Hacker News Reader

Comment by jfengel | Hacker News Reader

I don't understand the details of cloud stuff, and it took me a heck of a long time to google just what a "pre-signed URL" was. In case anybody else is in the same bucket (ahem):

Users can't upload to your S3 storage because they lack credentials. (It would be dangerous to make it public.) But you can give them access with a specially-generated URL (generated for each time they want to upload). So your server makes a special URL, "signed" with its own authorization. That lets them upload one file, to that specific URL.

(I dunno about anybody else, but I find working with AWS always involves cramming in a lot of security-related concepts that I had never had to think about before. It puts a lot of overhead on simple operations, but presumably is mandatory if you want an application accessible to the world.)

View on HN

It's a cool feature. You don't need to proxy the upload via your web server. But instead it is directly handled by AWS.

It's nost likely more efficient, faster, and cheaper (no need to handle the traffic and hardware to proxy).

Calling it a "single use upload url" would probably be a lot clearer. Describe the purpose, not the mechanism...

It sure sounds like it. I'm not sure how much of AWS could be clarified by better names, but I suspect it's a lot.

Single use upload URL isn't the only use case for pre-signed URLs though. They are more commonly used for quick-expiring downloads for example.

pre-signed URLs also allow you to set conditions such as file size limit, type of file, file name etc to ensure malicious party isn't uploading a massive 1 TB file into your bucket which you serve as profile pics. However, while amazon S3 supports these "conditions", others like backblaze implementing S3 may or may not implement it. So beware.

Note that limiting content length only works with createPresignedPost, not with getSignedUrl.

If you were building a system with the same architecture, you’d have the same security considerations. Nobody is telling you to use pre-signed URLs, even if you’re using AWS. This is an apples and oranges comparison. A seasoned technologist such as yourself should be able to see past the word “cloud”, understand the architectural differences and the engineering trade offs being made. It’s evident from your comments that you seem to wear this ignorance as a point of pride. I’m no tech hipster and I can still see that this isn’t the good look that you think it is.

you can use an EBS volume attached to the pod, or shared EFS volume as well.

but for certain applications, s3 is simpler to use, especially when you need to scale

I have zero idea what an EBS, EFS, or pod is.

Not that I'm asking for an explanation. Just illustrating how much stuff there is to learn for the basic operation of "run this on your computer", even for an experienced developer. (I've been doing this for nearly 40 years.)

You should probably learn.

I took a class for AWS certification. Even though I never ended up taking the test, it has been extremely helpful throughout my career.

If I ever need it, I will. It's not useful in my area of work so I haven't bothered.

I am curious, so I took the opportunity to look up the strange sounding term "pre signed url". But that's just being a dilettante.

Both Azure and AWS have this feature and it’s very useful to avoid having to proxy large files through your own backend.

Reply on news.ycombinator.com