Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon S3 Path Deprecation Plan – The Rest of the Story

aws.amazon.com

Post reply on HN
Print view View original

141–146 of 146 posts

Re: Amazon S3 Path Deprecation Plan – The Rest of the Story

#141

Post by scoot »

no_identd wrote: post #114
gumby wrote: post #111

Earlier quoted context omitted.

The fact the tcp (and it’s own institutional infrastructure) were already established is what made the whole OSI network effort even more enjoyably absurd. It was the last gasp of Big IT trying to take over the crazies. Most amusingly to me, it seemed only to be discussed in enterprise contexts and Very Important IT Journals. Such people were officially committed to deployment, while their own people were busy gettin…

You both get so much of this story so utterly… /not even/ __quite__ wrong, but more importantly, leave so much detail out that, if I didn't presume better(which I do! Would seem rather paranoid if I didn't.), I'd suspect lying by omission. All of this, which includes the story to follow, makes me—and I don't say this for exaggeration purposes, it really does have an emotional impact—very sad, although it doesn't surp…

> You both get so much of this story so utterly… /not even/ __quite__ wrong

Sorry, but no. It is perfectly factual.

> leave so much detail

I was on mobile (hence the typo). I included the level of detail necessary to make my point.

Speaking of points – did you have one?

Re: Amazon S3 Path Deprecation Plan – The Rest of the Story

#142

Post by inopinatus »

jasonkester wrote: post #112
inopinatus wrote: post #83

Earlier quoted context omitted.

If we're talking textbooks, well then. This is a textbook case for the 301 HTTP response code.

The old REST-style S3 URLs are specifically excluded from being able to redirect: https://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-page-... You can create a new bucket or switch your existing one to "Static Website Hosting" mode to enable the ability to 301 your content going forward. But the URL for the "website" version isn't the same as the REST URL. And again, there's no way to redirect from the old naming…

This isn't a restriction if you're AWS and looking to give more customers a soft landing over an extended deprecation timeframe.

The certificate concern some are raising is also a furphy.

Re: Amazon S3 Path Deprecation Plan – The Rest of the Story

#143

Post by [deleted] »

masklinn wrote: post #124
inopinatus wrote: post #83

Earlier quoted context omitted.

If we're talking textbooks, well then. This is a textbook case for the 301 HTTP response code.

Except for all the dotted bucket names which can't be redirected because the result will always trigger a certificate error.

[deleted]

Re: Amazon S3 Path Deprecation Plan – The Rest of the Story

#144

Post by AdamJacobMuller »

masklinn wrote: post #124
inopinatus wrote: post #83

Earlier quoted context omitted.

If we're talking textbooks, well then. This is a textbook case for the 301 HTTP response code.

Except for all the dotted bucket names which can't be redirected because the result will always trigger a certificate error.

That's not inherently accurate.

You can do inline generation of LetsEncrypt certificates with bucket-name-specific CN/SAN.

The fact that bucket names could contain characters which are wholly invalid as DNS labels is a bigger issue.

Re: Amazon S3 Path Deprecation Plan – The Rest of the Story

#145

Post by Ettvatre »

lugg wrote: post #72
Ettvatre wrote: post #68

Earlier quoted context omitted.

Couldn't they just middle-man the traffic and block specific URLs?

ssl prevents that.

I thought countries who did this already issued their own certs to be able to analyze traffic. Like China. Maybe I misunderstood.

Re: Amazon S3 Path Deprecation Plan – The Rest of the Story

#146

Post by cthalupa »

lugg wrote: post #106
cthalupa wrote: post #85

Earlier quoted context omitted.

It explicitly does not. It means there are additional barriers to doing it - people would need to accept a bad cert (we already know the overwhelming majority will), or they would need to slip in their own CA that allows them to generate their own valid certs for MITM, but that is eminently doable for the Chinese government inside of China. They can then block all traffic for people that do not use the cert that allo…

That's not what explicitly means. Ssl explicitly does prevent mitm attacks from intercepting URLs of requests. The fact you can get around it by ignoring the cert is a bit irrelevant. It's like saying locks don't work because people can break your window.

As noted, you don't have to ignore the cert, and we're talking about state level actors.

And it's not the window. It's like saying locks don't work if the state has a master key, which they do.

Post reply on HN