Hacker News Reader

tomc1985

It seems like providing sane, secure defaults would be more effective.

But that would probably destroy the onboarding experience, how many tech firms release big products that should have authentication but really don't because of "ease of use"?

(Here's looking at you, ElasticSearch. Did they finally fix this?)

View on HN

In s3 you not only have to mark the bucket as public, but also toggle a safety switch allowing the bucket to be made public, and you have to write an ACL policy allowing public access, and you will get a monthly email from AWS reminding you that this bucket is setup for public access. Oh, and the bucket has the word "public" next to it.

Like, what more can AWS do? Require a blood sacrifice? Call your boss?

Also there's an account-level switch that can prevent any bucket from going public.

Good, because the last time I used s3 (years ago) IIRC it seemed like public was the default

when I installed an ELK stack recently it took a fair bit of effort to get it secured but at least there were big scary warnings that it wasn't

Reply on news.ycombinator.com