4 ms·

I can't trust myself using S3 (or any other AWS service). Nothing is straightforward, there are too many things going on, too much documentation that I should r

I can't trust myself using S3 (or any other AWS service). Nothing is straightforward, there are too many things going on, too much documentation that I should read, and even then (as OP shows) I may be accidentally and unknowingly expose everything to the world. I think I'll stick to actually simple services, such as Hetzner Storage Boxes or DigitalOcean Spaces.

chamomeal 2y ago
I like digital ocean spaces, but it has its own annoying quirks. Like I recently found out yif you pipe a video file larger than a few MB, it’ll drop the https:// https:// from the returned Location. So on every file upload I have to check if the location starts with https, and add it on if it’s not there. Of course the S3 node client GitHub issue says “sounds like a digital ocean bug”, and the digital ocean forums say “sounds like an S3 node client bug” lol
slig 2y ago
The way that DO handles secrets should scare anyone. Did you know that if you use their Container Registry and set it up so that your K8S has automatically access to it, their service will create a secret that has full access to your Spaces?
- marcosdumay 2y ago
  Hum... Kubernetes is not on the GP's list...
  - slig 2y ago
    Fair enough, but not having scoped secrets is a red flag.
maximinus_thrax 2y ago
> Nothing is straightforward, there are too many things going on, too much documentation that I should read, and even then (as OP shows) I may be accidentally and unknowingly expose everything to the world. I took a break from cloud development for a couple of years (working mostly on client stuff) and just recently got back. I am shocked at the amount of complexity built over the years along with the cognitive load required for someone to build an ironclad solution in the public cloud. So many features and quirks which were originally designed to help some fringe scenario are now part of the regular protocol, so that the business makes sure nobody is turned away.

chamomeal 2y ago

I like digital ocean spaces, but it has its own annoying quirks. Like I recently found out yif you pipe a video file larger than a few MB, it’ll drop the https:// https:// from the returned Location. So on every file upload I have to check if the location starts with https, and add it on if it’s not there. Of course the S3 node client GitHub issue says “sounds like a digital ocean bug”, and the digital ocean forums say “sounds like an S3 node client bug” lol

slig 2y ago

The way that DO handles secrets should scare anyone. Did you know that if you use their Container Registry and set it up so that your K8S has automatically access to it, their service will create a secret that has full access to your Spaces?

marcosdumay 2y ago
Hum... Kubernetes is not on the GP's list...
- slig 2y ago
  Fair enough, but not having scoped secrets is a red flag.

maximinus_thrax 2y ago

> Nothing is straightforward, there are too many things going on, too much documentation that I should read, and even then (as OP shows) I may be accidentally and unknowingly expose everything to the world. I took a break from cloud development for a couple of years (working mostly on client stuff) and just recently got back. I am shocked at the amount of complexity built over the years along with the cognitive load required for someone to build an ironclad solution in the public cloud. So many features and quirks which were originally designed to help some fringe scenario are now part of the regular protocol, so that the business makes sure nobody is turned away.