4 ms·

AWS, as a system, allowed this. AWS, its employees, made such a mistake. Pretending processes somehow don't involve people blindsides us to obvious problems in

AWS, as a system, allowed this. AWS, its employees, made such a mistake. Pretending processes somehow don't involve people blindsides us to obvious problems in real implementations. Possible lessons: Why is it so easy/tempting/overlookable to misconfigure a bucket that an AWS employee could do it? What lessons can we learn from, for instance, Google Apps, where you don't usually misconfigure your file share? Upguard's conclusions are what you should be taking away, not "AWS buckets are fine from a tech standpoint".

edoceo 8y ago
Defaults for AWS are not public. The UI recommends against turning it on. Sales people turn on Public so clients can see it w/o logging into some system. IMO an employee intentionally set a bucket with critical data to public. My original point that the title was misleading stands.
Terretta 8y ago
The Internet as a system allowed this deliberately public configuration, so the Internet is at fault. The World Wide Web as a system allowed this deliberately public configuration, so the web is at fault. AWS S3 as a system allowed this deliberately public configuration. So AWS S3 is at fault. None of those seem quite right. To me, seems more like AWS S3 isn’t designed for the higher level use case of sending a “shared secret” folder link by email to a collaborator, combined with a drinking the kool-aid tic where all employees try solving all use cases with the in-house hammer at hand. At the same time, I think AWS has made a mistake — putting a Web Console on top of an API driven infrastructure, and investing so much recently in trying to make the web UI more “usable”. AWS is not your father’s webmin VPS, but by now the console is so friendly, today’s sales guy can be forgiven for thinking S3 config and Dropbox config are the same thing.
- user5994461 8y ago
  Looks like a case for FTP. Does AWS provides FTP hosting? I think not.

edoceo 8y ago

Defaults for AWS are not public. The UI recommends against turning it on. Sales people turn on Public so clients can see it w/o logging into some system. IMO an employee intentionally set a bucket with critical data to public. My original point that the title was misleading stands.

Terretta 8y ago

The Internet as a system allowed this deliberately public configuration, so the Internet is at fault. The World Wide Web as a system allowed this deliberately public configuration, so the web is at fault. AWS S3 as a system allowed this deliberately public configuration. So AWS S3 is at fault. None of those seem quite right. To me, seems more like AWS S3 isn’t designed for the higher level use case of sending a “shared secret” folder link by email to a collaborator, combined with a drinking the kool-aid tic where all employees try solving all use cases with the in-house hammer at hand. At the same time, I think AWS has made a mistake — putting a Web Console on top of an API driven infrastructure, and investing so much recently in trying to make the web UI more “usable”. AWS is not your father’s webmin VPS, but by now the console is so friendly, today’s sales guy can be forgiven for thinking S3 config and Dropbox config are the same thing.

user5994461 8y ago
Looks like a case for FTP. Does AWS provides FTP hosting? I think not.