It's popular enough to deserve it, IMHO.

https://db-engines.com/en/ranking


"More popular"? Citation needed, please.

In terms of measuring popularity, I love

https://db-engines.com/en/ranking

Google Trends is interesting too

https://trends.google.com/trends/explore?date=2021-04-24%202...

Disclosure: I work for Snowflake


Oracle is the most popular DB? I’ve never run into an Oracle DB in my entire career


I've seen the opposite: It's hard to find a large company that doesn't use Oracle (but many would love to get away from it)

See this chart from Gartner DBMS Market Share stack ranks - Oracle was #1 for a long time:

- https://www.linkedin.com/posts/aronthal_dbms-gartnerda-cloud...

Snowflake is now #9 on this chart.

(high res: https://media.licdn.com/dms/image/D4D2CAQGZqgH3ta2R0A/commen...)


What I’ve seen: most big companies have one or a few Oracle databases and hundreds or thousands of “all other DBs”, including licenses for MS SQL Server.


Example: Amazon

(Formerly)


It's interesting that Alibaba cloud and Huawei are ahead of Snowflake


Corporate and education is infested with Oracle due to an army of salesdroids and large technical platform decisions being made by upper mgmt instead of infra staff.

I've also observed that Oracle stack people generally don't have experience with other platforms, so push it in whatever org they're working for.


Sounds like that's a you issue, not one for Oracle.

Don't mean to sound dismissive but that what your post reads like, jut because I've never encountered a brown rat does not mean it's not the most populous animal species on earth


It's extremely possible to have never run into an Oracle DB in an entire career (in the depts you worked in), and moreover it's quite possible to use one database in finance and another in engineering or operations (Postgres or cloud). It merely means you haven't worked at the type and size of organization that tends to license Oracle, or more specifically only in some depts. And sometimes the org didn't voluntarily pick Oracle for technical reasons, it was mandated by the end-user, or for compliance, or application stack, or Oracle's sales team beat out technically superior/more cost-efficient competitors.

None of that is denying Oracle exists.

And that isn't even an 'issue', just an observation. I imagine this used to be similar with encountering IBM DB2 or SAP or Amdahl or melamine deskphones and partitions, but I assume you wouldn't say those are issues.


PS Oracle cloud didn't even have EU sovereign regions until 2022(!)


Pretty sure the most populous animal species on earth would be some type of insect, probably an ant or a locust. According to wikipedia there are estimated to be over 1.4 billion insects for each human on Earth. Rats are numerous but not nearly that numerous.


The Google Trends for "Snowflake" the company are clearly polluted by "Snowflake" the topic: https://screenbud.com/shot/1df2725e-0faf-4795-b066-585d0857d...


don't disagree with what you said, but your Google Trends argument has a big asterisk against it - right in the page it says "This comparison contains both Search terms and Topics, which are measured differently. LEARN MORE"


I hear what you say. But does it change anything?


Yes, efficacy of your argument


As a data point, if you examine something more granular and trend/topic tied, like Snowpark (which is close to Clickhouse alone) or "Snowflake Table" I would propose the overall point being made kind of stands.

The original term is ambiguous (I wish Snowflake had different branding) but more specific terms to Snowflake still rank high and are maybe less wonky of a comparison.


No account is required to read this, did you try?

I opened it with an incognito window, no problem.

I opened it with a logged in window, no problem.

Some authors try to monetize their posts. Not this one.

I'd love to know if your experience was somehow different.


On https://reddit.com/r/googlecloud someone noted that the latency between Europe and Asia doesn't look good.

The answer was

> There's not a lot of connectivity between Europe and SE Asia the "short" way. This is not Google-specific, compare cables across Atlantic and Pacific vs. across the Indian Ocean at https://www.submarinecablemap.com/


Give them a minute. Everyone is going through uncertain times. Hope you're doing well!


Thanks. Well so far. Same to you


A big hug to all my friends at O'Reilly. Their conferences have been a big part of my career. Not only as a speaker, but I've met so many awesome people at their lunch and social occasions.

As a for-profit endeavor they have also given amazing opportunities to a diversity of speakers and topics. For many speakers it means a lot when the conference is willing to pay for their travel expenses.

Looking forward to meet you all again!


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: