> They (AWS) should not accept traffic on that hostname until ownership - tightly bound - is proven.
Why shouldn't they ? Don't you think it can be a useful feature ?
Why shouldn't they ? Don't you think it can be a useful feature ?
If someone else creates the bucket on their AWS account, I am stuck. I would have to use a different hostname, or use a more complex workaround. Since creating empty buckets costs nothing, it effectively allows DoSing hostnames from an S3 hosting standpoint.
It would be one thing to allow this behavior if a domain owner explicitly wanted it, via a TXT record or something, but as it is, it's a poorly designed solution.