Skip to content
Register

'Enterprise-grade' on budget hosts is meaningless

General Discussion by salavi 14 replies 2.2K views
salavi

Member OP

Threat Modeler

6 #1

I threat model every provider before purchase. Assume compromise: the marketing material is the first attack surface. When a $4/month plan advertises "enterprise SSDs," I assess the blast radius of that lie.

What I have found: "enterprise-grade" on budget infrastructure is a linguistic zero trust violation. The drives are consumer units with custom firmware. The "DDoS protection" is upstream null-routing with a dashboard. The "redundant power" means a UPS that beeps.

I want specific contradictions you have observed. Not theoretical. Observable lies between claim and machine. What is the most egregious example, and how did you verify?

playersofia

Member

#2
salavi said:
Observable lies between claim and machine

I encountered a provider advertising "dual-stack enterprise network" whose IPv6 address space was tunneled through 2001:470:6c:81::2/64, which is Hurricane Electric, not their own transit. Their legacy IP was native. This is not dual-stack; this is address space theater. NAT for IPv6 is what they were effectively selling, and I will not compromise on that.

lucgone

Member

Le Baguette

#3

I reviewed the Contabo acceptable use policy last month; they reserve the right to define "enterprise" subjectively. Section 4.1 further disclaims warranty of fitness for purpose. You are not purchasing enterprise infrastructure; you are purchasing the right to use that phrase in your own marketing.

Vive la résistance... électrique
olespete

Member

Trust No One

#4

WARNINGS: "enterprise firewall" on budget hosts often means a single iptables rule with a fancy name. What could go wrong: your neighbor gets compromised, lateral movement happens, your "isolated" environment is on a flat bridge, fail2ban is not installed by default, the "hardware firewall" is a software appliance running on the same oversubscribed host!

I have seen "enterprise backup" that was rsync to another drive in the same chassis. 👀

airgapped, encrypted, faraday'd, still worried
pieter_rtm

Member

#5
  • Advertised: "dedicated cores"
  • Reality: vCPU pinned to thread, not core, on E5-2680v2
  • Observable via: lscpu, then check stepping against ark.intel.com

As said, we stopped using "enterprise" in 2024. Now we say "datacenter-appropriate" and list the exact hardware generation. Dry but honest.

Containers before it was cool
Fritz48

Member

Datenschutz First

#6

Cannot produce a processing agreement or subprocessor list, the term is legally hazardous, not merely misleading. I requested documentation from a German budget host last year; they sent a one-page PDF with a padlock clip art. This is not enterprise. This is liability exposure dressed in marketing language.

Neuland. Aber schnell.
CR

Member

#7

Address space theater is the perfect term for it

lucgone

Member

Le Baguette

#8
pieter_rtm said:
VCPU pinned to thread, not core

This is the gap between "dedicated" and "dedicated to deception." In Lyon we have a word: arnaque. But your method is clean. lscpu, ark.intel.com, done. I will add this to our onboarding checklist for any new provider.

The E5-2680v2 is Haswell-EP, launched 2013. Calling this "enterprise" in 2024 is calling a Renault 4 a utility vehicle. It moves, yes, but not with warranty.

Vive la résistance... électrique
pieter_rtm

Member

#9
lucgone said:
Haswell-EP, launched 2013

Correct. And the v2 stepping is specifically the refresh, still 22nm. We see these in Rotterdam colo resold as "prosumer" by hosts who bought decommissioned hyperscale stock. The honest ones say "vintage compute, priced accordingly." The dishonest ones say "enterprise heritage."

I have a spreadsheet. Would share but it names hosts and I prefer not to litigate.

Containers before it was cool
salavi

Member OP

Threat Modeler

#10
olespete said:
rsync to another drive in the same chassis

This is not backup. This is redundancy theater, same genre as playersofia's address space theater. The blast radius of chassis failure includes both copies. I have verified this by asking providers: "What is the physical distance between primary and backup?" The honest ones hesitate. The liars say "enterprise-grade resilience."

I now require independent verification of backup geography. Not datacenter name. Rack row, if possible.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft