Hacker News Reader

Comment by ChuckMcM | Hacker News Reader

Wow, S3 is the gift that keeps on giving. My favorite quote from the article: “Spyfone appears to be a magical combination of shady, irresponsible, and incompetent,”

Amazing how people don't lock down S3 data.

View on HN

Started playing around lately with AWS.

Gosh, getting the access rights to work properly between the various types of controls in place, whether it's the groups, the access policy and whatnot is kind of mind numbing and makes you feel very stupid.

Not that it excuses anything but it is confusing and I can foresee an overworked engineer going "Ah fuck it, no time to read up on that, just go for the easiest stuff to get started on using S3".

That is exactly the problem I see as well. Basically it is so hard to get it working "correctly" (and by that we mean in a way that isn't trivially exposed to the full frontal Internet), that engineers under pressure just punt after getting it to work at all. Sort of "Ok, here it is working, we'll fix the security concerns later, in the mean time try it out." and they get swept into another project because this part is "working" and nobody comes back to to do the hard work of figuring out the right way to make it work.

As a result 'war driving' through the S3 namespace continues to yield up PII, and CUI nuggets of gold to bad actors.

Just AWS's UI confuses me sometimes....

The S3 docs / error responses are so annoying. Very basic questions could be answered with simple examples, but it's almost like they go out of their way to make it hard to do the right thing.

If you give me a couple dozen developers, all of whom has never had to deal with:

1. S3/AWS 2. BackBlaze/B2 3. DigitalOcean/BS/Spaces

And you made a graph for how long it took to do different tasks I would be able to tell which people were assigned to S3 from across the room.

Reply on news.ycombinator.com