4 ms·

It's definitely using AWS Lamba, I spun up a trial account and texted myself the output of JSON.stringify(process.env)... Edit: adding linebreaks... 2nd edit:

It's definitely using AWS Lamba, I spun up a trial account and texted myself the output of JSON.stringify(process.env)... Edit: adding linebreaks... 2nd edit: Realized there were AWS access tokens in there. It's probably not a good idea for those to be exposed to the environment they're running this user generated code in. They should probably be wrapping these in vm.runInNewContext() { "PATH":"/var/lang/bin:/usr/local/bin:/usr/bin/:/bin", "LANG":"en_US.UTF-8", "TZ":":/etc/localtime", "LD_LIBRARY_PATH":"/var/lang/lib:/lib64:/usr/lib64:/var/runtime:/var/runtime/lib:/var/task:/var/task/lib", "LAMBDA_TASK_ROOT":"/var/task", "LAMBDA_RUNTIME_DIR":"/var/runtime", "AWS_REGION":"us-east-1", "AWS_DEFAULT_REGION":"us-east-1", "AWS_LAMBDA_LOG_GROUP_NAME":"/aws/lambda/ZDfb2ab7cd7ac1734d9a1a06a018a1c522", "AWS_LAMBDA_LOG_STREAM_NAME":"2017/05/25/[$LATEST]2d7b70d5a6914e3980f081ba96c9d4ab", "AWS_LAMBDA_FUNCTION_NAME":"ZDfb2ab7cd7ac1734d9a1a06a018a1c522", "AWS_LAMBDA_FUNCTION_MEMORY_SIZE":"512", "AWS_LAMBDA_FUNCTION_VERSION":"$LATEST", "_AWS_XRAY_DAEMON_ADDRESS":"169.254.79.2", "_AWS_XRAY_DAEMON_PORT":"2000", "AWS_XRAY_DAEMON_ADDRESS":"169.254.79.2:2000", "AWS_XRAY_CONTEXT_MISSING":"LOG_ERROR", "_X_AMZN_TRACE_ID":"Root=1-59274f44-71756c3273bfaf4895cd5610;Parent=4126596e259f5d9f;Sampled=0", "AWS_EXECUTION_ENV":"AWS_Lambda_nodejs6.10", "_HANDLER":"enigma.handler", "NODE_PATH":"/var/runtime:/var/task:/var/runtime/node_modules", "AWS_ACCESS_KEY_ID":"REMOVINGTHIS", "AWS_SECRET_ACCESS_KEY":"ALSOREMOVINGTHIS", "AWS_SESSION_TOKEN":"REMOVINGTHISTOO" }

kentonv 9y ago
... Are those actually Twilio's keys, or are they creating a new Lambda instance (with its own private access keys) for each customer? Maybe they actually intend for people to be able to use all the functionality of Lambda, some of which (I guess) requires using the AWS access key? Or are people naively assuming their own Lambda container is a reasonable sandbox for third-party code? If so, yikes.
- poolsh4rk 9y ago
  While it seems concerning on the service, you have to imagine twilio made a conscious decision not to wipe the env variables, just as aws don't. If you think about this product, you are paying for the service, so if you tried anything malicious, at worst you would do is impact yourself, and ultimately pick up a bill for your usage at the end of month, heh.
- idbehold 9y ago
  It's likely using an IAM role with no permissions other than writing logs to CloudWatch.
  - kentonv 9y ago
    OK, so they're effectively reselling Lambda, and creating a new Lambda account for each Twilio customer under the hood?
    - idbehold 9y ago
      It could all be under the same AWS account, and all using the same IAM role. It's just that the role doesn't have access to anything. It can write logs to its own function-specific log group and read from them potentially. Also, a hell of a lot of work went into this feature. You can try setting this infrastructure up yourself if you think it will save you money. You already know they're using Lambda!
      - kentonv 9y ago
        My comment wasn't intended as an attack. I was just curious about their approach to sandboxing, as it's my area of expertise. Sometimes systems that are secure with two parties become horribly insecure when you add a third. I don't know a lot about IAM but generally I'd be very cautious about using standard access control mechanisms to implement sandboxing while running the code "in your account", as often you find resources are made available to "the whole account" with no further access control settings, because the system designers didn't imagine customers running true third-party code. That said Amazon has some pretty thorough access control features and I'm sure Twilio has looked into it and figured out something reasonable.
    - philsnow 9y ago
      > they're effectively reselling Lambda Another take on this is that they're creating value for customers by shifting the reliability requirements from the customers themselves to AWS / lambda ... which I think is brilliant.
deleted 9y ago
[deleted]
shakes 9y ago
Hey, Ricky from Twilio here. In this case, while these environment variables appear to be sensitive, they are ephemeral keys, uniquely issued to the Function as part of running within Lambda. Their associated actions and permissions have been reviewed, approved and are required to run the Function. There is no risk of any Twilio customer’s Function being accessed or modified by disclosure of these keys. That said, we much appreciate the community raising potential concerns. If y’all ever see anything that looks like a vulnerability, we’d love for you to submit it to our Bug Bounty program: https://bugcrowd.com/twilio https://bugcrowd.com/twilio
- revicon 9y ago
  Thanks for letting us know Ricky, it's great to see new functionality being released so often on Twilio. Playing with functions for a bit today, it would be great to be able to add additional nodejs libraries, is that a feature coming up any time soon?
  - deleted 9y ago
    [deleted]
  - shakes 9y ago
    Stoked to hear you've been playing with it. I can't make any promises on roadmap yet but we're excited to get feedback from the community while we're in public beta to help shape what Functions become for GA. If you keep hacking with it and have thoughts feel free to drop me an e-mail (ricky AT twilio.com).
  - woloski 9y ago
    It is great to see that the industry is moving from webhooks to Functions. We've seen this model succeed at Auth0 with our Rules feature [1] implemented 3 years ago. Recently productized this experience with Auth0 Extend [2]. It supports all node modules, a one-line of js emebeddable Editor, real time logs, vault to store secrets, custom programming models and crons. [1] https://auth0.com/docs/rules https://auth0.com/docs/rules [2] https://auth0.com/extend/developers https://auth0.com/extend/developers
djhworld 9y ago
I wonder how they're doing this, are they invoking the Lambda functions using the synchronous API, or are they using something like API gateway? From what I can tell API gateway costs $3.50 a month per 1m calls, so unless they've negotiated some deal with AWS or something...

kentonv 9y ago

... Are those actually Twilio's keys, or are they creating a new Lambda instance (with its own private access keys) for each customer? Maybe they actually intend for people to be able to use all the functionality of Lambda, some of which (I guess) requires using the AWS access key? Or are people naively assuming their own Lambda container is a reasonable sandbox for third-party code? If so, yikes.

poolsh4rk 9y ago
While it seems concerning on the service, you have to imagine twilio made a conscious decision not to wipe the env variables, just as aws don't. If you think about this product, you are paying for the service, so if you tried anything malicious, at worst you would do is impact yourself, and ultimately pick up a bill for your usage at the end of month, heh.
idbehold 9y ago
It's likely using an IAM role with no permissions other than writing logs to CloudWatch.
- kentonv 9y ago
  OK, so they're effectively reselling Lambda, and creating a new Lambda account for each Twilio customer under the hood?
  - idbehold 9y ago
    It could all be under the same AWS account, and all using the same IAM role. It's just that the role doesn't have access to anything. It can write logs to its own function-specific log group and read from them potentially. Also, a hell of a lot of work went into this feature. You can try setting this infrastructure up yourself if you think it will save you money. You already know they're using Lambda!
    - kentonv 9y ago
      My comment wasn't intended as an attack. I was just curious about their approach to sandboxing, as it's my area of expertise. Sometimes systems that are secure with two parties become horribly insecure when you add a third. I don't know a lot about IAM but generally I'd be very cautious about using standard access control mechanisms to implement sandboxing while running the code "in your account", as often you find resources are made available to "the whole account" with no further access control settings, because the system designers didn't imagine customers running true third-party code. That said Amazon has some pretty thorough access control features and I'm sure Twilio has looked into it and figured out something reasonable.
  - philsnow 9y ago
    > they're effectively reselling Lambda Another take on this is that they're creating value for customers by shifting the reliability requirements from the customers themselves to AWS / lambda ... which I think is brilliant.

deleted 9y ago

[deleted]

shakes 9y ago

Hey, Ricky from Twilio here. In this case, while these environment variables appear to be sensitive, they are ephemeral keys, uniquely issued to the Function as part of running within Lambda. Their associated actions and permissions have been reviewed, approved and are required to run the Function. There is no risk of any Twilio customer’s Function being accessed or modified by disclosure of these keys. That said, we much appreciate the community raising potential concerns. If y’all ever see anything that looks like a vulnerability, we’d love for you to submit it to our Bug Bounty program: https://bugcrowd.com/twilio https://bugcrowd.com/twilio

revicon 9y ago
Thanks for letting us know Ricky, it's great to see new functionality being released so often on Twilio. Playing with functions for a bit today, it would be great to be able to add additional nodejs libraries, is that a feature coming up any time soon?
- deleted 9y ago
  [deleted]
- shakes 9y ago
  Stoked to hear you've been playing with it. I can't make any promises on roadmap yet but we're excited to get feedback from the community while we're in public beta to help shape what Functions become for GA. If you keep hacking with it and have thoughts feel free to drop me an e-mail (ricky AT twilio.com).
- woloski 9y ago
  It is great to see that the industry is moving from webhooks to Functions. We've seen this model succeed at Auth0 with our Rules feature [1] implemented 3 years ago. Recently productized this experience with Auth0 Extend [2]. It supports all node modules, a one-line of js emebeddable Editor, real time logs, vault to store secrets, custom programming models and crons. [1] https://auth0.com/docs/rules https://auth0.com/docs/rules [2] https://auth0.com/extend/developers https://auth0.com/extend/developers

djhworld 9y ago

I wonder how they're doing this, are they invoking the Lambda functions using the synchronous API, or are they using something like API gateway? From what I can tell API gateway costs $3.50 a month per 1m calls, so unless they've negotiated some deal with AWS or something...