Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In Digital Ocean, S3-like space keys can access all your buckets

ideas.digitalocean.com

Post reply on HN
Print view View original

81–90 of 104 posts

Re: In Digital Ocean, S3-like space keys can access all your buckets

#81

Post by plagiarist »

Operyl wrote: post #77
plagiarist wrote: post #75

Earlier quoted context omitted.

Yeah, I read a bit further and it was not scrub by default but had to be opt-in. And today is the first I heard that all API keys have ridiculous access. I'm done. Now I just need to find a cloud hosting service that will do a low cost easy k8s cluster, preferably not AWS.

Looks like OVH does managed k8s, and they're pretty solid at this point for the most part. https://us.ovhcloud.com/public-cloud/kubernetes/

Thank you, I didn't know they did. That puts them top-of-list for me.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#82

Post by supriyo-biswas »

pizzafeelsright wrote: post #69
slig wrote: post #21

Why the smaller players can't figure this out? Are they inventing their own S3-compatible storage or using a open source project underneath if?

Painful, slow, costly. Access request needs to be created, validated, logged, processed, expired or revoked. Or just validated, processed, and logged.

Minio can do this, so I don't see why RadosGW can't.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#83

Post by unilynx »

turtles3 wrote: post #71
csnweb wrote: post #33

Earlier quoted context omitted.

I agree, probably the biggest point Digitalocean is lacking. I think the only workaround is creating several projects? But that probably becomes annoying and hard to manage quite easily if you want a lot of separation.

IIRC projects only group resources under the same account. API keys are still account-wide, so projects provide no isolation there. There is a other mechanism DO has to allow multiple accounts under one billing context (I think it might be called 'teams'?) but sadly this is still extremely coarse grained, and doesn't allow you to lock a key down to a particular resource, or even a class of resources.

Teams have separate billing per team. Other platforms would call them ‘organization’

Re: In Digital Ocean, S3-like space keys can access all your buckets

#85

Post by ratg13 »

neom wrote: post #70
ratg13 wrote: post #64

Earlier quoted context omitted.

Even startups have to follow the law. Before the GDPR the EU had the 1995 Data Protection Directive, which you would have to comply with to have EU customers. You can’t just decide to not follow the law because you’re a startup.

What law would cover this??

I just told you in my previous comment..

In the event your google is broken:

----

https://en.wikipedia.org/wiki/Data_Protection_Directive

>the controller must implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#86

Post by roelvanhintum »

angra_mainyu wrote: post #24

Hmm, the only issue I've had with spaces is not being able to trivially serve a static site.

That is what Apps Platform is meant for. You can pick static as an option which, if i understand correctly, should do the same thing.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#87

Post by neom »

ratg13 wrote: post #85
neom wrote: post #70

Earlier quoted context omitted.

What law would cover this??

I just told you in my previous comment.. In the event your google is broken: ---- https://en.wikipedia.org/wiki/Data_Protection_Directive > the controller must implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of d…

https://en.wikipedia.org/wiki/Personal_data

Re: In Digital Ocean, S3-like space keys can access all your buckets

#88

Post by mootline »

I unfortunately had to ditch DigitalOcean because of a number of small problems like this (not taking permissions seriously is a symptom of a larger problem). Other issues included how you can't assign a floating IP to a load balancer, the managed kubernetes is embarassing (to resize nodes, you must destroy and recreate the whole cluster), paltry volumes IOPS, minimal support for DNS stuff, and more.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#89

Post by drogus »

dijksterhuis wrote: post #65
drogus wrote: post #49

Earlier quoted context omitted.

It's not about the API key. It's about the container registry credentials. Which you would expect to be able to only interact with the container registry. This is not the case. If you go to the container registry and click to download credentials you will get JSON like: {"auths":{"registry.digitalocean.com":{"auth":" "}}} If you decode the base64 encoded credentials it will be a string like " : " with either a read o…

> It's not about the API key. It's about the container registry credentials. Which you would expect to be able to only interact with the container registry. think my reply shortness maybe has you misunderstanding me? The fact that an API token can only have read/write project wide basically results in everything you said. No RBAC on services. No RBAC on specific API actions. Anyone with read+write can do/nuke everyth…

Ok, I see what you mean. Still, even knowing that general access tokens are all or nothing it was surprising that exactly the same thing was used for containers. Like, if you generate a separate credentials for containers it strongly suggests there are for containers only.

Re: In Digital Ocean, S3-like space keys can access all your buckets

#90

Post by kyledrake »

Aside from this, their Spaces service has had multiple outages, the service seems to be pretty unreliable in general (definitely compared to S3). A quick glance of their NYC3 status suggests they may have finally improved this recently, but I don't know what use case I would have for a version of S3 that goes down multiple times a year.
Post reply on HN