3 ms·

Link as originally submitted leads to a commit message where the submitter, maintainer of git-annex-remote-rclone, a tool which wraps the multi-provider cloud s

Link as originally submitted leads to a commit message where the submitter, maintainer of git-annex-remote-rclone, a tool which wraps the multi-provider cloud storage client rclone [1], makes the following comment: "Amazon has, without warning, revoked the API keys necessary for users to access the data that Amazon's paying customers have entrusted with Amazon. A data storage offering that simply stops working one day is not a data storage offering at all." In effect, this is a self-submission to an opinion that leads to a dead end; I propose a better source is this reddit thread [2] which includes a screenshot of an email from Amazon support confirming the news. As another poster writes, Amazon has revoked rclone's OAuth2 API key. However, consider that rclone's default OAuth2 client id and secret are compiled into the rclone executable, and thus effectively public; aka. anyone can extract them and pretend to be rclone, and fool users into obtaining access and abuse them for unrelated purposes. A far better option is for the cloud provider to let users generate their own OAuth2 clients, such as Google does (and supposedly Microsoft, although for me it's always errored out). Unfortunately, Amazon has a "call us" style of Developer access, which effectively translates to no new API access being granted to these types of users. The speculation around the web is that Amazon also wanted to shut this down because they offered "unlimited" storage, and people were using it to store very large amounts of hard-to-compress, hard-to-dedup data. Breaking a popular tool used to accomplish this (e.g. it supported on-the-fly encryption, producing the exact style of difficult data) will cause some portion of less profitable users to migrate elsewhere. This may or may not be true, but it's certainly an intriguing point. [1] https://rclone.org/ https://rclone.org/ [2] https://www.reddit.com/r/DataHoarder/comments/6c3mnv/amazon_confirmed_rclone_is_revoked_aka_banned/ https://www.reddit.com/r/DataHoarder/comments/6c3mnv/amazon_...

DanielDent 9y ago
My submission was unnecessarily terse. Thank you for expanding upon it. I agree with all your points about OAuth2 clients. But I would also add: All clients (Amazon official or not) will ultimately need to have API keys compiled into them, and/or use a (less secure for the user) remote service to do the OAuth flow. And for all of these clients, it will be possible for users to obtain the keys with some very simple reverse engineering and/or protocol analysis. Which makes this entire thing seem like a real waste of everyone's time. Provide an API/service available on the internet, or don't. Trying to tell people exactly which configuration of which software they should use to access your service is both disrespectful of your user's freedom as well as a fool's errand.

DanielDent 9y ago

My submission was unnecessarily terse. Thank you for expanding upon it. I agree with all your points about OAuth2 clients. But I would also add: All clients (Amazon official or not) will ultimately need to have API keys compiled into them, and/or use a (less secure for the user) remote service to do the OAuth flow. And for all of these clients, it will be possible for users to obtain the keys with some very simple reverse engineering and/or protocol analysis. Which makes this entire thing seem like a real waste of everyone's time. Provide an API/service available on the internet, or don't. Trying to tell people exactly which configuration of which software they should use to access your service is both disrespectful of your user's freedom as well as a fool's errand.