91–100 of 148 posts
In both cases, the UI and UX designers should be shot. I understand that they are supporting a lot of complicated things. It's a huge fail, unusable by anyone who hasn't dedicated their lives to learning.
Any decent api should have some kind of signatures which work roughly like:
signature = hmac_sha256(secret, url+payload+time+etc)
set_header(…, auth_header(signature))
Most of the mess seems to be due to AWS wanting to limit the power of the secrets that they store, presumably in case they’re compromised. You can get a reasonably good idea of their architecture by looking at how you construct the derived secret – each inner layer will be more tightly controlled than the one around it.
If you don't use the SDK, how can you judge anything as being "overly complicated"? I mean, I don't know about you, but, last time I checked, signatures, certificates, security and all that stuff IS SUPPOSED to be super complicated because it's a subject with a very high inherent complexity in and of itself. The SDK exists and is well designed to precisely shield you from said complexity. If you deliberately choose n…
Actually, security is not supposed to be complicated. "Complicated" is the anti-thesis of "secure".
They just need a “simple” mode that cuts out all of the verbose stuff
Earlier quoted context omitted.
I envy you. I am using a simple S3 bucket to serve image files. We’re getting close to busting the free tier web traffic limit. I can’t figure out where, or how, to enter my boss’s credit card so we can start paying for the service. I’m not kidding. I’ve looked everywhere. Several times. I’ve probably spent two hours on this.
How can you even get started with AWS without entering payment details? I would love to use AWS for personal projects if I could guarantee it will just stop service outright I stead of charging me.
Ah that's nothing. Simple problem from a high level: static web site on apex domain. What you should be able to do: Click click done. Upload files to S3. Point CNAME at AWS. What you have to do: Create an S3 bucket and stick the files in it. Create a zone in Route 53 and import your old zone file. Change your nameservers at the registrar. Wait a bit. Go to ACM in the correct region and create a cert. Tell it to add t…
I prefer log into Hostgator, click cPanel, click File Manager, drag files across. Any day! Ok I missed: point DNS to Hostgator name servers. Click the button to install lets encrypt.
Earlier quoted context omitted.
We get our customers to upload to S3 directly so we don't have to handle their ingress traffic through our infra. Problems involve mostly when the client cocks up as it's near impossible to distinguish between broken files and good ones. This leads to the assumption that the clients have uploaded a file and they haven't.
If you know the file hash beforehand, you can encode that into the signed URL. But if you’re saying clients will upload the wrong file, then that’s not really AWS’s fault is it? If you’re saying the file itself is corrupted, I’m not sure how? The upload should fail if the content length is incorrect, and s3 doesn’t make the contents visible unless the upload completes.
First, most users are using the SDK that Amazon provides. But second, most of this complexity is in the name of security. I have plenty of criticism of my former employer (Amazon), but I have never once felt that AWS didn't take security seriously. Use the SDK. Be happy that it will keep your calls very secure.
Because of their size they are a very interesting target for cyber-criminals. If Amazon wouldn’t make security a top priority it would all tumble down pretty quickly.
The reality is is that what AWS is doing here is all fully justified and normal, and that’s why SDKs exist. Like many developers, you’re being a bit clueless about security here. Instead of complaining, I recommend educating yourself - look into capability security and signed tokens in general, and you’ll understand what AWS is doing and it’ll make you a better developer.