Re:Hacking misconfigured AWS S3 buckets: A complete guide
by tgmatt on Monday September 09, 2024 @09:49PM
(#41496411)
While this is true, a manager really shouldn't be giving an inexperienced dev enough rope to hang himself with.
Re:Hacking misconfigured AWS S3 buckets: A complete guide
by travismcpeak on Monday September 09, 2024 @10:31PM
(#41496614)
Totally agree with you on this one, it's the role of specialized platform teams + managers to make sure devs have the tools they need while also accounting for their skill level(s).
Re:Hacking misconfigured AWS S3 buckets: A complete guide
by jallmann on Monday September 09, 2024 @10:45PM
(#41496695)
Not everyone has access to a specialized platform team or technical manager; very often it is a solo (or small group of) devs just trying to Get Stuff Done
Re:Hacking misconfigured AWS S3 buckets: A complete guide
by physicsguy on Tuesday September 10, 2024 @02:23AM
(#41497736)
That just can’t work for most companies.
Re:Hacking misconfigured AWS S3 buckets: A complete guide
by lynx23 on Tuesday September 10, 2024 @03:42AM
(#41498215)
Inexperienced devs/admins are always a risk when it comes to infra. There isn't much difference between a misconfigured mysql test user and a freely accessible S3 bucket. One might be more modern then the other, but thats about it. Only real difference is that with cloud infra, junior employees can do more harm then they used to be able to do with local infra, because stuff has grown since.
Re:Hacking misconfigured AWS S3 buckets: A complete guide
by falconertc on Tuesday September 10, 2024 @09:25AM
(#41500552)
Part of this is a consequence of Amazon's hesitance towards shutting down old features. They are getting better at this lately, but S3 remains an example of a system with too many ways of doing things simply because they don't want to take the step of eliminating legacy functionality.
Re:Hacking misconfigured AWS S3 buckets: A complete guide
by echelon on Tuesday September 10, 2024 @10:08AM
(#41500937)
Introduce S4 [1] with a reduced set of configuration options and nudge customers into using it instead. Then eventually make it the default and encourage migrations.
[1] I know the name doesn't make sense.
Re:Hacking misconfigured AWS S3 buckets: A complete guide
by treyd on Tuesday September 10, 2024 @10:17AM
(#41501034)
Super Simple Storage Service
Re:Hacking misconfigured AWS S3 buckets: A complete guide
by alserio on Friday September 13, 2024 @02:47AM
(#41528627)
Simple Secure Storage Service
Re:Hacking misconfigured AWS S3 buckets: A complete guide
by wongarsu on Tuesday September 10, 2024 @11:00AM
(#41501467)
> one of the most simple cloud infra services
Maybe compared to other AWS offerings S3 is a simple service. But on the scale of all services it's incredibly complex. There is no shortage of providers offering cloud storage that's actually easy to set up, and intuitive to set up correctly
Imagine you're a junior dev and your manager says "just spin up an S3 bucket and drop the data there, and make sure your app can access it".
S3 does have some sensible defaults, but a lot of Terraform modules do not...imagine somebody who now has to decipher S3's basic properties, ACLs, IAM, etc.