News for hackers. Stuff that matters.
Re:Twilio: Someone broke into our AWS S3 silo, added 'non-ma... by nitrogen on Wednesday July 22, 2020 @11:54AM (#23918324)
IMO this is code/console dichotomy is a design flaw in most cloud offerings that will haunt the industry for a long time.

The web console should be just another UI for editing the configuration in source control. As an example of why that's important, a UI can give you a warning and use affordances to guide beginners away from dangerous setups. In the case of S3, a slider for basic access level can use colors and show a list of objects that would become world readable or writable at a given level (for that matter why is world writable even an option?). A giant YAML file looks the same whether it's safe or dangerous.

If you really don't want to use a UI, then maybe abstracting a linting layer that feeds the exact same warnings to the UI as to your CI system and text editor would help.

Re:Twilio: Someone broke into our AWS S3 silo, added 'non-ma... by SV_BubbleTime on Wednesday July 22, 2020 @12:29PM (#23918734)
> The web console should be just another UI for editing the configuration in source control.

Should. But isn’t.

So until it is, IaC for production. Console or CLI for development.