News for hackers. Stuff that matters.
Re:Hacking misconfigured AWS S3 buckets: A complete guide by travismcpeak on Monday September 09, 2024 @03:12PM (#41492386)
This does a great job of highlighting why properly configuring infrastructure is hard: S3 buckets (one of the most simple cloud infra services) have 70 configuration options.

Imagine you're a junior dev and your manager says "just spin up an S3 bucket and drop the data there, and make sure your app can access it".

S3 does have some sensible defaults, but a lot of Terraform modules do not...imagine somebody who now has to decipher S3's basic properties, ACLs, IAM, etc.

Re:Hacking misconfigured AWS S3 buckets: A complete guide by tgmatt on Monday September 09, 2024 @09:49PM (#41496411)
While this is true, a manager really shouldn't be giving an inexperienced dev enough rope to hang himself with.
Re:Hacking misconfigured AWS S3 buckets: A complete guide by travismcpeak on Monday September 09, 2024 @10:31PM (#41496614)
Totally agree with you on this one, it's the role of specialized platform teams + managers to make sure devs have the tools they need while also accounting for their skill level(s).
Re:Hacking misconfigured AWS S3 buckets: A complete guide by jallmann on Monday September 09, 2024 @10:45PM (#41496695)
Not everyone has access to a specialized platform team or technical manager; very often it is a solo (or small group of) devs just trying to Get Stuff Done
Re:Hacking misconfigured AWS S3 buckets: A complete guide by physicsguy on Tuesday September 10, 2024 @02:23AM (#41497736)
That just can’t work for most companies.
Re:Hacking misconfigured AWS S3 buckets: A complete guide by lynx23 on Tuesday September 10, 2024 @03:42AM (#41498215)
Inexperienced devs/admins are always a risk when it comes to infra. There isn't much difference between a misconfigured mysql test user and a freely accessible S3 bucket. One might be more modern then the other, but thats about it. Only real difference is that with cloud infra, junior employees can do more harm then they used to be able to do with local infra, because stuff has grown since.
Re:Hacking misconfigured AWS S3 buckets: A complete guide by falconertc on Tuesday September 10, 2024 @09:25AM (#41500552)
Part of this is a consequence of Amazon's hesitance towards shutting down old features. They are getting better at this lately, but S3 remains an example of a system with too many ways of doing things simply because they don't want to take the step of eliminating legacy functionality.
Re:Hacking misconfigured AWS S3 buckets: A complete guide by echelon on Tuesday September 10, 2024 @10:08AM (#41500937)
Introduce S4 [1] with a reduced set of configuration options and nudge customers into using it instead. Then eventually make it the default and encourage migrations.

[1] I know the name doesn't make sense.

Re:Hacking misconfigured AWS S3 buckets: A complete guide by treyd on Tuesday September 10, 2024 @10:17AM (#41501034)
Super Simple Storage Service
Re:Hacking misconfigured AWS S3 buckets: A complete guide by alserio on Friday September 13, 2024 @02:47AM (#41528627)
Simple Secure Storage Service
Re:Hacking misconfigured AWS S3 buckets: A complete guide by wongarsu on Tuesday September 10, 2024 @11:00AM (#41501467)
> one of the most simple cloud infra services

Maybe compared to other AWS offerings S3 is a simple service. But on the scale of all services it's incredibly complex. There is no shortage of providers offering cloud storage that's actually easy to set up, and intuitive to set up correctly