> I don't understand the whole 'don't host in US'-thing. It doesn't make sense.
By hosting in the US (or with something that the US claims jurisdiction over) you leave yourself open to other US agencies getting access, sometimes with valid legal documentation, or by just seizing the servers.
There's nothing you can do to stop the NSA having access, so you may as well assume that they've got it anyway. If you're worries about a targeted attack from NSA you're toast anyway, and if you're worries about them slurping the data - well, they're going to do it, so you can try to use encryption and hope everyone communicating with you is also encrypting. Obviously, this leaves you with metadata, which the NSA is also slurping.
But I agree that people saying "don't host in the US" seem to have it backwards quite often.
Not hosting in the US removes an attack vector, and a particularly nasty one. If I have to choose between being spied on passively, or having armed thugs with guns come in, ransack my house, and steal my equipment with the hosting provider's blessing.. well, you can see where I'm going with this.
By hosting in the US (or with something that the US claims jurisdiction over) you leave yourself open to other US agencies getting access, sometimes with valid legal documentation, or by just seizing the servers.
There's nothing you can do to stop the NSA having access, so you may as well assume that they've got it anyway. If you're worries about a targeted attack from NSA you're toast anyway, and if you're worries about them slurping the data - well, they're going to do it, so you can try to use encryption and hope everyone communicating with you is also encrypting. Obviously, this leaves you with metadata, which the NSA is also slurping.
But I agree that people saying "don't host in the US" seem to have it backwards quite often.