Rent or Own

In June 2026 a lifecycle rule I didn't control deleted my off-site backup repository. Nothing alerted. The provider's dashboard called the bucket healthy the whole time, and it was right to.

The off-site copy is a Kopia repository on S3-compatible storage — Cloudflare R2. A Kopia repository is write-once in the parts that matter: the metadata blobs describing what the repository contains get written and are expected to stay written. A bucket-wide object lifecycle rule — no prefix filter, which in R2 means everything in the bucket — began expiring exactly those blobs. The storage layer did what it was told. From its side nothing had gone wrong: objects reached their expiry, objects were deleted, no error to report. What found it was a restore drill. Kopia's snapshot verify does flag missing blobs, but it will not repair them — the next snapshot runs incremental over the hole and carries the loss forward, which is issue #3492, closed as not planned.

I own the disks the primary copy lives on. I don't own the bucket. The part that failed was the part I rent.

That's a small instance of a large arrangement. Most of the intelligence any of us runs on now is rented from a handful of companies, on terms we don't set and can't inspect. It arrives as convenience — call an endpoint instead of running the model, let the data live somewhere warm and managed — and the terms move later, on somebody else's timetable.

Rented services also end on somebody else's timetable. On 25 July 2024 AWS stopped onboarding new customers to CodeCommit with no blog post and no deprecation notice; Jeff Barr mentioned it on X five days after it took effect, which is how most customers found out, and the change broke AWS's own Control Tower templates on the way through. Existing repositories keep working and get no new features. Google Domains went the other way — sold rather than shut, roughly 10 million registered domains handed to Squarespace when the deal completed on 7 September 2023, with renewal pricing guaranteed for at least twelve months after that. Neither event is a failure. Both are vendors doing ordinary business, and in both cases the schedule was theirs.

Almost everything I build argues with the arrangement. Offline agents that never phone home. Models that run in a room with no route out. A homelab that exists mostly so the things I depend on depend on me back. From the outside it reads as paranoia. It's closer to wanting the tools I stake anything on to be tools I can still operate on a bad day.

The counter-argument holds and I'm not going to pretend otherwise. The frontier models are better than anything I can run at home, they're cheaper than doing it myself, and I'll always be a version or two behind. I use them daily. June cut the same way: the rented layer failed, and what saved me wasn't ownership — it was a drill.

Scale it up and the stakes change shape. A person who loses a rented tool changes tools. An institution that has put its analysis, its translation and its decision support on infrastructure it can't inspect and doesn't own has nothing local to change to, and learns this on the day interests diverge rather than in advance of it.

The fix was dull. The repository bucket carries a lock rule now, and lock rules take precedence over lifecycle expiry — a rule that wants an object gone at 30 days doesn't get it while a lock says 90. Lifecycle expiry is scoped to a prefix the repository doesn't live under. The restore drill runs on a calendar instead of running when I get nervous. None of that makes the storage mine; the building, the billing and the rule engine still belong to someone else.