4 ms·

This is because, I assume, the AWS policy execution has a number of “operators” and “operands”, and in this case, you’re using the StringLike operand on the acc

This is because, I assume, the AWS policy execution has a number of “operators” and “operands”, and in this case, you’re using the StringLike operand on the account ID string. Anyway, this discussion is a bit amusing to me, since Devops people are discovering side channels[1] now, although other types of side channels such as speculative execution side channels on CPUs (Meltdown, Spectre) already made waves at the time of discovery, and before that we had power analysis[2] and Magnetostriction detection, and constant time cryptography (this one is a field of its own, so I omit references.) [1] https://en.m.wikipedia.org/wiki/Side-channel_attack https://en.m.wikipedia.org/wiki/Side-channel_attack [2] https://en.m.wikipedia.org/wiki/Power_analysis https://en.m.wikipedia.org/wiki/Power_analysis

paulddraper 3y ago
> the AWS policy execution has a number of “operators” and “operands” That is correct. The IAM condition language is flexible and does not prevent you from doing strange things.
- jameshart 3y ago
  It’s a consequence of weak typing choices - not an inevitable result of allowing flexibility. Doing glob matching on account IDs is like doing concatenation with guids, applying a bitshift to a UTF8 string, or running a regex on an integer. It is a nonsensical operation, and - as shown here - results in surprising security properties of the resulting system. Surprising security properties are an undesirable result in an access control policy language.
  - paulddraper 3y ago
    Of course it's possible to create a more sophisticated system with less possibility for user error.
  - asdfaoeu 3y ago
    They have ARN's which include the account which a glob match is useful. Something like "arn:aws:*:*:1234567890:*" is useful but "arn:aws:*:*:1234567*:*" isn't
darkwater 3y ago
> Anyway, this discussion is a bit amusing to me, since Devops people are discovering side channels[1] We, the DevOps people, already knew about side channel attacks, Spectre and the likes, evaluated the performances hit for the fixes (or alleged fixes), patched our kernel boot params etc etc. We are curious people, just like many here.
- zer00eyz 3y ago
  Jesus, I have been in tech for 25 years and we're still throwing shit across this divide. Well we are, if nothing, consistent. The next nerd who pinches and inch of the coder/ops divide is going to make a billion.
  - staplers 3y ago
    Figma did this for design-dev and is worth about $40 billion. It's amazing how anything got made considering how disjointed processes used to be.
    - msie 3y ago
      Only worth about 10 billion. But still a lot!
      - staplers 3y ago
        The deal was for $20b my mistake.
        lasean 3y ago
        The Adobe deal didn't go through. Last publicly hinted valuation was back at ~$10B when employee share buyouts happened in JAN 2024.
  - darkwater 3y ago
    ¯\_(ツ)_/¯ Not GP, I tried to answer as friendly as possible. Their approach is even more weird given that Security goes really hand in hand with systems infrastructure In any small enough organization, security will be managed by devops/sre. If the org becomes large enough, it will start dedicating people to Security.

paulddraper 3y ago

> the AWS policy execution has a number of “operators” and “operands” That is correct. The IAM condition language is flexible and does not prevent you from doing strange things.

jameshart 3y ago
It’s a consequence of weak typing choices - not an inevitable result of allowing flexibility. Doing glob matching on account IDs is like doing concatenation with guids, applying a bitshift to a UTF8 string, or running a regex on an integer. It is a nonsensical operation, and - as shown here - results in surprising security properties of the resulting system. Surprising security properties are an undesirable result in an access control policy language.
- paulddraper 3y ago
  Of course it's possible to create a more sophisticated system with less possibility for user error.
- asdfaoeu 3y ago
  They have ARN's which include the account which a glob match is useful. Something like "arn:aws:*:*:1234567890:*" is useful but "arn:aws:*:*:1234567*:*" isn't

darkwater 3y ago

> Anyway, this discussion is a bit amusing to me, since Devops people are discovering side channels[1] We, the DevOps people, already knew about side channel attacks, Spectre and the likes, evaluated the performances hit for the fixes (or alleged fixes), patched our kernel boot params etc etc. We are curious people, just like many here.

zer00eyz 3y ago
Jesus, I have been in tech for 25 years and we're still throwing shit across this divide. Well we are, if nothing, consistent. The next nerd who pinches and inch of the coder/ops divide is going to make a billion.
- staplers 3y ago
  Figma did this for design-dev and is worth about $40 billion. It's amazing how anything got made considering how disjointed processes used to be.
  - msie 3y ago
    Only worth about 10 billion. But still a lot!
    - staplers 3y ago
      The deal was for $20b my mistake.
      - lasean 3y ago
        The Adobe deal didn't go through. Last publicly hinted valuation was back at ~$10B when employee share buyouts happened in JAN 2024.
- darkwater 3y ago
  ¯\_(ツ)_/¯ Not GP, I tried to answer as friendly as possible. Their approach is even more weird given that Security goes really hand in hand with systems infrastructure In any small enough organization, security will be managed by devops/sre. If the org becomes large enough, it will start dedicating people to Security.