3 ms·
It seems like providing sane, secure defaults would be more effective. But that would probably destroy the onboarding experience, how many tech firms release b
by tomc1985 4y ago
It seems like providing sane, secure defaults would be more effective.
But that would probably destroy the onboarding experience, how many tech firms release big products that should have authentication but really don't because of "ease of use"?
(Here's looking at you, ElasticSearch. Did they finally fix this?)
- ghostpepper 4y agowhen I installed an ELK stack recently it took a fair bit of effort to get it secured but at least there were big scary warnings that it wasn't
- vorpalhex 4y agoIn s3 you not only have to mark the bucket as public, but also toggle a safety switch allowing the bucket to be made public, and you have to write an ACL policy allowing public access, and you will get a monthly email from AWS reminding you that this bucket is setup for public access. Oh, and the bucket has the word "public" next to it. Like, what more can AWS do? Require a blood sacrifice? Call your boss?
- isbvhodnvemrwvn 4y agoAlso there's an account-level switch that can prevent any bucket from going public.
- tomc1985 4y agoGood, because the last time I used s3 (years ago) IIRC it seemed like public was the default