Hacker News Reader

I think the philosophy is that the trust boundry is your host, not your uid. We seem to be migrating towards "one instance per application" from of the traditional "one uid/proc per application". For the great majority of use cases this is going to be the simpler, and safer assumption.

Another concern is the EC2 Instance Metadata Service does not support SSL.

This is true, but I'm not sure if I understand how SSL support for this would increase security since the request and the response go no further than our internal network.

https://github.com/boto/boto/issues/811