5 ms·
I could have had this a few weeks ago, when I realised popular S3 integration tool `django-storages` sets all objects' ACL as public-read by default: https://d
by fredley 8y ago
I could have had this a few weeks ago, when I realised popular S3 integration tool `django-storages` sets all objects' ACL as public-read by default:
https://django-storages.readthedocs.io/en/latest/backends/amazon-S3.html https://django-storages.readthedocs.io/en/latest/backends/am...
- cbg0 8y agoCan't really fault Amazon or the Django library for you not reading the docs.
- geofft 8y agoI am 100% willing to fault software for bad defaults regardless of how they document those defaults.
- nscalf 8y agoAbsolutely agree. Telling people of your bad design is still bad. Especially when "telling people" happens in a flood of other noise, like one line in documentation on a whole tool.
- Alex3917 8y ago> Telling people of your bad design is still bad. IIRC the person who took over maintenance and added that warning isn't the one who created the tool.
- fredley 8y agoDefault-insecure is bad design almost anywhere I can think of (and Django Storages is changing their default in the next version - they realised it's probably not best as it is).
- jon_richards 8y agoThat got fixed. Default behaviour is now to use the bucket's default.