4 ms·

How much of this is a holdover of lax security practices from before they were acquired? I can’t imagine AWS being managed in a way where local network access g

by koolba 5y ago

How much of this is a holdover of lax security practices from before they were acquired? I can’t imagine AWS being managed in a way where local network access gives you keys to the kingdom. Then again, EC2 instance profiles do let you do quite a bit.

lamontcg 5y ago
Conflating AWS security with twitch security is probably the wrong way to think about it. Within Amazon those are almost going to be two entirely separate companies, with very different security focuses. The idea that Amazon is monolithic and uniform wasn't true when I left there in 2006, and I'm certain it is less so now. And that isn't just that its related to the merger, but that fundamentally its different business orgs with different focus.
- vineyardmike 5y ago
  But does twitch not share the same Amazon wide git service? Could most of Amzn code be leaked or compromised? Seems like all of amazon internals that shares security measures is at risk...
  - cheeze 5y ago
    I've heard (but don't have any actual evidence more than hearsay) that Twitch generally operates independently of Amazon/AWS. I'm sure that they share some things, but I wouldn't be surprised if their source was separate from the "main repo"
  - bleepblooop 5y ago
    Remember that Amazon runs one of the biggest multi-tenant service platforms in the industry! A separate business unit like Twitch is likely to be set up a lot like any other random AWS customer, and you wouldn't expect that compromising servers used by one AWS customer to automatically compromise the underlying infrastructure. (I would also expect that the Amazon retail systems are in most senses "just another tenant" on AWS, albeit with much more liberal quotas!)
ganoushoreilly 5y ago
If you go back to the Adobe software breach circa 2013, a large part of their issues were the bolt on connections between acquisitions. It's honestly the most common thing I see in the startup world.
this_user 5y ago
I always had the impression that Twitch were operating in a largely independent fashion. For instance, it had been an open secret for years that one of their executives had been sexually harassing female streamers. Only a year ago he was finally fired. If Amazon had a firmer grip on Twitch, I'm sure they would have stepped in much earlier.

by koolba 5y ago

lamontcg 5y ago

Conflating AWS security with twitch security is probably the wrong way to think about it. Within Amazon those are almost going to be two entirely separate companies, with very different security focuses. The idea that Amazon is monolithic and uniform wasn't true when I left there in 2006, and I'm certain it is less so now. And that isn't just that its related to the merger, but that fundamentally its different business orgs with different focus.

vineyardmike 5y ago
But does twitch not share the same Amazon wide git service? Could most of Amzn code be leaked or compromised? Seems like all of amazon internals that shares security measures is at risk...
- cheeze 5y ago
  I've heard (but don't have any actual evidence more than hearsay) that Twitch generally operates independently of Amazon/AWS. I'm sure that they share some things, but I wouldn't be surprised if their source was separate from the "main repo"
- bleepblooop 5y ago
  Remember that Amazon runs one of the biggest multi-tenant service platforms in the industry! A separate business unit like Twitch is likely to be set up a lot like any other random AWS customer, and you wouldn't expect that compromising servers used by one AWS customer to automatically compromise the underlying infrastructure. (I would also expect that the Amazon retail systems are in most senses "just another tenant" on AWS, albeit with much more liberal quotas!)

ganoushoreilly 5y ago

If you go back to the Adobe software breach circa 2013, a large part of their issues were the bolt on connections between acquisitions. It's honestly the most common thing I see in the startup world.

this_user 5y ago

I always had the impression that Twitch were operating in a largely independent fashion. For instance, it had been an open secret for years that one of their executives had been sexually harassing female streamers. Only a year ago he was finally fired. If Amazon had a firmer grip on Twitch, I'm sure they would have stepped in much earlier.