> the AWS policy execution has a number of “operators” and “operands”

That is correct.

The IAM condition language is flexible and does not prevent you from doing strange things.

It’s a consequence of weak typing choices - not an inevitable result of allowing flexibility.

Doing glob matching on account IDs is like doing concatenation with guids, applying a bitshift to a UTF8 string, or running a regex on an integer. It is a nonsensical operation, and - as shown here - results in surprising security properties of the resulting system.

Surprising security properties are an undesirable result in an access control policy language.

Of course it's possible to create a more sophisticated system with less possibility for user error.

They have ARN's which include the account which a glob match is useful. Something like "arn:aws:*:*:1234567890:*" is useful but "arn:aws:*:*:1234567*:*" isn't

> Anyway, this discussion is a bit amusing to me, since Devops people are discovering side channels[1]

We, the DevOps people, already knew about side channel attacks, Spectre and the likes, evaluated the performances hit for the fixes (or alleged fixes), patched our kernel boot params etc etc. We are curious people, just like many here.

Jesus, I have been in tech for 25 years and we're still throwing shit across this divide.

Well we are, if nothing, consistent.

The next nerd who pinches and inch of the coder/ops divide is going to make a billion.

Figma did this for design-dev and is worth about $40 billion.

It's amazing how anything got made considering how disjointed processes used to be.

Only worth about 10 billion. But still a lot!

The deal was for $20b my mistake.

The Adobe deal didn't go through. Last publicly hinted valuation was back at ~$10B when employee share buyouts happened in JAN 2024.

¯\_(ツ)_/¯

Not GP, I tried to answer as friendly as possible. Their approach is even more weird given that Security goes really hand in hand with systems infrastructure In any small enough organization, security will be managed by devops/sre. If the org becomes large enough, it will start dedicating people to Security.

I didn't think you were wrong I just thought the exchange and its tone was very stereotypical of Developers and Operations (and I was amused). Each being on their side of the fence and only throwing things over the top.

It used to be really bad... "works on my machine", bad deploy instructions etc. We paved a lot of these roads with (really fucking bad) strategies like containers. At some point maybe we will learn to write software that is operationalizable. Projects like tigerbeetle give me hope that this is our next evolution.