4 ms·

I have nothing against Capital One, but I must say that Netflix published this article in November 2018: https://medium.com/netflix-techblog/netflix-information

I have nothing against Capital One, but I must say that Netflix published this article in November 2018: https://medium.com/netflix-techblog/netflix-information-security-preventing-credential-compromise-in-aws-41b112c15179 https://medium.com/netflix-techblog/netflix-information-secu... I would expect folks to be prepared for this kind of vulnerability. Anyway the repo is for educational purposes and it's sarcastic name is, well, saracastic. Cap One is a great technology company.

giggzy2 7y ago
Interestingly, the author of that Netflix article had joined CaptitalOne about a month before the incident.
- jcims 7y ago
  CapOne also maintains Cloud Custodian, which a lot of people use to great effect to help prevent stuff like this. Ultimately I think it just shows that securing cloud infrastructure is difficult to do consistently when you move quickly and broadly at scale. It also shows that the specific mechanism for authenticating EC2 instances had some design issues. These have been known about for a long time of course and it is kind of disappointing how long it took AWS to do something about it.
  - kapilvt 7y ago
    Cloud custodian is maintained by the community, capitalone has not had any maintainers on staff for around a year, though they still use and occasionally contribute prs. The major contributors and maintainers over the last year have been the cloud providers. The community has been working with capitalone to move it into cncf in 2020.
    - jcims 7y ago
      I stand corrected by an authority on the subject. :)
    - 616c 7y ago
      Huge fan working with you on one issue and glad to see you are everywhere setting the record straight, Kapil!
hnews_account_1 7y ago
Isn't netflix's tech implementation exceptionally good? I've heard much praise about how much they've leveraged python in their systems. I'd expect them to be much more on top of their security than financial companies, a fair few of which were still sending unencrypted emails as late as 2016 (at least out in India). I'm not sure if capital one is better than the rest of the crowd in some way though.

giggzy2 7y ago

Interestingly, the author of that Netflix article had joined CaptitalOne about a month before the incident.

jcims 7y ago
CapOne also maintains Cloud Custodian, which a lot of people use to great effect to help prevent stuff like this. Ultimately I think it just shows that securing cloud infrastructure is difficult to do consistently when you move quickly and broadly at scale. It also shows that the specific mechanism for authenticating EC2 instances had some design issues. These have been known about for a long time of course and it is kind of disappointing how long it took AWS to do something about it.
- kapilvt 7y ago
  Cloud custodian is maintained by the community, capitalone has not had any maintainers on staff for around a year, though they still use and occasionally contribute prs. The major contributors and maintainers over the last year have been the cloud providers. The community has been working with capitalone to move it into cncf in 2020.
  - jcims 7y ago
    I stand corrected by an authority on the subject. :)
  - 616c 7y ago
    Huge fan working with you on one issue and glad to see you are everywhere setting the record straight, Kapil!

hnews_account_1 7y ago

Isn't netflix's tech implementation exceptionally good? I've heard much praise about how much they've leveraged python in their systems. I'd expect them to be much more on top of their security than financial companies, a fair few of which were still sending unencrypted emails as late as 2016 (at least out in India). I'm not sure if capital one is better than the rest of the crowd in some way though.