3 ms·
Right, but the owner of the domain needs to create a CNAME record that points to AWS for a bucket they don't control. How is that not purely on them?
by fastball 5y ago
Right, but the owner of the domain needs to create a CNAME record that points to AWS for a bucket they don't control. How is that not purely on them?
- Sebb767 5y agoThe bucket can be created before they can do so, which is exactly what happened to MarkMonitor here. Now, technically you could create the bucket first before setting the CNAME, but this can quickly go wrong (especially when handling hundreds of domains) and it regularly does. There's no need to keep this footgun around.
- ctvo 5y agoS3 is not a CDN. S3 is a distributed file system. Use a CDN for CDN use cases (CloudFront) and you wouldn't have these issues. There's a chance a normal AWS user may not understand the above distinction, a sophisticated actor like MarkMonitor (whose business is THIS) should. Instead they had a security incident. That's it. They used the wrong AWS service. They configured massive numbers of domain DNS records incorrectly. They risked their customer's reputations.
- detaro 5y agoIf thousands of people keep making a mistake when using your product, you can go "purely on them, not our problem", true. Or you can do something to your product to make the mistake less likely to cause a problem.