4 ms·
I worked on a product that required DNS changes to set up. Especially for business accounts, the level of friction was STUNNING. We had it take months to get se
by zippergz 3y ago
I worked on a product that required DNS changes to set up. Especially for business accounts, the level of friction was STUNNING. We had it take months to get set up because the contact had to submit a ticket to IT, write up the business justification, get director level approval, get security approval, and so on before it could get done. We had customers who couldn't even figure out which group in their company managed DNS. Yeah, you can argue that those companies are broken, but as an outsider I have no influence over that. The result was just that they couldn't use our product. On the flip side, we had consumer and small business customers who had purchased domains through simple webhosting things that didn't give them the required level of access to create a record (and/or they couldn't figure out how to do it). We eventually added an HTTP option and the success rate and time to success both improved hugely.
- reaperducer 3y agoEspecially for business accounts, the level of friction was STUNNING. Honestly, that's a feature, not a bug.
- unethical_ban 3y ago[flagged]
- CydeWeys 3y agoAnything touching the DNS records for the root of your entire web presence is not simple and needs substantial review.
- unethical_ban 3y agoAdding a new DNS record for a new, specific purpose is simple and low-impact, technically.
- UncleEntity 3y ago…which gets promptly forgotten about after it’s initial use case and years later your user database gets sold on the internet. How many “low-impact” things have been compromised over the years, I wonder?
- unethical_ban 3y agoUnless you have anyone competent running the DNS config, or have a ticketing workflow of any kind, and I can't figure out what you think a DNS record with a onetime validation token could do if left unmanaged beyond some adversary discovery.
- throwaway60607 3y agoThat's exactly why DNS verification is a overkill.
- belltaco 3y agoFor representing and verifying identity, it should need director level approval.
- unethical_ban 3y agoYes.
- iudqnolq 3y agoThat's an overly technical way of looking at things. This issue is a whoopsie, not a catastrophic failure at AWS. It doesn't actually represent identity that much because anything critical has humans in the loop. The bank won't accept this as proof of identity. NYT won't accept this as proof of identity: if this bluesky account confessed AWS murders puppies NYT would call somebody they know at Amazon to check. A company blog is a much bigger vulnerability when it comes to representing and verifying identity. Rather than let somebody fake identify to a computer system it allows faking identity to humans reading it. Yet I don't think most places require director signoff to post.
- themagician 3y agoNot in an economy that demands rapid, scalable, and infinite growth.
- reaperducer 3y ago[flagged]
- themagician 3y agoFair enough.
- throwaway892238 3y agoDoesn't capitalism demand infinite growth? If you don't have >= 2% YoY, the market thinks you're dead
- reaperducer 3y agoDoesn't capitalism demand infinite growth? If you don't have >= 2% YoY, the market thinks you're dead No, it doesn't. There are plenty of businesses, and even entire industries that have operated for centuries on less than 2% growth. And yet somehow the world kept turning.