robinwarren

The ft has some good stuff, this is probably a good jumping off point https://www.ft.com/content/c7bb24c9-964d-479f-ba24-03a2b2df6...

That's really cool to hear. We used to make use of the toy library in Bristol when we lived there, it was a great way to get toys the kids could play with for 2 weeks then return them when they got bored :)

I did a lot of listening to the griefcast (podcast with comedians talking about people they lost) recently which I think helped me. No idea if that's good advice and the people on it skew heavily uk centric so you might not know any of them. Good luck!

The plan at the moment is to use this as a lead magnet for our main (paid) tool https://www.bluecatreports.com/

But, possibly we will discover some need for features we could add to a paid version of this in future.

I think this was a deliberate move from the Trello team not to implement this. They were very much focussed on the "not developers" market and didn't want to implement features which were mostly only of interest to a developer audience. It seemed to work quite well for them commercially :)

Trello don't allow any more fine grained access than this. Power-ups can request view and write access and that is about it. No way to say we only want access to the current board or etc. Or that we only want to be able to update labels/members but not add comments.

They have been talking about changing that, but I understand it is complex and never really becomes a priority

It would also be software dev 101 for an organisation of AWS's size and clout to do some pretty basic things - If someone's costs increase drastically (ie spending in 24hrs what they spent in the last year or etc.) then maybe flag it up to them - If the above is combined with costs on services/regions they've not used, definitely maybe contact them? - If the above is combined with a well known exploit used on compromised accounts, again maybe contact them?

Not saying the OP has no responsibility here. Just that I don't think it is that black and white. There is plenty AWS could do to avoid this sort of thing happening. Totally fair to call them out for that. Especially when the cost of phoning support is $2-3k specifically because of the new costs on your account!

Fair enough, I did read this somewhere but it is obviously wrong now I check it out. Thanks!

Note, I think, you also need to be GDPR compliant for EU users when they are not in the EU. So I don't think IP blocking actually works for 100% of cases.

I would suggest not getting too hung up on this, it is showing you the worst outcome and assuming you have made a good effort to be compliant I should think things would be fine even then. No doubt you have Ts and Cs, that document is full of clauses put in place because of things like this, and any of them could probably result in a worse letter from a customer wanting to sue you over something. But I image also that hasn't happened to you yet either?