Hacker News Reader

"It should be emphasized that a public bucket is not a risk created by Amazon but rather a misconfiguration caused by the owner of the bucket."

So not really a hole so much as it's configured that way. Title implies that this is a breach of some kind, which it's not.

View on HN

Yeah, what's the point of this article? Public buckets are public, who would guess?!

Seems to be really about misconfiguration and serving as a reminder for developers to check permissions on AWS buckets. While some data is obviously stored in public bucks for a reason, it's clear that much of the data Rapid7 was able to find in the "open" buckets was not intended to be made available to the public. It's not a security flaw with AWS, but an administrative oversight really, but at least a good reminder for everyone to go check their buckets :)

The point seems to be that this is a really common misconfiguration and you should probably double-check to make sure you did yours right.

Reply on news.ycombinator.com