That would definitely be a step forward for the jurisdiction objective. But I don’t see how this would dramatically improve supply chain sovereignty and technology sovereignty.
Google acts solely as a technology provider. S3NS secures and manages three dedicated, isolated data centers located in France. Google Cloud Updates are received in a quarantine zone, inspected, and only moved to production once validated by S3NS. Operations, customer support, and contracting are all handled by S3NS under French law.
In this case you’re still dependent on Google to provide both the technology and the updates. Sure they can be inspected and only installed after inspection and validation, but it’s not like you have any alternatives in place. What if Google chooses (or is compelled) to no longer provide any updates?
What if Google chooses (or is compelled) to no longer provide any updates?
Complimentary to everything @Balinares@pawb.social said: Such a contract breach would only happen in a situation where there is an open confrontation between the EU / German and the US… this would be a way bigger thing than blocking some judges.
Well, if you opt to define sovereignty as using solely tech made locally, that’s a valid view, but then you end up hitting a wall pretty damn fast because as it turns out it takes a lot of countries to make everything that goes into a computer. For PC CPUs alone, for instance, you have a choice of Intel or AMD, and neither are European companies. For OSes, there is no 100% EU Linux distro. Even SLES is made of software developed all over the world. So basically, no matter what, you have to draw the line somewhere and that line will involve compromises. Not even China is 100% sovereign, by the above definition.
And, y’know. That’s a good thing, in my book. Better a world where we all need each other. Then autocrats who figure they can totally fly solo soon discover otherwise. Their economy does, anyway.
Regarding GCP updates, yup, under one setup I’ve seen, those are first deployed to a quarantine environment also under the control of a EU entity, and only that entity has the means to allow them into actual prod once validated. And as to withholding updates, ventures like S3NS happen under monster contracts, the breaching of which would incur eye-watering penalties. Ultimately GCP is a business that exists to make money. Eye-watering penalties get in the way of that.
I mean open source would at least make it possible for you to keep going for a bit when google cuts you off, you can then implement patches in your forks.
Sure, that’d be nice. I don’t believe there is anything remotely close to GCP capability that can be assembled from open source. (Wait, is that so hard? Actually yes, getting to the hyper part of hyperscaler is staggeringly complex. There are problems that come up at scale that you wouldn’t even imagine are problems one can have.)
It would be fantastic if the EU funded an open source GCP equivalent, mind you; but then we’re talking basically founding a GCP competitor and years of work for a large number of top engineers. Balance that against just locking GCP into a tight contract that severely disincentives withholding updates and it’s an easy decision.
EDIT: Oh, if you mean, the contracts should force GCP to open source their stack, I don’t see a path to that happening for a bunch of reasons. GCP would just walk away from the deal. That said, a clause that escrows the sources, to be released to S3NS should GCP unilaterally withdraw from the contract, that’s not unreasonable and might actually exist, I don’t know.
That would definitely be a step forward for the jurisdiction objective. But I don’t see how this would dramatically improve supply chain sovereignty and technology sovereignty.
In this case you’re still dependent on Google to provide both the technology and the updates. Sure they can be inspected and only installed after inspection and validation, but it’s not like you have any alternatives in place. What if Google chooses (or is compelled) to no longer provide any updates?
Complimentary to everything @Balinares@pawb.social said: Such a contract breach would only happen in a situation where there is an open confrontation between the EU / German and the US… this would be a way bigger thing than blocking some judges.
Well, if you opt to define sovereignty as using solely tech made locally, that’s a valid view, but then you end up hitting a wall pretty damn fast because as it turns out it takes a lot of countries to make everything that goes into a computer. For PC CPUs alone, for instance, you have a choice of Intel or AMD, and neither are European companies. For OSes, there is no 100% EU Linux distro. Even SLES is made of software developed all over the world. So basically, no matter what, you have to draw the line somewhere and that line will involve compromises. Not even China is 100% sovereign, by the above definition.
And, y’know. That’s a good thing, in my book. Better a world where we all need each other. Then autocrats who figure they can totally fly solo soon discover otherwise. Their economy does, anyway.
Regarding GCP updates, yup, under one setup I’ve seen, those are first deployed to a quarantine environment also under the control of a EU entity, and only that entity has the means to allow them into actual prod once validated. And as to withholding updates, ventures like S3NS happen under monster contracts, the breaching of which would incur eye-watering penalties. Ultimately GCP is a business that exists to make money. Eye-watering penalties get in the way of that.
I mean open source would at least make it possible for you to keep going for a bit when google cuts you off, you can then implement patches in your forks.
Sure, that’d be nice. I don’t believe there is anything remotely close to GCP capability that can be assembled from open source. (Wait, is that so hard? Actually yes, getting to the hyper part of hyperscaler is staggeringly complex. There are problems that come up at scale that you wouldn’t even imagine are problems one can have.)
It would be fantastic if the EU funded an open source GCP equivalent, mind you; but then we’re talking basically founding a GCP competitor and years of work for a large number of top engineers. Balance that against just locking GCP into a tight contract that severely disincentives withholding updates and it’s an easy decision.
EDIT: Oh, if you mean, the contracts should force GCP to open source their stack, I don’t see a path to that happening for a bunch of reasons. GCP would just walk away from the deal. That said, a clause that escrows the sources, to be released to S3NS should GCP unilaterally withdraw from the contract, that’s not unreasonable and might actually exist, I don’t know.